Contributors: lotgrafix
Tags: captcha, anti-spam, security, forms, spam, recaptcha, login
Requires at least: 6.0
Tested up to: 7.1
Requires PHP: 7.4
Stable tag: 1.0.0
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Lightweight CAPTCHA and anti-spam for login, registration, comment, and custom forms. No Google reCAPTCHA or external APIs, GDPR-friendly.

== Description ==

AutoCaptcha is a lightweight, privacy-friendly CAPTCHA and anti-spam plugin for WordPress, with no Google reCAPTCHA or Cloudflare Turnstile required. It generates SVG challenges directly on your server, with no external APIs or tracking, to protect login, registration, comment, and custom forms from bots and spam. Forms inside your content are detected automatically, and you can target specific forms with HTML IDs or CSS selectors.

== Features ==

🛡️ Privacy & Performance

– Zero Third-Party APIs: 100% self-hosted generation. Requires no external keys, cookies, or remote server requests.
– Lightweight SVG Engine: Renders visual SVG distortion grids and randomized character transformations directly on the server.
– High Performance: Eliminates heavy external JavaScript bundles to preserve fast page loading speeds.

🎯 Automatic Form Protection

– Content Form Detection: Automatically injects CAPTCHA challenges into forms embedded within post or page content (the_content).
– WordPress Login & Register: Adds immediate protection to the core login, registration, and multisite signup screens.
– Comment Protection: Configurable separate toggles for registered members and guest commenters.

⚙️ Advanced Targeting & Control (Modular Features)

– Custom Form Inclusion: Manually target and inject CAPTCHA challenges into external forms using HTML IDs or CSS selectors.
– ID-Based Form Exclusion: Exclude specific forms from automatic CAPTCHA injection by defining their unique container or form IDs.
– Strict Expiration & Attempt Throttling: Transient-backed token validation enforcing strict expiration windows and maximum failed attempts to block brute-force automation.

== Installation ==

1. Upload the plugin files to the `/wp-content/plugins/lotgrafix-captcha` directory, or install the plugin through the WordPress plugins screen directly.
2. Activate the plugin through the ‘Plugins’ screen in WordPress.
3. Navigate to **LOT Grafix → AutoCaptcha** in your WordPress dashboard to configure features.
4. Enable the desired features and click “Save Changes”.

== Frequently Asked Questions ==

= Does this plugin require API keys from Google or Cloudflare? =
No. AutoCaptcha operates completely natively on your server using PHP and inline SVG graphics. No API keys or account registrations are required.

= Does AutoCaptcha store user tracking data? =
No. Verification relies on temporary transients stored in your server’s database, making it fully privacy-friendly and compliant with strict privacy regulations (GDPR / DSGVO).

= Can I exclude specific forms from having a CAPTCHA? =
Yes. You can specify form IDs or CSS classes in the settings panel to skip CAPTCHA rendering on selected forms.

= Can I add CAPTCHA to custom forms outside the main content area? =
Yes. The inclusion rule setting allows you to specify custom HTML IDs or selectors so AutoCaptcha can attach verification fields to forms placed in sidebars, footers, or custom templates.

= Does AutoCaptcha store user tracking data? =
No cookies or tracking are used, and no data is sent to third parties. Verification relies on temporary transients stored in your own server’s database, which makes it a privacy-friendly option for sites that need to follow regulations such as GDPR.

== External services ==

This plugin includes the LOT Grafix dashboard, which connects to an external service to display the list of other LOT Grafix plugins.

= LOT Grafix Plugin List =

– Service: https://wp-plugins.lotgrafix.workers.dev (hosted on Cloudflare Workers, operated by LOT Grafix, Inc.)
– Purpose: retrieves the list of available LOT Grafix plugins shown on the LOT Grafix admin page.
– Data sent: no personal or user data is sent. As with any HTTP request, the server receives your site’s IP address and the standard WordPress User-Agent, which includes your site URL.
– When: only when an administrator opens the LOT Grafix admin page and the cached list (1 hour) has expired.
– Terms of Service: https://lotgrafix.com/terms-of-service/
– Privacy Policy: https://lotgrafix.com/privacy-policy/
– Hosting provider (Cloudflare) Terms: https://www.cloudflare.com/website-terms/
– Hosting provider (Cloudflare) Privacy: https://www.cloudflare.com/privacypolicy/

== Screenshots ==

1. AutoCaptcha activation and module control panel.
2. Native SVG CAPTCHA rendered on a standard WordPress comment form.
3. Inclusion and Exclusion targeting settings by HTML ID and CSS selectors.

== Changelog ==

= 1.0.0 =
– Initial stable release.
– Added native SVG CAPTCHA generator and validation engine.
– Added automated protection for the_content, login, registration, and comment forms.
– Added granular inclusion and exclusion rules by form HTML ID / CSS class.

== Upgrade Notice ==

= 1.0.0 =
Initial stable release.