外掛標籤
開發者團隊
原文外掛簡介
TrueSift connects WordPress forms to the TrueSift verification service. It starts an automated browser challenge when a protected form is displayed, keeps the form submit action unavailable until an authoritative verification token is issued, and validates and atomically consumes that single-use token on the WordPress server before the protected action continues.
The plugin does not implement a separate CAPTCHA protocol. Its browser runtime tracks the public @truesift/next 0.3.0 client contract, and its PHP bridge uses the official TrueSift challenge, verify, and business-proof API contracts.
Included integrations
WordPress login
WordPress registration
WordPress password reset request
WordPress comments
WooCommerce customer login
WooCommerce customer registration
WooCommerce checkout (classic and Checkout Block)
WooCommerce product reviews
Contact Form 7
WPForms
Fluent Forms
Elementor Pro Forms
Manual shortcode and PHP helper integration
The WooCommerce checkout integration supports both the classic shortcode checkout and the Checkout Block. Checkout Block proofs are carried through Store API extension data and validated before checkout processing.
Security model
The browser sends only an opaque verificationToken as security proof. Client-provided values such as allowed, decision, score, status, failOpen, challengeId, action, path, and origin are never trusted by the protected PHP action.
The plugin sends the token together with a signed WordPress form context to the server. The PHP verifier calls TrueSift’s proof endpoint with server-owned credentials and expected action, path, and origin. A normal success is accepted only when TrueSift confirms allowed: true, decision: allow, and atomic consumption through either consumed: true or a non-empty consumedAt timestamp. Replayed, expired, invalid, mismatched, reviewed, or blocked proofs are rejected.
The bundled SDK 0.3.0 adapter may send only aggregate in-memory interaction counters for the current verification window, such as pointer, keyboard, focus, and blur counts. It does not send pointer coordinates, pressed keys, form contents, device fingerprints, or persistent visitor identifiers. Missing or insufficient behavioral telemetry remains neutral.
Visual modes
The admin page shows live, non-networked previews of all official layouts:
Checkbox
Banner
Inline
Badge
Theme, language, size, and appearance can be configured globally.
Manual integration
Place the shortcode inside a form:
[truesift]
When used outside a form, the same shortcode renders a standalone visual verification status. Standalone mode does not protect a business action until it is associated with a form and server-side verification.
For a form located elsewhere in the DOM:
[truesift form_selector="#contact-form" button_selector="button[type=submit]"]
A custom PHP handler must also validate the proof before performing its protected action:
$proof = truesift_verify_request();
Continue only when the returned value is not a WP_Error and its allowed value is true.
External services
This plugin connects to the external TrueSift service operated by WebDigiTech.
The following requests are made only when TrueSift is configured and a protected form or connection test is used:
Browser challenge through the local WordPress route, forwarded server-to-server to https://api.truesift.de/api/v1/botguard/challenge
Browser verification through the local WordPress route, forwarded server-to-server to https://api.truesift.de/api/v1/botguard/verify
Authoritative single-use proof verification directly from the protected WordPress server action to https://api.truesift.de/api/v1/botguard/proof/verify
Data sent can include the site key, requested action, page path, website origin, browser language, languages, time zone, screen and viewport dimensions, platform information, cookie availability, referrer, current page URL, challenge identifiers, short-lived challenge tokens, verification timing, aggregate interaction counters for the active verification window, and the single-use verification token. The behavioral counters contain counts only and do not contain pointer coordinates, actual pressed keys, form contents, fingerprints, or persistent visitor identifiers. The secret key is sent only server-to-server and is never exposed to the browser.
TrueSift service information: https://truesift.de/
Request access and obtain a Site Key / Secret Key: https://truesift.de/#zugang
Privacy policy: https://webdigitech.de/datenschutz
Terms of service: https://webdigitech.de/agb
Privacy
The plugin adds suggested text to WordPress’ Privacy Policy Guide. It does not store visitor verification tokens, browser metadata, or visitor profiles in the WordPress database. Site credentials are stored encrypted when supported by the server, or may be supplied through wp-config.php constants.
