WordPress¶

The EU-Captcha plugin protects the forms of WordPress and of the usual form plugins. It does the widget and the server-side verification.

Setup of the plugin in WordPress

Requirements¶

The following requirements must be met:

Requirement	Value
WordPress	from version 5.8, tested up to version 6.9
PHP	from version 7.4
Access	Administration area of WordPress

Protected forms¶

The plugin protects these forms:

login of WordPress
registration of WordPress
comments of WordPress
Contact Form 7
Ninja Forms
WooCommerce Checkout
WPForms

Set up the plugin¶

Proceed as follows to set up the plugin:

► Upload the eu-captcha folder into the /wp-content/plugins/ directory of your installation.

List of the plugins with the EU-Captcha plugin

► Activate the plugin in the Plugins menu.
↳ The EU-Captcha settings page is available.

EU-Captcha settings page

► Open the EU-Captcha settings page.
► Click on the Quick Setup button. As an alternative, enter the public sitekey and the secret manually.
► Below Protected Destinations, select the forms to protect.
► Click on the Save Changes button.
➔ The plugin embeds the widget in the selected forms and verifies the tokens on the server.

EU-Captcha settings page after saving

Behaviour during a malfunction¶

By default, the plugin refuses a transmission if the API is not reachable. Thus, the protection cannot be bypassed during a malfunction.

The Failsafe option in the settings below API Settings changes this behaviour: transmission errors such as timeouts or name resolution errors then count as a verification that passed. The plugin continues to refuse invalid responses.

Warning

With the Failsafe option activated, your form stays available during a malfunction. The form is unprotected during this time.

Protect your own forms¶

The plugin supplies the eu_captcha_verify() function. With it, other plugins and themes verify a token with the credentials that are already stored.

Add the widget element to your form:

<div class="eu-captcha" data-sitekey="a1b2c3d4-0000-0000-0000-000000000000"></div>

Verify the token during the transmission:

if ( function_exists( 'eu_captcha_verify' ) ) {
    $token  = sanitize_text_field( $_POST['eu-captcha-response'] );
    $result = eu_captcha_verify( $token );
    if ( ! $result ) {
        wp_die( 'Captcha verification failed.' );
    }
}

The function returns true for a valid verification, and false for an invalid token, missing credentials, or an error of the API. Always examine with function_exists() first, so that your source code also operates when the plugin is deactivated.

The plugin embeds the verify.js script on all pages of the frontend and on the login page itself.