=== GridXFlex Captcha Security ===
Contributors: gridxflex
Tags: captcha, security, spam, login, comments
Requires at least: 5.7
Tested up to: 7.1
Requires PHP: 7.4
Stable tag: 1.0.0
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Self-hosted image CAPTCHA and silent honeypot for Login, Registration, Lost Password, and Comments forms. No API keys, no external services.

== Description ==

GridXFlex Captcha Security adds a self-hosted image CAPTCHA, backed by a silent honeypot layer, to your site's Login, Registration, Lost Password, and Comments forms.

Everything is generated on your own server using PHP's built-in GD library. No requests are ever sent to a third-party service, no API keys are required, and no personal data is stored beyond a short-lived, one-time-use security token.

= Features =

* Self-hosted image CAPTCHA (GD-generated, delivered inline as a base64 image — no extra HTTP request)
* Silent honeypot field on every protected form, on by default
* Per-form protection toggles: Login, Registration, Lost Password, Comments
* Configurable character type (alphanumeric / letters / numbers), letter case, and length (3–6 characters)
* Option to hide the comment captcha for logged-in users
* One-time-use challenge tokens — each code can be attempted exactly once, then it's gone
* No PHP sessions, no cookies set by this plugin, no external requests, no tracking

= Why no PHP sessions? =

Older captcha plugins commonly call `session_start()` on every front-end request, even on pages that never show a captcha. That has a real performance cost, breaks under object-cache or load-balanced PHP-FPM pools without sticky sessions, and is incompatible with full-page caching. GridXFlex Captcha Security stores each challenge as a short-lived WordPress transient, keyed by a random token embedded in the form. The token is just a lookup key — the actual secret (a hash of the code) stays server-side — so it remains safe even on a cached page, and each challenge is deleted the instant it's checked, pass or fail.

== Installation ==

1. Upload the `gridxflex-captcha-security` folder to `/wp-content/plugins/`.
2. Activate the plugin through the "Plugins" screen in WordPress.
3. Go to **Settings → GridXFlex Captcha** to choose which forms are protected and adjust the captcha's appearance.

== Frequently Asked Questions ==

= Does this plugin transmit any data externally? =

No. Code generation, image rendering, and verification all happen on your own server using PHP's built-in GD library. Nothing is sent to any third-party API or service.

= Why doesn't this use PHP sessions? =

For compatibility with page caching and load-balanced hosting. Instead of `$_SESSION`, each challenge is stored as a short-lived WordPress transient keyed by a random token embedded in the form. This works identically behind full-page cache and across load-balanced PHP-FPM pools without sticky sessions, and every challenge is automatically deleted after a single use.

= What is the honeypot layer? =

A hidden form field that's invisible to human visitors but often auto-filled by simple bots. If it's filled in, the submission is rejected the same way a wrong CAPTCHA code would be — no separate "bot detected" message is ever shown, so automated scripts can't learn which check they failed.

= Does this require an API key? =

No. This version doesn't use any third-party CAPTCHA provider.

= Does the plugin work if my host doesn't have the GD PHP extension? =

Yes. If GD isn't available, the image challenge is automatically skipped — protected forms keep working normally, they just fall back to honeypot-only protection instead of erroring out. You'll see an admin notice explaining this; it clears itself automatically as soon as GD is enabled, no need to reactivate the plugin.

= Does the captcha add any visible branding to my site? =

An HTML comment — `<!-- Powered By GridXFlex WordPress Plugins -->` — is placed next to the captcha markup wherever it renders (login, registration, lost password, comments). It isn't visible in the page as displayed, only in page source.

= What happens if someone gets the comment captcha wrong? =

They're redirected back to the same post with an inline error message, and their typed name, email, URL, and comment text are restored — nothing is lost and they don't leave the page. Login, Registration, and Lost Password show their errors the same way, inline on the same page, using WordPress core's own error-display mechanism for those forms.

== Screenshots ==

1. Settings screen under Settings → GridXFlex Captcha.
2. The image CAPTCHA as it appears on the login form.

== Changelog ==

= 1.0.0 =
* Initial release: image CAPTCHA + honeypot for Login, Registration, Lost Password, and Comments forms.
* Graceful fallback when the GD extension is unavailable: protected forms keep working via the honeypot layer alone instead of erroring; the admin notice re-checks live and clears itself once GD is enabled, no reactivation needed.

== Upgrade Notice ==

= 1.0.0 =
Initial release.
