=== CAPTCHAme ===
Contributors: alphadigitalagentur
Tags: captcha, spam, gdpr, dsgvo, antispam
Requires at least: 5.8
Tested up to: 7.0
Requires PHP: 7.4
Stable tag: 1.5.2
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Spam protection without cookies, without a consent banner and without data leaving Germany. Free, for any number of sites.

== Description ==

CAPTCHAme protects the forms of a WordPress site against automated submissions. The service runs on servers in Germany and sets no cookies. In most cases that means no entry in the consent banner is needed either.

Instead of picture puzzles, the visitor's browser solves an arithmetic task in the background. Only when something looks suspicious does a short input step follow: two digits that can be read only while they move, and that an image model cannot recognise from a still frame.

= Protected forms =

* Comments
* Log in
* Registration
* Lost password
* Contact Form 7
* WPForms
* YOOtheme Pro and other page builder forms (optional)

For your own forms there is the shortcode `[captchame]` as well as the functions `captchame_field()` and `captchame_verify()`.

= Privacy =

No cookies are set and no device profiles are built. The visitor's IP address is processed only as a pseudonym that changes daily, and it is not stored. When a form is submitted, a token is sent to captchame.de and checked there.

= Price =

Free, with no limit on the number of sites.

= Language =

The service is aimed at Germany, Austria and Switzerland, and the plugin's own interface is German. Translations are welcome through translate.wordpress.org.

== External Services ==

This plugin relies on CAPTCHAme, an external service. It cannot work without
it, because a submission is verified on the service, not on your site.

* Service: CAPTCHAme, https://captchame.de
* Provider: Alpha Digitalagentur GmbH, Rosenheim, Germany
* Terms of service: https://captchame.de/agb
* Privacy policy: https://captchame.de/datenschutz

The plugin causes six requests to that service. Four are made by the visitor's
browser, two by your own server.

**1. Widget script — visitor's browser**

`GET https://captchame.de/captchame.js`

Transmitted: whatever any HTTP request carries — IP address, user agent,
referrer. The plugin adds only its own version number as a query parameter, so
that browsers fetch the script again after an update.
When: on page load, and only on pages that actually contain a protected form.

**2. Widget configuration — visitor's browser**

`GET https://captchame.de/api/v1/config?sitekey=…`

Transmitted: your public site key, plus IP address and user agent.
When: when the widget starts.

**3. Challenge — visitor's browser**

`POST https://captchame.de/api/v1/challenge`

Transmitted: your public site key, the requested language, and a flag for
whether the accessible variant was asked for. Plus IP address and user agent.
When: when the widget starts.

**4. Solution — visitor's browser**

`POST https://captchame.de/api/v1/redeem`

Transmitted: the challenge identifier, the computed proof-of-work values, the
typed answer if an interactive step was shown, and four counters describing the
interaction: how many input events occurred in the form, how many milliseconds
passed between the widget starting and the solution being submitted, whether a
honeypot field was filled in, and whether the widget was ever visible on
screen. Plus IP address and user agent.
When: once the visitor's browser has solved the challenge, before the form is
submitted.

**5. Verification — your server**

`POST https://captchame.de/api/v1/siteverify`

Transmitted: your secret key, the one-time token that the widget placed in the
form, and — unless you switch the domain check off in the settings — the host
name of your site. The visitor's IP address is not part of this request.
When: on every submission of a protected form.

**6. Setup check — your server**

`GET https://captchame.de/api/v1/sitecheck?sitekey=…&hostname=…`

Transmitted: your public site key and the host name of your site. No visitor
data at all.
When: in the WordPress admin area only, so the plugin can warn you when the
keys do not match the domain. The result is stored and reused.

No cookies are set by any of these requests. The service does not store IP
addresses; it derives a daily rotating pseudonym from them for rate limiting.

== Installation ==

1. Upload the plugin and activate it.
2. Create a free account on captchame.de and add a project.
3. Enter the site key and the secret under Settings -> CAPTCHAme.

The selected forms are protected from then on. Whether the setup is complete is shown by two ticks in the dashboard on captchame.de.

== Frequently Asked Questions ==

= Do I need an entry in the cookie banner? =

The plugin sets no cookies. Whether and how the service has to be named in your privacy policy depends on the individual case; a text block is available on captchame.de.

= What happens when the service cannot be reached? =

By default the form is rejected and the visitor is asked to try again. This can be switched over in the settings, so that forms pass unchecked during an outage.

= Does this work with caching plugins? =

Yes. The widget fetches its task by itself, so a cached page stays valid.

= And with plugins that combine JavaScript? =

Since version 1.5.0 captchame.js goes through the WordPress script queue. Optimisation plugins therefore see it as a regular script and handle it along with the rest. The script lives on an external domain and must be neither combined nor cached locally. Should such a plugin try to do so anyway, exclude `captchame.js` from optimisation there.

= Can I switch the plugin off without access to the admin area? =

Yes. `define( 'CAPTCHAME_DISABLE', true );` in wp-config.php stops the plugin completely, `CAPTCHAME_DISABLE_LOGIN` only on the login form. That way a misconfigured domain can never lock you out.

== Changelog ==

= 1.5.2 =
* The exception for the code check now covers the whole statement instead of only its first line. No change in behaviour.

= 1.5.1 =
* Readme rewritten in English, as the plugin directory now requires.
* The token from the form now also passes through sanitize_text_field().
* The script is registered with the plugin version, so browsers fetch it again after an update.

= 1.5.0 =
* captchame.js is bound in through the WordPress script queue instead of a script tag of its own.
* The injector for page builder forms goes through the queue as well.
* No more notice on WordPress 6.7 and newer: translations are no longer loaded too early.
* Every connection to the service is disclosed individually in this readme.

= 1.4.1 =
* Page builder forms: on forms laid out as a single grid the widget ended up above all fields instead of in front of the submit button.
* Links now point straight to the manual for this plugin.

= 1.4.0 =
* The spacing above and below the widget can now be set (20 pixels by default).

= 1.3.4 =
* Page builder forms: the widget now sits evenly between the last field and the submit button instead of right against the button.

= 1.3.3 =
* WPForms: even spacing between the last field and the submit button.
* Widget: the light or dark variant follows the embedding page, no longer the operating system.

= 1.3.2 =
* Brand mark: more distance to the edge.

= 1.3.1 =
* Spelling: umlauts instead of ue, ae and oe in all texts.

= 1.3.0 =
* Important: a misconfigured domain can no longer lock anyone out of the admin area.
* The plugin checks by itself whether the site key applies to this domain and warns in the admin area.
* New emergency exits for wp-config.php: CAPTCHAME_DISABLE and CAPTCHAME_DISABLE_LOGIN.

= 1.2.0 =
* WPForms is recognised and protected.

= 1.1.0 =
* Protection for YOOtheme Pro and other page builder forms, through pre_wp_mail.
* New settings for the CSS selector and for how strict the check is.
* The admin area now shows when the check last actually took effect.

= 1.0.0 =
* First release.
* Protection for comments, log in, registration and lost password.
* Contact Form 7 is recognised automatically.
* Shortcode [captchame] as well as captchame_field() and captchame_verify() for your own forms.

== Upgrade Notice ==

= 1.5.1 =
The script address now carries the plugin version. If an optimisation plugin caches it locally, exclude captchame.js there.

= 1.5.0 =
Technical change to how the script is bound in. If you use an optimisation plugin for JavaScript, check once after the update that the widget still appears in your forms.
