內容簡介
VAPTCHA Human Verification 是一款完全免費的 WordPress 人類驗證外掛，旨在保護標準的 WordPress 表單免受自動濫用，同時保持原始頁面佈局不變。
【主要功能】
• 保護 WordPress 登入、用戶註冊、密碼重置及評論
• 無需可見驗證按鈕或修改表單樣式
• 完全免費使用，無需 VAPTCHA 帳號
• 提供即時可用的共享驗證單元
• 符合 WordPress 安全實踐，保護驗證憑證
外掛標籤
開發者團隊
原文外掛簡介
VAPTCHA Human Verification is a completely free WordPress human verification plugin. It helps protect standard WordPress forms from automated abuse while keeping the original page layout unchanged.
The plugin protects:
WordPress login
User registration
Password reset
Comments
Verification opens only when a visitor submits an enabled form. The plugin does not add a visible verification button or modify the native WordPress form styling.
Free to use
The VAPTCHA Human Verification plugin is completely free to download and use.
The ready-to-use shared verification unit works immediately after activation at no additional cost.
No VAPTCHA account is required for the shared unit.
Site owners can optionally connect their own verification unit for independent statistics and management.
Security by design
The plugin follows WordPress security practices and is designed to keep verification credentials and form data protected:
VKEY is used only by server-side PHP and is never sent to the browser, HTML, JavaScript, REST responses, or browser developer tools.
Protected forms use WordPress nonces, input sanitization, and escaped output.
Missing, expired, invalid, or forged verification data is rejected.
Verification and network failures fail closed instead of accepting the protected action.
The plugin does not modify WordPress login or comment styles and does not add a public credit link.
The plugin includes a ready-to-use shared verification unit, so protection works immediately after activation. For independent verification statistics and unit management, create a verification unit at https://www.vaptcha.com/ and enter its VID and VKEY on the settings page.
External services
This plugin connects to the VAPTCHA human verification service to protect the WordPress forms selected by the site administrator.
When a protected form is displayed, the browser loads the VAPTCHA SDK from https://c4.vaptcha.com/src/v4.js.
When a visitor submits a protected form and verification starts, the SDK connects to VAPTCHA service endpoints to provide human verification. VAPTCHA processes the visitor’s IP address, browser and device signals (including the user agent), verification-session identifiers, verification results, and the interaction data produced within the verification interface, such as operation timing and trajectory characteristics.
The SDK may use cookies or browser local storage for limited verification-session or device-recognition identifiers. They are used only to help complete verification, reduce repeated verification, prevent abuse, and protect service security; they are not used for advertising or unrelated tracking.
Before WordPress accepts a protected action, the WordPress server sends the VID, VKEY, verification token, verification-session identifier, and visitor IP address to https://v41.vaptcha.com/api/verify for server-side verification. The plugin does not send WordPress usernames, passwords, comment text, or other form contents to VAPTCHA.
The VAPTCHA service is provided by VAPTCHA:
User Service Agreement
Privacy Statement
By installing and activating the plugin, the site administrator enables this external service for the selected forms and is responsible for providing any notice required for the site’s visitors.
Privacy
Protected forms use the external VAPTCHA service. See the VAPTCHA Privacy Statement for the information processed for verification, including the limited use of cookies and browser local storage. No VAPTCHA-powered public credit link is added by this plugin. Site administrators should disclose this processing in their own privacy notice where required.
