Àpèjúwe
GridXFlex Captcha Security adds a self-hosted image CAPTCHA, backed by a silent honeypot layer, to your siteÌtumọ̀ Yorùbá: ’s Login, Registration, Lost Password, and Comments forms.
Everything is generated on your own server using PHPÌtumọ̀ Yorùbá: ’s built-in GD library. No requests are ever sent to a third-party service, no API keys are required, and no personal data is stored beyond a short-lived, one-time-use security token.
Features
- Self-hosted image CAPTCHA (GD-generated, delivered inline as a base64 image — no extra HTTP request)
- Silent honeypot field on every protected form, on by default
- Per-form protection toggles: Login, Registration, Lost Password, Comments
- Configurable character type (alphanumeric / letters / numbers), letter case, and length (3–6 characters)
- Option to hide the comment captcha for logged-in users
- One-time-use challenge tokens — each code can be attempted exactly once, then itÌtumọ̀ Yorùbá: ’s gone
- No PHP sessions, no cookies set by this plugin, no external requests, no tracking
Why no PHP sessions?
Older captcha plugins commonly call session_start() on every front-end request, even on pages that never show a captcha. That has a real performance cost, breaks under object-cache or load-balanced PHP-FPM pools without sticky sessions, and is incompatible with full-page caching. GridXFlex Captcha Security stores each challenge as a short-lived WordPress transient, keyed by a random token embedded in the form. The token is just a lookup key — the actual secret (a hash of the code) stays server-side — so it remains safe even on a cached page, and each challenge is deleted the instant itÌtumọ̀ Yorùbá: ’s checked, pass or fail.
Àwọn àwòrán ìbòjú
Ìgbéwọlẹ̀
- Upload the
gridxflex-captcha-securityfolder to/wp-content/plugins/. - Activate the plugin through the “Plugins” screen in WordPress.
- Go to Settings GridXFlex Captcha to choose which forms are protected and adjust the captchaÌtumọ̀ Yorùbá: ’s appearance.
FAQ
-
Does this plugin transmit any data externally?
-
No. Code generation, image rendering, and verification all happen on your own server using PHPÌtumọ̀ Yorùbá: ’s built-in GD library. Nothing is sent to any third-party API or service.
-
Why doesnÌtumọ̀ Yorùbá: ’t this use PHP sessions?
-
For compatibility with page caching and load-balanced hosting. Instead of
$_SESSION, each challenge is stored as a short-lived WordPress transient keyed by a random token embedded in the form. This works identically behind full-page cache and across load-balanced PHP-FPM pools without sticky sessions, and every challenge is automatically deleted after a single use. -
What is the honeypot layer?
-
A hidden form field thatÌtumọ̀ Yorùbá: ’s invisible to human visitors but often auto-filled by simple bots. If itÌtumọ̀ Yorùbá: ’s filled in, the submission is rejected the same way a wrong CAPTCHA code would be — no separate “bot detected” message is ever shown, so automated scripts canÌtumọ̀ Yorùbá: ’t learn which check they failed.
-
Does this require an API key?
-
No. This version doesnÌtumọ̀ Yorùbá: ’t use any third-party CAPTCHA provider.
-
Does the plugin work if my host doesnÌtumọ̀ Yorùbá: ’t have the GD PHP extension?
-
Yes. If GD isnÌtumọ̀ Yorùbá: ’t available, the image challenge is automatically skipped — protected forms keep working normally, they just fall back to honeypot-only protection instead of erroring out. YouÌtumọ̀ Yorùbá: ’ll see an admin notice explaining this; it clears itself automatically as soon as GD is enabled, no need to reactivate the plugin.
-
Does the captcha add any visible branding to my site?
-
An HTML comment —
<!-- Powered By GridXFlex WordPress Plugins -->— is placed next to the captcha markup wherever it renders (login, registration, lost password, comments). It isnÌtumọ̀ Yorùbá: ’t visible in the page as displayed, only in page source. -
What happens if someone gets the comment captcha wrong?
-
TheyÌtumọ̀ Yorùbá: ’re redirected back to the same post with an inline error message, and their typed name, email, URL, and comment text are restored — nothing is lost and they donÌtumọ̀ Yorùbá: ’t leave the page. Login, Registration, and Lost Password show their errors the same way, inline on the same page, using WordPress coreÌtumọ̀ Yorùbá: ’s own error-display mechanism for those forms.
Àwọn àgbéyẹ̀wò
Kò sí àwọn àgbéyẹ̀wò fún plugin yìí.
Àwọn Olùkópa & Olùgbéejáde
“GridXFlex Captcha Security” jẹ́ ètò ìṣàmúlò orísun ṣíṣí sílẹ̀. Àwọn ènìyàn wọ̀nyí ti ṣe ìkópa sí plugin yìí.
Àwọn Olùkópa
Túmọ̀ “GridXFlex Captcha Security” sí èdè rẹ.
Ṣe o nífẹ̀ẹ́ sí ìdàgbàsókè?
Ṣàwárí koodu, ṣàyẹ̀wò ibi ìpamọ́ SVN, tàbí ṣe àgbékalẹ̀ sí àkọsílẹ̀ ìdàgbàsókè nípasẹ̀ RSS.
Àkọsílẹ̀ àwọn àyípadà
1.0.0
- Initial release: image CAPTCHA + honeypot for Login, Registration, Lost Password, and Comments forms.
- Graceful fallback when the GD extension is unavailable: protected forms keep working via the honeypot layer alone instead of erroring; the admin notice re-checks live and clears itself once GD is enabled, no reactivation needed.