=== hostily Captcha ===
Contributors: connectdeutschland
Tags: captcha, spam, anti-spam, woocommerce, contact form 7
Requires at least: 6.0
Tested up to: 7.1
Requires PHP: 7.4
Stable tag: 0.2.5
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Spam protection for comments, login, registration, WooCommerce and form plugins. Hosted in Germany, no cookies, no image puzzles.

== Description ==

hostily Captcha connects your site to a hostily Captcha service (https://captcha.hostily.de or your own installation). Visitors confirm with one click (or invisibly): their browser solves a small proof-of-work task, so there are no image puzzles and no tracking cookies. Your server then checks the result with your project secret, together with content rules, a honeypot field, a minimum fill-in time and detection of identical submissions.

**Protected forms**

* WordPress: comments, login, registration, lost password, setting a new password, multisite sign-up (wp-signup.php)
* WooCommerce: classic checkout, account registration, login
* Contact Form 7, WPForms, Gravity Forms, Elementor Pro Forms, Formidable Forms, Ninja Forms, Gwolle Guestbook
* Your own forms via an action and a filter (see FAQ)

**Requirements**

The plugin needs a project at the hostily Captcha service: create a free account at https://captcha.hostily.de (the free plan includes 1,000 checks per month for one website). The plugin itself has no limits and no locked features; plans only differ in the service's monthly quota and extras such as statistics. If the quota is exceeded, forms stay protected.

Every integration is only active when the matching plugin is active, and every form can be switched off on the settings page (Settings -> hostily Captcha).

**Privacy**

* The plugin sets no cookies.
* The visitor's browser talks only to the captcha service you configured (widget script, task, result). No other third party is contacted.
* Your server sends the one-time token, the visitor's IP address and (for forms with content checks) the submitted form fields to the service. Password fields are never sent. The service stores only hashed IP addresses and deletes events after a retention period. Mention the service in your privacy policy.

**External service**

This plugin needs a hostily Captcha service (default: https://captcha.hostily.de, privacy information at https://captcha.hostily.de). It loads the script `<service>/widget/hostily-captcha.js` on pages with protected forms and calls `<service>/api/v1/pruefen` from your server on every submission of a protected form.

**Widget license**

The browser widget is not part of this plugin. It is loaded from the service and is licensed under the Apache License 2.0 (it contains parts of Cap, Copyright 2025 Tiago, Apache-2.0).

**Limits**

* WooCommerce: only the classic checkout (shortcode `[woocommerce_checkout]`). The block based checkout is not covered.
* Ninja Forms: add the field "hostily Captcha" (section Miscellaneous) to every form that should be protected.
* Forms sent by JavaScript work best in the visible mode.
* Logged-in users are not checked on comments.

**Lock-out rescue**

Add `define( 'HOSTILY_CAPTCHA_DISABLE', true );` to wp-config.php to switch all checks off.

== External services ==

This plugin connects to the hostily Captcha service at https://captcha.hostily.de, operated by connect – Media & Teledienst (Germany). Without it, the forms cannot be protected.

* In the visitor's browser, the widget script is loaded from captcha.hostily.de and requests a proof-of-work task (challenge) and redeems the solution for a one-time token. This sends the site key, the page origin and the visitor's IP address (as part of the HTTP request; the service stores it only as a daily-salted hash).
* When a protected form is submitted, your server sends the token, your secret, the visitor's IP address and the content fields of the form (no passwords, payment data or hidden technical fields) to https://captcha.hostily.de/api/v1/pruefen, so that minimum time, honeypot, duplicate submissions and your content rules can be checked. Submissions are not stored; events are deleted after 14 days.

Terms of service: https://captcha.hostily.de/agb.html – Privacy policy: https://captcha.hostily.de/datenschutz-dienst.html – Data processing agreement: https://captcha.hostily.de/avv.html

== Installation ==

1. Upload the plugin folder to `/wp-content/plugins/` or install the ZIP via Plugins -> Add New.
2. Activate the plugin.
3. Go to Settings -> hostily Captcha, enter site key and secret of your project, save.
4. Press "Test connection". Choose the forms you want to protect.

The domain of your site must be on the project's list of allowed domains in the service.

== Frequently Asked Questions ==

= Where do I get site key and secret? =

From your project in the hostily Captcha administration (https://captcha.hostily.de/verwaltung/).

= Why does the widget show "Protected by hostily"? =

The notice is part of the service's widget (like the badge of other captcha services) and links to the service's website. No link or credit is added by the plugin itself. On plans that include it, the notice can be switched off per project in the service's administration.

= What happens if the service is down? =

By default submissions pass and the problem is logged (shown on the settings page, and in the PHP error log when WP_DEBUG_LOG is on). You can choose to block instead.

= My site is behind a proxy or CDN. =

Enter the proxy's address under "Trusted proxies". Only then X-Forwarded-For is used for the visitor's address.

= How do I protect a form of my theme or my own plugin? =

Inside the form: `do_action( 'hostily_captcha_widget' );`. When the form is sent:
`$error = apply_filters( 'hostily_captcha_check', null, $fields );` – `null` means passed, otherwise show `$error`
to the visitor. `$fields` (name => value) is optional and enables the content rules. Without the plugin both calls
do nothing. Enable "Own forms" in the settings.

== Screenshots ==

1. Comment form: the visitor ticks the box, the browser solves a small task in the background.
2. Login without the check is rejected with a clear message.
3. WooCommerce classic checkout: the widget sits directly above "Place order".
4. Contact Form 7 form, confirmed.
5. Settings: keys, mode, language, protected forms and behaviour when the service is not reachable.

== Changelog ==

= 0.2.5 =
* New: the form for setting a new password (link from the lost password mail, WordPress and WooCommerce).
* New: multisite sign-up on wp-signup.php (new user and new site). Both are switched on after the update, like on a new installation.

= 0.2.4 =
* WooCommerce checkout: the widget now sits directly above the "Place order" button instead of below the order notes.

= 0.2.3 =
* Widget script for own forms is always enqueued (wp_print_scripts on pages without wp_head).
* Field names sent for content checks are sanitized.
* Translations come from translate.wordpress.org; no bundled language files.

= 0.2.2 =
* Readme: requirements (free account at captcha.hostily.de), notice in the widget, Gwolle and own forms listed; description corrected.

= 0.2.1 =
* Elementor Pro Forms: a failed check now stops the submission (field error, not only a message).

= 0.2.0 =
* Gwolle Guestbook.
* Own forms: action hostily_captcha_widget, filter hostily_captcha_check.
* Gravity Forms: no check for page changes, GravityView edits, back end and WooCommerce product add-ons.

= 0.1.0 =
* First release.
