Great, but needs improvement

Bug: Widget fails with “Unexpected token ‘<‘, <!doctype” when WP REST API is blocked (e.g. by security plugins)

On many WordPress sites (especially those using security or optimization plugins like Clearfy Pro), the WordPress REST API (/wp-json/) is disabled for non-authenticated users.

When this happens, requests to /wp-json/openporte/v1/challenge return a 404 HTML page or a redirect instead of JSON. The widget script altcha.min.js fails to parse this response and crashes with the following console error: SyntaxError: Unexpected token '<', "<!doctype "... is not valid JSON

This completely breaks the widget on public forms (e.g. WooCommerce Login/Register, Elementor Forms).

Proposed Solution: Switch the fallback endpoint from get_rest_url to admin-ajax.php, which is almost never blocked by security plugins because too many frontend functionalities rely on it.

I’ve successfully tested this workaround by adding standard AJAX hooks and modifying get_challengeurl(). Here is the diff:

--- a/includes/core.php
+++ b/includes/core.php
@@ -301,7 +301,7 @@ class OpenPortePlugin
     if ($api === "custom") {
       $challenge_url = $this->get_api_custom_url();
     } else { /* default to selfhosted */
-      $challenge_url = get_rest_url(null, "/openporte/v1/challenge");
+      $challenge_url = admin_url('admin-ajax.php?action=openporte_challenge');
     }
 
     $challenge_url = apply_filters('openporte_challenge_url', $challenge_url);
@@ -722,4 +722,13 @@ function openporte_generate_challenge_endpoint()
   $resp->set_headers(array('Cache-Control' => 'no-cache, no-store, max-age=0'));
   return $resp;
 }
+
+add_action('wp_ajax_openporte_challenge', 'openporte_ajax_challenge');
+add_action('wp_ajax_nopriv_openporte_challenge', 'openporte_ajax_challenge');
+
+function openporte_ajax_challenge()
+{
+  $challenge = OpenPortePlugin::$instance->generate_challenge();
+  wp_send_json($challenge);
+}