=== CaptchaBox – Free Private Captcha ===
Contributors: natbox
Tags: captcha, spam, recaptcha alternative, login security, contact form 7
Requires at least: 6.3
Tested up to: 7.1
Requires PHP: 7.4
Stable tag: 1.0.0
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Stop spam bots on login, sign-up, comments, WooCommerce and Contact Form 7. No puzzles, no cookies, no tracking. Free.

== Description ==

CaptchaBox is a privacy-friendly alternative to reCAPTCHA, hCaptcha and Turnstile. Your visitors never pick traffic lights or type letters: their browser does about a second of math in the background (proof of work), and your site checks the result with CaptchaBox before it accepts the form.

**What it protects**

* Login form (wp-login.php)
* Registration form
* Lost password form
* Comment form (optionally also for logged-in users)
* WooCommerce My Account login, registration and lost password
* Contact Form 7: add the `[captchabox]` tag to any form

**Why CaptchaBox**

* No image puzzles: nothing to click for most visitors.
* No cookies and nothing stored in the visitor's browser, so no cookie banner is needed for it.
* Visitor IP addresses are kept in memory for at most 10 minutes and never logged.
* Works in 7 languages (English, Arabic, Spanish, German, French, Portuguese, Turkish) and follows your site's language.
* Light, dark or automatic theme; normal or compact size.
* Never locks you out: if the CaptchaBox service cannot be reached, logins still work.
* Free plan: 10,000 successful checks a month and up to 10 sites. Paid plans for busier sites.

**Setup**

1. Create a free account at [my.natbox.io/captchabox](https://my.natbox.io/captchabox), add your site and its domain.
2. Copy the site key and secret into Settings > CaptchaBox.
3. Choose the forms to protect. Done.

Full guide: [captcha.natbox.io/docs/wordpress](https://captcha.natbox.io/docs/wordpress)

== External services ==

This plugin uses CaptchaBox, a captcha service run by natbox.io, to tell people from bots. It does nothing until you enter a site key and secret.

* **On pages with a protected form**, the visitor's browser loads the widget script from `https://captcha.natbox.io/v1/widget.js` and asks `captcha.natbox.io` for a puzzle, then sends back the answer. This sends the visitor's IP address, the address of your site, and the browser's user agent string with the request. The IP address is kept in memory for at most 10 minutes to limit abuse and is not logged.
* **When the form is sent**, your server sends your secret and the visitor's one-time token to `https://captcha.natbox.io/v1/siteverify` to check it. No personal data from the form is sent.

Terms: [natbox.io/terms](https://natbox.io/terms) · Privacy policy: [natbox.io/privacy#captchabox](https://natbox.io/privacy#captchabox)

== Installation ==

1. Install from Plugins > Add New (search for "CaptchaBox"), or upload the `captchabox` folder to `/wp-content/plugins/`.
2. Activate the plugin.
3. Go to Settings > CaptchaBox, paste your site key and secret, and save.

For a quick test before you have keys, use the test keys `cb_test_pass` (site key) and `cbs_test_pass` (secret): every check passes, on any domain. Replace them with your real keys before going live.

== Frequently Asked Questions ==

= Is it really free? =

Yes. The free plan includes 10,000 successful checks a month and up to 10 sites. If you need more, Plus (100,000 a month) and Pro (1,000,000 a month) are paid monthly plans.

= Do visitors have to solve a puzzle? =

No. The check runs on its own while the visitor fills in the form. If they press the button before it is done, the form waits a moment and then sends itself.

= What happens if CaptchaBox is down? =

Logins still work, so you are never locked out of your own site. Registration, password reset, comments and contact forms ask the visitor to try again.

= Does it work with page caching? =

Yes. The widget fetches a fresh puzzle each time in the visitor's browser, so cached pages are fine.

= Can I change the widget on one form only? =

Use the `captchabox_widget_attributes` filter. It receives the attributes and a context (`login`, `register`, `lostpassword`, `comments`, `woocommerce-login`, `woocommerce-register`, `woocommerce-lostpassword`, `cf7`).

= Does it protect XML-RPC or the REST API? =

No. Those are not forms, so there is no captcha to show. Application passwords and apps keep working.

== Screenshots ==

1. The widget on the WordPress login form.
2. The settings page.

== Changelog ==

= 1.0.0 =
* First release: login, registration, lost password, comments, WooCommerce My Account forms and Contact Form 7.
