描述
GridXFlex Captcha Security adds a self-hosted image CAPTCHA, backed by a silent honeypot layer, to your site’s Login, Registration, Lost Password, and Comments forms.
Everything is generated on your own server using PHP’s built-in GD library. No requests are ever sent to a third-party service, no API keys are required, and no personal data is stored beyond a short-lived, one-time-use security token.
Features
- Self-hosted image CAPTCHA (GD-generated, delivered inline as a base64 image — no extra HTTP request)
- Silent honeypot field on every protected form, on by default
- Per-form protection toggles: Login, Registration, Lost Password, Comments
- Configurable character type (alphanumeric / letters / numbers), letter case, and length (3–6 characters)
- Option to hide the comment captcha for logged-in users
- One-time-use challenge tokens — each code can be attempted exactly once, then it’s gone
- No PHP sessions, no cookies set by this plugin, no external requests, no tracking
Why no PHP sessions?
Older captcha plugins commonly call session_start() on every front-end request, even on pages that never show a captcha. That has a real performance cost, breaks under object-cache or load-balanced PHP-FPM pools without sticky sessions, and is incompatible with full-page caching. GridXFlex Captcha Security stores each challenge as a short-lived WordPress transient, keyed by a random token embedded in the form. The token is just a lookup key — the actual secret (a hash of the code) stays server-side — so it remains safe even on a cached page, and each challenge is deleted the instant it’s checked, pass or fail.
屏幕截图
安装
- Upload the
gridxflex-captcha-securityfolder to/wp-content/plugins/. - Activate the plugin through the “Plugins” screen in WordPress.
- Go to Settings GridXFlex Captcha to choose which forms are protected and adjust the captcha’s appearance.
常见问题
-
Does this plugin transmit any data externally?
-
No. Code generation, image rendering, and verification all happen on your own server using PHP’s built-in GD library. Nothing is sent to any third-party API or service.
-
Why doesn’t this use PHP sessions?
-
For compatibility with page caching and load-balanced hosting. Instead of
$_SESSION, each challenge is stored as a short-lived WordPress transient keyed by a random token embedded in the form. This works identically behind full-page cache and across load-balanced PHP-FPM pools without sticky sessions, and every challenge is automatically deleted after a single use. -
What is the honeypot layer?
-
A hidden form field that’s invisible to human visitors but often auto-filled by simple bots. If it’s filled in, the submission is rejected the same way a wrong CAPTCHA code would be — no separate “bot detected” message is ever shown, so automated scripts can’t learn which check they failed.
-
Does this require an API key?
-
No. This version doesn’t use any third-party CAPTCHA provider.
-
Does the plugin work if my host doesn’t have the GD PHP extension?
-
Yes. If GD isn’t available, the image challenge is automatically skipped — protected forms keep working normally, they just fall back to honeypot-only protection instead of erroring out. You’ll see an admin notice explaining this; it clears itself automatically as soon as GD is enabled, no need to reactivate the plugin.
-
Does the captcha add any visible branding to my site?
-
An HTML comment —
<!-- Powered By GridXFlex WordPress Plugins -->— is placed next to the captcha markup wherever it renders (login, registration, lost password, comments). It isn’t visible in the page as displayed, only in page source. -
What happens if someone gets the comment captcha wrong?
-
They’re redirected back to the same post with an inline error message, and their typed name, email, URL, and comment text are restored — nothing is lost and they don’t leave the page. Login, Registration, and Lost Password show their errors the same way, inline on the same page, using WordPress core’s own error-display mechanism for those forms.
评价
此插件暂无评价。
贡献者及开发者
更新日志
1.0.0
- Initial release: image CAPTCHA + honeypot for Login, Registration, Lost Password, and Comments forms.
- Graceful fallback when the GD extension is unavailable: protected forms keep working via the honeypot layer alone instead of erroring; the admin notice re-checks live and clears itself once GD is enabled, no reactivation needed.