=== MTCaptcha WordPress Plugin ===
Contributors: mtcaptcha
Tags: captcha, security, spam, woocommerce, contact-form-7
Requires at least: 6.0
Tested up to: 7.0
Requires PHP: 8.2
Stable tag: 2.8.1
License: Apache-2.0
License URI: https://www.apache.org/licenses/LICENSE-2.0

Protect your WordPress forms from spam and brute-force attacks with MTCaptcha, a privacy-first, GDPR and WCAG compliant captcha.

== Description ==

MTCaptcha is an efficient security solution to protect your WordPress website against spam comments and brute-force attacks. It integrates with comments, login, registration, forgot password, Contact Form 7, and WooCommerce checkout.

= Top highlights =

* GDPR compliance
* Enterprise friendly
* Accessibility compliance
* Adaptive risk engine
* High availability around the world

= Supported forms =

* WordPress login, registration, comment, and password reset forms
* WooCommerce login, registration, checkout, and password reset forms
* Contact Form 7 via the `[mtcaptcha]` form tag
* BuddyPress registration

= Customization =

Choose from multiple prebuilt themes, widget sizes, and 60+ languages. Advanced users can supply a custom `mtcaptchaConfig` snippet for full control.

== External services ==

This plugin relies on MTCaptcha, a third-party captcha service operated by MTCaptcha Inc. The plugin cannot function without it: solving and verifying a captcha requires contacting the MTCaptcha service. An MTCaptcha account and a registered domain are required to obtain the site key and private key used by the plugin.

The plugin connects to MTCaptcha in two ways.

**1. Captcha widget loaded in the visitor's browser**

On any page where a protected form is displayed, the plugin loads the MTCaptcha widget script from `https://service.mtcaptcha.com/mtcv1/client/mtcaptcha.min.js` (with `https://service2.mtcaptcha.com/mtcv1/client/mtcaptcha2.min.js` as a failover). The visitor's browser therefore contacts MTCaptcha directly and, as part of that request, transmits their IP address, browser and device information, and their interactions with the captcha widget. Your site key is also sent so MTCaptcha can identify the account. MTCaptcha sets two cookies in the visitor's browser for device verification and transaction flow. This happens when the page loads, before any form is submitted.

**2. Token verification from your server**

When a protected form is submitted, the plugin sends a request from your server to `https://service.mtcaptcha.com/mtcv1/api/checktoken` containing the single-use captcha token produced by the widget and your account's private key. MTCaptcha responds with whether the token is valid. This happens once per form submission. No form content, personal data, or user-entered values are included in this request.

MTCaptcha states that it does not collect personally identifiable information, anonymises indirectly identifying data such as IP addresses, and does not use collected data for profiling, advertising, or resale.

By using this plugin you are agreeing to MTCaptcha's terms and policies:

* Terms and Conditions: https://www.mtcaptcha.com/legal-terms
* Privacy Policy: https://www.mtcaptcha.com/legal-privacy-captcha
* GDPR information: https://www.mtcaptcha.com/gdpr-captcha
* Data Processing Agreement: https://www.mtcaptcha.com/legal-dpa

== Installation ==

1. Upload the plugin files to `/wp-content/plugins/mtcaptcha`, or install through the WordPress Plugins screen.
2. Activate the plugin through the Plugins screen.
3. Go to **Settings → MTCaptcha** to configure the plugin.
4. [Register your domain](https://www.mtcaptcha.com/pricing/) with MTCaptcha and enter your site key and private key.
5. Choose which forms should display MTCaptcha and save your settings.
6. For Contact Form 7, add the `[mtcaptcha]` tag to your form.

== Frequently Asked Questions ==

= Where do I get my site key and private key? =

Register your domain at [MTCaptcha pricing](https://www.mtcaptcha.com/pricing/) and copy the keys from your MTCaptcha account.

= How do I add MTCaptcha to Contact Form 7? =

Enable Contact Form 7 in the plugin settings, then add `[mtcaptcha]` to your form.

= More questions? =

See the [MTCaptcha FAQ](https://www.mtcaptcha.com/faq).

== Screenshots ==

1. MTCaptcha common and basic settings
2. MTCaptcha advanced settings
3. MTCaptcha usage snapshot for Contact Form 7
4. MTCaptcha modern mini widget snapshot
5. MTCaptcha custom theme examples for the standard widget

== Changelog ==

= 2.8.1 =
* Added an "External services" section to the readme documenting the MTCaptcha service, the data sent to it, and links to the terms, privacy policy and DPA.
* Added `translators:` comments for all translatable strings containing placeholders.
* Documented why nonce verification is not applicable when reading the public captcha token, which is validated server-side against the MTCaptcha API.
* Documented why the remote MTCaptcha scripts are enqueued without a version query string.
* Tested against WordPress 7.0.

= 2.8.0 =
* WordPress 6.x compatibility (requires WordPress 6.0+).
* PHP 8.2+ compatibility (requires PHP 8.2+).
* Security fix for CVE-2025-13520: settings updates now use the WordPress Settings API with proper CSRF nonce validation.
* Refactored admin settings to post through `options.php` instead of a custom update handler.
* Improved input sanitization and escaping across admin and frontend code.
* Safer script loading via `wp_enqueue_script` and `wp_add_inline_script`.
* Fixed uninstall routine deleting incorrect option names.

= 2.7.2 =
* Latest WordPress support.
* BuddyPress support.
* Bug fixes.

= 2.5.0 =
* Custom configuration support.
* Show captcha label based on configuration.
* Bug fixes.

= 1.3 =
* Bug fixes to support rendering captcha for multiple forms on the same page.

= 1.2 =
* Bug fixes.

= 1.1 =
* Contact Form 7 support.
* Ability to choose MTCaptcha widgets (modern mini / standard).
* Ability to choose MTCaptcha for logged-in, logged-out, and all users.
* Bug fixes for comments form support.

= 1.0 =
* MTCaptcha on login, registration, forgot password, and WooCommerce checkout.
* Theme customization.
* Language selection.

== Upgrade Notice ==

= 2.8.1 =
Documentation and coding standards update. Adds a full disclosure of the MTCaptcha external service. No functional changes.

= 2.8.0 =
Important security update. Fixes CVE-2025-13520 (CSRF in plugin settings). Requires WordPress 6.0+ and PHP 8.2+. Upgrade as soon as possible.
