=== Captvane – Captcha Errors & Lost Form Leads ===
Contributors: lalokupfer
Tags: captcha, recaptcha, contact form, smtp, form
Requires at least: 6.7
Tested up to: 7.1
Requires PHP: 7.4
Stable tag: 1.0.0
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

See why your contact form refused a message: captcha key errors, missing captcha answers, failed e-mails, this month's checks and a 30-day copy.

== Description ==

Captvane reads the answer your form's captcha already got and tells you the real reason a message was refused: a broken key, no answer from the captcha service, or a captcha that never loaded, where the form's own log may only say "low score". It keeps a 30-day copy of the messages the captcha could not check, and of those the form accepted but could not e-mail to you, so you can still reply. It changes nothing by itself and sends nothing anywhere.

Captvane does not connect to any external service: it reads the answers your form's captcha already received, everything happens on your site, and its e-mails go through your site's own mailer.

= How Captvane is different =

* It reads the answer your form's captcha already got, so your form works exactly as before.
* It names the real reason a message was refused: a broken key, no answer from the captcha service, or a captcha that never loaded.
* It keeps a 30-day copy of the messages the captcha could not check and of those the form could not e-mail to you, and sends nothing anywhere.

= reCAPTCHA not working? See the captcha error in plain words =

Captvane's screen answers one question first: is your form's captcha working? Below the answer, each form's last 7 and 30 days: checks, low scores, messages the captcha could not check and e-mails that failed. The latest reCAPTCHA error or captcha error is said in plain words: what happened, what it means and how to fix it.

= Contact Form 7 reCAPTCHA: why your contact form refused a message =

For Contact Form 7, Captvane files every message your contact form refused under its real cause: a low score, a broken key, no answer from the captcha service, a captcha that never loaded, an answer that was spent or expired, or something other than the captcha. It works as a spam log that says why: for each form, the low scores, the messages the captcha could not check and the e-mails that failed are counted apart, and the latest problem is shown with its fix.

= Form submissions not received? A 30-day copy of the messages at risk =

When the captcha cannot check a message, because its key is broken, the captcha service did not answer or the captcha never loaded, the form refuses a real person, and that lead is lost unless someone sees it. Captvane keeps a 30-day copy of each of those messages, and of a message the form accepted but could not e-mail to you, so you can still reply; you can keep copies for fewer days in its Settings tab. A low score is counted, never copied.

= reCAPTCHA quota: this month's checks =

Captvane counts this month's captcha checks on this site for each captcha service, beside the free reCAPTCHA limit on Google's own quota page, linked and dated, and tells you when Google says the site is over it.

= Office 365 SMTP: the mail sign-in check =

Captvane shows how your site sends its e-mail: the kind of mail server, its port and encryption and the kind of sign-in, such as SMTP AUTH with a password, never the user name or the password. If your site signs in to Microsoft 365 (Office 365, Outlook) with a user name and password, it shows Microsoft's announcement of a change to that sign-in in Microsoft's own words, linked and dated, and what you can do. One button sends a test e-mail to your own address, the way your site sends every e-mail.

= Switch from reCAPTCHA to Cloudflare Turnstile, with an Undo =

If your forms are Contact Form 7 forms checked by Google reCAPTCHA, Captvane can switch them to Cloudflare Turnstile, Cloudflare's free captcha, when you press one button. You paste Cloudflare's keys into Contact Form 7 yourself; Captvane first shows the one setting that changes, and keeps an Undo for 30 days. It installs nothing, edits no form and keeps no copy of Cloudflare's keys. The words of Cloudflare's it quotes on that screen are from Cloudflare's pages [Cloudflare Turnstile](https://developers.cloudflare.com/turnstile/) and [Plans](https://developers.cloudflare.com/turnstile/plans/) (both updated 2026-08-14, read 2026-10-25).

= Know when your form's captcha stops working =

If you turn it on, Captvane sends you an alert by e-mail when your contact form refused messages the captcha could not check, or could not e-mail you a message it accepted: what happened, how to fix it, and a link to Captvane's screen. At most one e-mail a day for each problem, to the addresses you choose, through your site's own mail. It is off until you turn it on.

= One notice, only after a captcha error =

Outside its own screen Captvane shows one notice, and only when a captcha error was actually seen in the last 7 days: it names the fix and links to Captvane's screen. Close it once and it stays closed for you.

= Works with your form plugin and your captcha =

Contact Form 7: every refused message with its reason, and the copies. WPForms Lite, Forminator, Fluent Forms and Ninja Forms, and WordPress's own login and comment forms: their captcha checks counted, with the latest error in the captcha service's own words. Captvane reads the answers of Google reCAPTCHA, Cloudflare Turnstile and hCaptcha.

== Installation ==

1. In wp-admin, go to Plugins › Add New Plugin and search for Captvane.
2. Press Install Now, then Activate.
3. Open Captvane in the admin menu. Its first card shows what it already found, the alert e-mail and how your site sends e-mail; press Save and start, or Skip.

== Frequently Asked Questions ==

= Does Captvane change what my form does? =

No. It only reads the answers your form already got. The one exception is the switch to Cloudflare Turnstile: it changes one Contact Form 7 setting, only when you press its button, and Undo puts it back for 30 days.

= Does it stop spam? =

No. Your captcha does that job; Captvane does not stop spam itself. It tells you when the captcha is not working.

= What happens when my site passes Google's free checks? =

[Google's reCAPTCHA questions page](https://developers.google.com/recaptcha/docs/faq) (updated 2026-04-02, read 2026-10-24) says: "If a v3 site key exceeds its monthly quota, then `site_verify` may fail open by returning a static score 0.9 and an error message `"Over free quota."` for the remainder of the month." It adds: "There are no user-visible indications when v3 sites are over quota."

[Google's quota page](https://docs.cloud.google.com/recaptcha/quotas) (updated 2026-10-22, read 2026-10-24) sets the free limit per Google Cloud organization: "The free 10,000 assessments are per organization. The limit aggregates use across all accounts and all sites."

So past the limit your form lets spam through, but it does not refuse people. Captvane counts this site's checks beside that limit and says so on its screen the moment Google's answer says the site is over it. It counts only this site's checks.

= Will my Microsoft 365 mail stop? =

Microsoft has announced, in [its post of 2026-01-27](https://techcommunity.microsoft.com/blog/exchange/updated-exchange-online-smtp-auth-basic-authentication-deprecation-timeline/4489835) (updated 2026-01-29, read 2026-10-24): "End of December 2026: SMTP AUTH Basic Authentication will be disabled by default for existing tenants. Administrators will still be able to enable it if needed." It adds: "Second half of 2027: Microsoft will announce the final removal date for SMTP AUTH Basic Authentication."

So it is a default an administrator of your Microsoft 365 account can switch back on, and Microsoft has moved this date before. If your site signs in to Microsoft 365 with a user name and password, Captvane shows that announcement on its screen with the date it was read and the steps you can take, and its test e-mail lets you check your mail after a change.

= Does Captvane send anything outside my site? =

No data, to anyone. Its only e-mails are the ones you ask for, the test e-mail and, if you turn it on, the alert e-mail, sent to your own addresses through WordPress's own mail function. It never contacts a captcha service, Microsoft, Cloudflare or us.

= Can Captvane e-mail me when my form's captcha stops working? =

Yes, if you turn on the alert e-mail in Captvane's Settings tab; it is off until you do. Captvane then e-mails the addresses you choose, or the site's administration e-mail address when you choose none, when your contact form refused messages the captcha could not check (a key that does not work, no answer from the captcha service, a captcha that did not load) or could not e-mail you a message it accepted. The e-mail says what happened and how to fix it, with a link to Captvane's screen. It sends at most one e-mail a day for each problem, through your site's own mail.

= Will Captvane put notices on my dashboard? =

One at most, and only when a captcha error was actually seen in the last 7 days. It names the fix and links to Captvane's screen; close it with its × or "Do not show this again" and it stays closed for you. It is shown to administrators only, never on Captvane's own screen, and Captvane shows no other notice, count or badge outside its screen.

= Which form plugins does Captvane work with? =

Contact Form 7, with every refused message filed under its reason and a 30-day copy of the messages the captcha could not check or whose e-mail to you failed. For WPForms Lite, Forminator, Fluent Forms and Ninja Forms, and for WordPress's own login and comment forms, Captvane counts the captcha checks and shows the latest error; it keeps no copies for those. It reads the answers of Google reCAPTCHA, Cloudflare Turnstile and hCaptcha.

= Can I see how many reCAPTCHA checks my site used this month? =

Yes. Captvane counts this site's checks for each captcha service, in the site's own time zone, beside the free limit on Google's own page, with the date it was read. It counts only this site's checks.

= What does Captvane keep about the people who write to me? =

Only a copy of a message your contact form refused because the captcha could not check it, or accepted but could not e-mail to you: what the visitor typed in the form's text boxes, the form's name and when it was sent. Never an uploaded file, a password box, the visitor's internet address or browser. Each copy is deleted after 30 days, or sooner if you choose fewer days under "How long copies are kept" in Captvane's Settings tab (from 1 to 30; a shorter time deletes the copies past it when you save), and a site keeps the newest 500 copies at most. Captvane looks for old copies every day and now and then as you use wp-admin, so they are deleted even on a site whose scheduled tasks are switched off. WordPress's own Export Personal Data and Erase Personal Data tools find a person's copies by their e-mail address, and Captvane adds its suggested text to your privacy policy guide in Settings › Privacy. Deleting the plugin deletes every copy.

= What is left when I delete Captvane? =

Nothing of Captvane's. Deleting it from the Plugins screen removes its settings, its tables with every copy and count, its scheduled tasks and the Undo of the captcha switch, on every site of a network, and leaves every other plugin's settings as they were. Deactivating it keeps everything, so you can turn it off to rule out a conflict and find it as it was when you turn it back on.

= Does Captvane read my mail password? =

No. It reads only the kind of mail server your site's e-mail goes through, its port, its encryption and the kind of sign-in. It never reads, shows, stores or sends a user name, a password or a sign-in token, and never a mail plugin's saved settings.

= Does Captvane connect to Microsoft or test my mail sign-in? =

No. It never connects to Microsoft or to your mail server. The one test you can press sends one e-mail to your own address through WordPress's own mail function, the way your site sends every e-mail.

= Can Captvane switch my forms from reCAPTCHA to Cloudflare Turnstile? =

Yes, for Contact Form 7. Make the Turnstile keys in your Cloudflare account and paste them into Contact Form 7's own Integration screen; Captvane's Switch captcha tab then shows the one setting that changes and a button. The press takes the reCAPTCHA keys out of Contact Form 7, so your forms use Turnstile only. For 30 days, Undo puts the reCAPTCHA keys back exactly as they were and takes Cloudflare's keys out in the same step, so a form never carries both captchas. Captvane keeps no copy of Cloudflare's keys, installs and switches no plugin, edits no form and never connects to Cloudflare or Google.

= Does it work on a multisite network? =

Yes. Each site of a network has its own Captvane screen, counts, copies and settings, and deleting the plugin removes them from every site.

= Does it work on a phone? =

Yes. Captvane's screens and its alert e-mail work on any phone or tablet, an iPhone, an iPad and an Android phone included: the lists show as cards and every button is large enough to tap.

== Changelog ==

= 1.0.0 =
* First release.
* A screen that answers whether your form's captcha is working, shows each form's last 7 and 30 days, and the latest problem with its fix.
* Contact Form 7: every refused message filed under its real cause, and a 30-day copy of the messages the captcha could not check or whose e-mail failed.
* Counts the captcha checks of WPForms Lite, Forminator, Fluent Forms, Ninja Forms and WordPress's login and comment forms.
* Counts this month's captcha checks for each captcha service, beside Google's free limit as Google's own page states it.
* Shows how your site sends its e-mail, never the password; Microsoft's announcement for a site that signs in to Microsoft 365 with a password; a test e-mail to your own address.
* Switches Contact Form 7 from Google reCAPTCHA to Cloudflare Turnstile when you press the button: the change shown first, an Undo for 30 days.
* An alert e-mail you can turn on: when your contact form refused messages the captcha could not check, or could not e-mail you one, with the fix; at most one a day for each problem.
* One notice outside Captvane's screen, only when a captcha error was seen in the last 7 days, with the fix; it closes for good.
* A first-run card on Captvane's screen: what it found already, the alert e-mail and who gets it, and how your site sends e-mail; done in two presses, or skipped.
* Choose how many days copies are kept, from 1 to 30, in Captvane's Settings tab.
* The messages Captvane keeps in WordPress's Export Personal Data and Erase Personal Data tools, found by e-mail address; a suggested privacy policy text; old copies deleted even when scheduled tasks are off.
* Deleting the plugin removes everything it kept, on every site of a network, and nothing of any other plugin.
* Captvane's screens and its alert e-mail read well on phones and tablets: the lists show as cards and every button is large enough to tap.
* What makes Captvane different: it reads the answer your form's captcha already got and says why a message was refused, in plain words.
