=== CaptchaTool ===
Contributors: captchatool
Tags: captcha, spam, comments, contact form 7, privacy
Requires at least: 5.8
Tested up to: 7.0
Requires PHP: 7.4
Stable tag: 1.0.0
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Privacy-friendly CAPTCHA for WordPress forms. One checkbox, no fingerprinting, no cookies, no profiling.

== Description ==

CaptchaTool blocks form spam without tracking the people filling in your forms. Your visitors tick one box — no traffic lights, no crosswalks, no bicycles.

**What it does not do**

* No fingerprinting
* No cookies set on your visitors
* No profiling or cross-site tracking
* No data sold or shared

Every submission is checked twice: the visitor's browser solves a small proof-of-work puzzle, and your server then verifies a cryptographically signed, single-use proof that expires after five minutes. A forged or replayed proof is rejected.

**Works with**

* WordPress comment form
* User registration
* Lost password
* Login form (optional, off by default)
* Contact Form 7
* Any other form, via the `[captchatool]` shortcode

== Installation ==

1. Install and activate the plugin.
2. Get a free site key at https://captchatool.com/signup.
3. In your CaptchaTool dashboard, register your website and verify your domain.
4. Go to **Settings → CaptchaTool** and paste your site key.

The settings screen shows the exact origin your site sends. Register that same origin in your dashboard — if one has `www` and the other doesn't, every check fails.

== Frequently Asked Questions ==

= Does this work before I add a site key? =

The plugin stays completely inactive until a key is configured. It will never block your own forms because it is half set up.

= What happens if CaptchaTool goes down? =

By default, submissions are accepted. An outage on our side should not silently break your contact form. A visitor who actually fails verification is always blocked — the setting only covers the case where our service cannot be reached at all. You can switch to strict mode in Settings.

= Why is login protection off by default? =

Because a misconfiguration there locks you out of your own site. Turn it on once you have confirmed the widget appears and works, and test it in a second browser before relying on it.

= Does it add a "powered by" link to my site? =

Not unless you ask for one. Attribution is off by default; there is a checkbox in Settings if you want to show it. The widget does always display Privacy and Terms links, because it sends your visitor's IP address to our servers and they are entitled to know where it went.

= Is anything in the plugin locked behind a paid plan? =

No. Every feature in this plugin works on the free plan. CaptchaTool is a hosted service with paid tiers for higher volume, but nothing in this plugin's code is gated, time-limited or quota-limited.

= Does it slow the page down? =

The widget loads deferred and does its work in a background worker thread. The proof-of-work is usually finished before a visitor reaches the checkbox.

== External services ==

This plugin relies on the CaptchaTool service to decide whether a submission is human. It is not self-contained, and it will not work without an account.

**When it contacts the service**

1. When a protected form is displayed, the visitor's browser loads the widget script from `https://captchatool.com/widget/captcha-widget.min.js`.
2. While the visitor interacts with the form, their browser calls `https://captchatool.com/api/captcha/generate` and `.../validate` to obtain a signed proof.
3. When the form is submitted, your server calls `https://captchatool.com/api/captcha/verify-proof` to confirm that proof before the submission is accepted.

**What is sent**

* From the visitor's browser: their IP address and the origin of your site. This is used for rate limiting and abuse prevention.
* From your server: the challenge ID and the proof token, your public site key, and your site's origin. No visitor content and no form field values are sent.

No cookies are set on your visitors, no device fingerprinting is performed, and no cross-site profiles are built.

The widget script is served minified for speed. Its readable source is published at https://captchatool.com/widget/captcha-widget.js

Service provided by CaptchaTool.
Terms of use: https://captchatool.com/terms
Privacy policy: https://captchatool.com/privacy

== Privacy ==

The widget sends your visitor's IP address to captchatool.com so we can rate limit abuse. We do not set cookies on your visitors, do not fingerprint their device, and do not build profiles. See https://captchatool.com/privacy.

== Changelog ==

= 1.0.0 =
* First release: comments, registration, lost password, optional login, Contact Form 7, and a shortcode for everything else.
* Attribution link is opt-in and off by default.
