=== Reycob Form Firewall ===
Contributors: reycob38
Tags: spam protection, captcha, forms, login security, woocommerce
Requires at least: 6.0
Tested up to: 7.1
Requires PHP: 7.4
Stable tag: 1.3.3
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Protects public WordPress forms, login, registration, comments, and WooCommerce product reviews with a local CAPTCHA and rate limits.

== Description ==

Reycob Form Firewall adds a lightweight protection layer for public forms without using an external CAPTCHA service.

Main features:

* Local math CAPTCHA loaded only when the visitor interacts with the checkbox.
* Browser proof token, honeypot field, and origin validation for protected forms.
* Rate limits per visitor and per endpoint.
* Specific protection for WooCommerce product reviews against links, duplicated spam, and repeated abusive submissions.
* Automatic exclusions for WooCommerce cart, checkout, payments, coupons, shipping, Store API, REST API, webhooks, cron, and server-to-server requests.
* Admin settings for limits, CAPTCHA, browser proof mode, IP source, and excluded paths.
* Developer opt-out with `data-rffw-skip="1"` and opt-in for custom admin-post or admin-ajax actions through the `rffw_protected_actions` filter.

The plugin is designed for visible public forms. It does not modify global `fetch` or `XMLHttpRequest`, does not call third-party APIs, and does not log IP addresses or submitted form contents.

The JavaScript and CSS files distributed with the plugin are the human-readable source files. No minification, bundling, compilation, npm, webpack, or other build step is required.

== Installation ==

1. Upload the plugin folder to `/wp-content/plugins/reycob-form-firewall/`, or install it through the WordPress Plugins screen.
2. Activate **Reycob Form Firewall**.
3. Go to **Settings > Form Firewall**.
4. Review the default limits and clear any page cache/CDN cache after activation.
5. Test your public contact forms, login, registration, comments, product reviews, cart, checkout, and payment flow.

== Frequently Asked Questions ==

= Does it use Google reCAPTCHA or another external service? =

No. The CAPTCHA is generated and verified locally by WordPress.

= Does it protect WooCommerce checkout? =

No. Checkout, cart, coupons, payment callbacks, shipping calculations, Store API, and product add-to-cart actions are intentionally excluded so normal store operations keep working.

= Does it protect WooCommerce reviews? =

Yes. Product reviews use the general form protections plus an additional review-specific spam check.

= Can I exclude a form? =

Yes. Add `data-rffw-skip="1"` to the form element. Administrators can also exclude paths from the settings screen.

= Can developers protect custom AJAX or admin-post actions? =

Yes. Use the `rffw_protected_actions` filter to return an array of action names that should require the firewall checks.

== Privacy ==

The plugin does not collect analytics, does not send data to external services, and does not store submitted form contents.

Temporary tokens and hashed rate-limit keys may be stored in WordPress transients to validate CAPTCHA challenges, browser proof checks, and request frequency. These temporary values expire automatically.

== Changelog ==

= 1.3.3 =
* Use WordPress-generated endpoint paths for admin AJAX, admin post, comments, login, REST, XML-RPC, and admin area detection.
* Move CAPTCHA styles into a human-readable CSS source file and enqueue it normally.

= 1.3.2 =
* Prepared WordPress.org readme, centralized sanitized request reads, and adjusted automated review compatibility.

= 1.3.1 =
* Limited protection scope to public forms, login, registration, comments, and WooCommerce product reviews.
* Excluded WooCommerce cart, checkout, payments, Store API, webhooks, and license/API requests.
* Removed global request interception and added on-demand CAPTCHA loading.

== Upgrade Notice ==

= 1.3.3 =
Maintenance update for WordPress.org review feedback about endpoint detection and readable assets.
