=== Dlit Easy Math Captcha ===
Contributors: dlit
Tags: captcha, math captcha, spam protection, comments, woocommerce
Requires at least: 5.0
Tested up to: 7.1
Requires PHP: 7.4
Stable tag: 1.5.2
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

A simple math captcha plugin for comments, login, registration, WooCommerce reviews, and Contact Form 7.

== Description ==

Dlit Easy Math Captcha adds configurable math captcha protection to:

- WordPress comments
- Login form
- Registration form
- WooCommerce product reviews
- Contact Form 7 forms via [math_captcha]

Features:

- Answer-digit based difficulty (1-3 digits)
- Configurable operations: addition, subtraction, multiplication
- Question style: digits, emoji (1️⃣3️⃣ ➕ 7️⃣), or mixed
- Per-integration simple one-line mode to minimize UI impact
- Stateless HMAC-signed single-use token verification (no database writes on page render)
- Nonce verification for submissions

== Installation ==

1. Upload the plugin folder to /wp-content/plugins/.
2. Activate the plugin in WordPress.
3. Go to Settings > Math Captcha.

== Frequently Asked Questions ==

= How do I use it with Contact Form 7? =

Add this tag in your CF7 form (the name, e.g. `captcha-1`, lets CF7 show the validation error next to the field):

[math_captcha captcha-1]

Optional flags (no colons):

[math_captcha captcha-1 simple]            - force compact one-line layout
[math_captcha captcha-1 full]              - force full layout with description
[math_captcha captcha-1 light]             - force light text mode
[math_captcha captcha-1 dark]              - force dark text mode
[math_captcha captcha-1 id:my-id]          - set a custom HTML id on the input
[math_captcha captcha-1 id:my-id simple]   - combine id + compact layout
[math_captcha captcha-1 simple light]      - combine compact + light text mode
[math_captcha captcha-1 id:my-id full dark] - combine id + full + dark text mode

= Does it support Redis or Memcached? =

Yes, automatically. Tokens are stored via the WordPress Transients API, so if your site uses a persistent object-cache drop-in (for example the "Redis Object Cache" plugin), tokens live in Redis/Memcached instead of the database with no configuration. The Settings > Math Captcha page shows which storage is currently in use.

= Does it work with page caching? =

Each captcha embeds a single-use token in the page HTML. If a full-page cache serves the same cached page to many visitors, only the first successful submission is accepted; later visitors must reload past the cache. Exclude pages with comment forms from full-page caching, or keep cache lifetimes short (under 30 minutes).

== Changelog ==
= 1.5.1 =
- Added: Question style option (Digits / Emoji / Mixed) — emoji questions like 1️⃣3️⃣ ➕ 7️⃣ break the simplest text-parsing spam bots. Display only; verification is unchanged.
- Fixed: Contact Form 7 no longer burns the captcha token when another field fails validation — the token is consumed only after the whole form passes, so corrected resubmits work without reloading.
- Improved: dead tokens (expired or already used) now show "please reload the page" instead of the misleading "incorrect answer".
- Fixed: the answer input stays readable on dark themes and in the CF7 light text mode (it no longer inherits light text onto its white background).
- Fixed: valid HTML in the simple layout (the question is no longer a div inside a span).
- Improved accessibility: the answer input references the math question via aria-describedby, numeric keyboards are requested on mobile, and the info tooltip is keyboard-reachable.
- Improved: number-input spinner arrows are hidden and the tooltip wraps instead of overflowing on small screens.
- Improved: the stylesheet now loads only on pages where a captcha is rendered instead of site-wide.

= 1.5.0 =
- Improved: redesigned settings screen — protect/layout toggles combined into one Protected Forms table with inline dependency status, corrected difficulty wording (the digit setting controls the answer; operands are auto-generated with up to one extra digit), and a live preview of both captcha layouts.
- Added: Settings link on the plugin row of the Plugins screen.
- Added: Token Storage status panel on the settings page — shows whether replay-protection tokens are stored in a persistent object cache (Redis/Memcached/APCu) or the database, and suggests enabling one when the server supports it.
- Improved: captcha tokens are now stateless HMAC-signed values — rendering no longer writes to the database; a single transient is written only on successful verification to prevent replay. Wrong answers no longer consume the token, so visitors can retry.
- Security: comment captcha can no longer be bypassed by spoofing review POST fields; product reviews are now detected from the target post type on the server.
- Security: WooCommerce review submissions now have their math answer verified (previously only the nonce was checked).
- Fixed: pingbacks and trackbacks are no longer blocked by comment captcha validation.
- Fixed: front-end login forms built with wp_login_form() now render the captcha instead of locking users out.
- Fixed: consolidated to a single plugin main file (dlit-easy-math-captcha.php).
- Improved: multiplication questions no longer degenerate to the trivial "N x 1" pattern.
- Improved: captcha is no longer rendered for logged-in users who can moderate comments.

= 1.4.5 =
- Improved simple layout alignment and theming behavior.
- Updated text domain to match plugin slug.

= 1.4.4 =
- Added CF7 text mode flags: `light` and `dark`.
- Removed external front-end link from captcha output.

= 1.4.3 =
- Added CF7 shortcode layout flags: `simple` and `full`.
- Added one-line compact captcha display mode.

= 1.2.0 =
- Added optional setting defaults for core integrations.
- Updated activation behavior and admin settings flow.

= 1.1.0 =
- Added answer-digit based difficulty generation.
- Added per-integration simple one-line display mode.
- Improved comments and WooCommerce review validation flow.

== Upgrade Notice ==

= 1.5.0 =
Security release: fixes captcha bypasses on comments and WooCommerce reviews. Update recommended.
