=== CaptchaKit ===
Contributors: loudunicorn
Tags: captcha, bot protection, spam, security, woocommerce
Requires at least: 5.8
Tested up to: 7.0
Requires PHP: 7.4
Stable tag: 1.0.1
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Replace boring CAPTCHAs with fun 10-second mini-games. Bot protection that doesn't frustrate real users.

== Description ==

**CaptchaKit** protects your WordPress site from bots, spam, and credential-stuffing attacks — without subjecting real visitors to blurry fire-hydrant photographs.

Instead of a CAPTCHA, visitors play a quick 10-second mini-game (Connect 4, Pac-Man, or Whack-a-Bot). Real humans breeze through it. Bots can't pass automated checks against the CaptchaKit API.

= How it works =

1. The CaptchaKit widget is injected into the forms you choose (login, registration, comments, WooCommerce checkout).
2. A visitor completes the mini-game.
3. A signed completion token is placed in a hidden form field by our JavaScript.
4. WordPress sends the token to the CaptchaKit API for server-side verification before allowing the form submission through.

= Supported forms =

* **WordPress Login** — protects `wp-login.php` against brute-force and credential-stuffing bots.
* **WordPress Registration** — stops automated account creation at the source.
* **Comment forms** — eliminates comment spam without annoying logged-in users (moderators are always trusted).
* **WooCommerce Checkout** — prevents fake order submissions and account abuse on your store.

= Games available =

* Connect 4 — drop discs, get four in a row.
* Pac-Man — eat the dots, dodge the ghosts.
* Whack-a-Bot — bonk the bots before they escape.
* Color Match — match the colors before time runs out.
* Maze Runner — navigate the maze to the exit.
* Fruit Sorter — sort the fruit into the correct bins.
* Stack It — stack the blocks without toppling.

= Privacy =

CaptchaKit does not store personally identifiable information. The widget communicates with `captchakit.com` only to verify game tokens. See [our privacy policy](https://captchakit.com/privacy) for full details.

= Free to get started =

[Create a free account](https://captchakit.com/dashboard) and get your Site Key and API Key instantly.

== Installation ==

= Automatic (recommended) =

1. In your WordPress admin, go to **Plugins > Add New**.
2. Search for **CaptchaKit**.
3. Click **Install Now**, then **Activate**.
4. Go to **Settings > CaptchaKit** and enter your Site Key and API Key (get them free at [captchakit.com/dashboard](https://captchakit.com/dashboard)).
5. Choose which forms to protect and which game to use, then click **Save Settings**.

= Manual =

1. Download the plugin ZIP from the WordPress Plugin Directory (or from [captchakit.com](https://captchakit.com)).
2. In your WordPress admin, go to **Plugins > Add New > Upload Plugin**.
3. Choose the ZIP file and click **Install Now**.
4. Click **Activate Plugin**.
5. Go to **Settings > CaptchaKit** to configure.

= WooCommerce =

WooCommerce support is automatic — if WooCommerce is active, the checkout option becomes available in the settings. No extra steps required.

== Frequently Asked Questions ==

= Do I need an account? =

Yes, you need a free CaptchaKit account to get a Site Key and API Key. [Sign up here](https://captchakit.com/dashboard) — it takes about 30 seconds.

= Will this break my login form? =

No. If the CaptchaKit API is unreachable (network error, server outage), the plugin **fails open** — form submissions are allowed through so your site never becomes completely locked. An error is logged to the PHP error log for your review.

= Does it work with custom login forms? =

The plugin hooks into WordPress's standard form actions and filters. If your custom login plugin fires `login_form` and `wp_authenticate_user`, CaptchaKit will work. Contact us if you need help integrating with a specific plugin.

= Does it work with WooCommerce? =

Yes. The plugin detects whether WooCommerce is active and adds the widget after the billing form on checkout. Enable it under **Settings > CaptchaKit > Enable On > WooCommerce Checkout**.

= Will logged-in users have to play the game? =

For comment forms, users with the `moderate_comments` capability (Editors and Administrators) bypass the game automatically. Other forms (login, registration) only appear to logged-out users by definition.

= Is the plugin GDPR-compliant? =

The widget sends only the completion token and your Site Key to our API. No user personal data (name, email, IP address) is transmitted. Please review our [privacy policy](https://captchakit.com/privacy) and include CaptchaKit in your site's privacy notice.

= How do I test that it's working? =

Go to **Settings > CaptchaKit** and click the **Test Connection** button. It will verify that your credentials are valid and that WordPress can reach the API.

= The widget isn't showing up. What do I check? =

1. Make sure your Site Key is saved in Settings.
2. Open the browser console — look for JavaScript errors. An ad-blocker may be blocking `captchakit.com/widget.js`.
3. Check that the form type is enabled in **Settings > CaptchaKit > Enable On**.
4. Use the Test Connection button to confirm your API Key is correct.

= Can I translate the plugin? =

Yes. The plugin is fully internationalised with the text domain `captchakit`. A `.pot` file is included in `languages/captchakit.pot`. Submit translations via [translate.wordpress.org](https://translate.wordpress.org/).

= What happens if someone submits the form without playing the game? =

An empty token is submitted. The server-side verification returns false and WordPress blocks the submission with an error message prompting the user to complete the game.

== Screenshots ==

1. The CaptchaKit widget shown on the WordPress login form — Connect 4 game in progress.
2. The Connect 4 widget, completed state — a green checkmark confirms the player is human.
3. Whack-a-Bot mini-game embedded in a WooCommerce checkout page.
4. Admin settings page — credentials, game selector, and form toggles.
5. The "Test Connection" result confirming valid API credentials.

== Changelog ==

= 1.0.1 =
* Security: server-side API key validation and rate limiting on verification requests.
* Accessibility: keyboard controls and ARIA roles across all games, plus a screen-reader-friendly challenge fallback that issues the same pass token.
* Fix: timer cleanup to prevent stray intervals after a game completes.
* More games available via the CaptchaKit widget.

= 1.0.0 =
* Initial release.
* Login, registration, comment, and WooCommerce checkout form support.
* Connect 4, Pac-Man, Whack-a-Bot, Color Match, Maze Runner, Fruit Sorter, and Stack It games.
* Server-side token verification via the CaptchaKit API.
* Fail-open behaviour on network errors.
* "Test Connection" button in admin.
* Live widget preview in admin settings.
* Full i18n with `.pot` file.
* Multisite-compatible uninstall.

== Upgrade Notice ==

= 1.0.1 =
Security hardening and an accessibility pass — recommended for all users.

= 1.0.0 =
Initial release — no upgrade steps needed.
