[WordPress] 外掛分享： LukaCodes AntiSpam Shield

All features are independent — enable only what you need.
Login & Registration Shield
Version 1.1.2 adds CAPTCHA protection to wp-login.php:

Login Shield — Hooks into wp_authenticate_user for server-side verification after credentials are checked. Returns a WP_Error if CAPTCHA fails — WordPress displays it as a normal login error.
Registration Shield — Hooks into registration_errors to add CAPTCHA validation during registration. Works alongside all other WordPress registration validations.

Both are independently togglable in the settings panel. Admins already logged in are never affected.
WPForms Integration
Version 1.1.0 introduces CAPTCHA protection for WPForms Lite:

Hooks into wpforms_display_submit_before to inject the CAPTCHA widget before the submit button.
Hooks into wpforms_process for server-side token verification.
Works with both reCAPTCHA v3 (invisible) and Cloudflare Turnstile (visible widget).

Note: WPForms Pro includes its own native CAPTCHA integration — this feature is intended for WPForms Lite users only.
Why AntiSpam Shield?
Most anti-spam plugins are heavy, require accounts, or add ugly CAPTCHAs. LukaCodes AntiSpam Shield is different:

~30 KB total — no external libraries, no jQuery dependency
Settings page with live key testing — verify your reCAPTCHA or Turnstile keys before enabling
Link stripping preview — paste any comment text and see exactly what gets removed
Graceful fallback: if Google’s or Cloudflare’s API is unreachable, comments are held for moderation (never lost)
Trusted users (administrators) bypass CAPTCHA checks automatically
Mutual exclusion: reCAPTCHA v3 and Cloudflare Turnstile cannot be active at the same time
WP Coding Standards compliant — fully escaped output, nonce-protected AJAX

reCAPTCHA v3 — How it works
When a visitor submits a form, JavaScript silently requests a score token from Google. The token is sent with the submission and verified server-side against your minimum score threshold (configurable from 0.1 to 1.0). No user interaction required.
Cloudflare Turnstile — How it works
A Turnstile widget is rendered inside the form. When the visitor completes the challenge, a token is submitted and verified server-side against the Cloudflare API.
Third-Party Services
This plugin optionally uses the following third-party services:
Google reCAPTCHA v3
A service provided by Google LLC.

What it does: Detects bots and spam on your comment form and contact forms without user interaction.
When data is sent: Only when reCAPTCHA v3 is enabled. A token is sent to https://www.google.com/recaptcha/api/siteverify on each form submission.
What data is sent: The visitor’s IP address and a reCAPTCHA token.
Google Privacy Policy: https://policies.google.com/privacy
Google Terms of Service: https://policies.google.com/terms

Cloudflare Turnstile
A service provided by Cloudflare, Inc.

What it does: Presents a privacy-friendly CAPTCHA widget on comment and contact forms.
When data is sent: Only when Cloudflare Turnstile is enabled. A token is sent to https://challenges.cloudflare.com/turnstile/v0/siteverify on each form submission.
What data is sent: The visitor’s IP address and a Turnstile token.
Cloudflare Privacy Policy: https://www.cloudflare.com/privacypolicy/
Cloudflare Terms of Service: https://www.cloudflare.com/website-terms/

Both services are entirely optional. If you do not enter API keys or enable either CAPTCHA, no data is sent to any third party.

延伸相關外掛