Kitgenix CAPTCHA for Cloudflare Turnstile
| 开发者 |
kitgenix
carlbensy16 |
|---|---|
| 更新时间 | 2025年12月9日 20:52 |
| 捐献地址: | 去捐款 |
| PHP版本: | 7.0 及以上 |
| WordPress版本: | 6.8 |
| 版权: | GPLv3 or later |
| 版权网址: | 版权信息 |
详情介绍:
Cloudflare Turnstile, done properly for WordPress.
Kitgenix CAPTCHA for Cloudflare Turnstile is a lightweight, privacy-first reCAPTCHA alternative that adds Cloudflare Turnstile to your WordPress, WooCommerce and form plugins with server-side validation, replay protection and proxy-aware IP detection.
Protect:
- WordPress core forms – login, registration, lost/reset password, comments
- WooCommerce – checkout, account login/registration, lost password (Classic and Blocks / Store API)
- Form plugins – WPForms, Fluent Forms, Gravity Forms, Formidable Forms, Forminator, Contact Form 7, Jetpack Forms, Kadence Forms
- Elementor Pro Forms and Popups
- Forums – bbPress topic and reply forms
- Ultra-lightweight and fast
- Uses the modern WordPress Script API (6.3+) with
strategy=async - Scripts load only on protected pages and forms
- Privacy-first
- The plugin itself does not add cookies or tracking
- Cloudflare Turnstile is designed to minimise data collection
- Rock-solid server-side validation
- Uses Cloudflare’s official
siteverifyendpoint - Validates tokens server-side for all supported forms
- Replay protection
- Rejects reused tokens by default (TTL is filterable)
- Proxy-aware client IP
- Correctly resolves IPs behind Cloudflare, reverse proxies and load balancers
- Honours proxy headers only from configured trusted proxies
- Deep integrations
- WordPress core, WooCommerce (Classic and Blocks), Elementor Pro
- WPForms, Fluent Forms, Gravity Forms, Formidable Forms, Forminator, Contact Form 7, Jetpack Forms, Kadence Forms
- bbPress forums
- Smart UX
- Optional “disable submit until verified”
- Token freshness timers and auto-resets
- Clean inline error hints designed to match Cloudflare’s own UI
- Production-ready admin
- Onboarding wizard and Site Health integration
- Modern sidebar UI with overview card, collapsible sections, search/filter box, and an “Unsaved changes” bar
- Shortcode copy button next to
[kitgenix_turnstile] - Multisite-aware
- Per-site settings
- Clean uninstall removes settings site-wide (and network-wide if run via Network Admin)
- Login (
wp-login.php) - Registration
- Lost and Reset Password
- Comments
- Checkout
- Login
- Registration
- Lost Password
- Checkout (Blocks / Store API)
X-Turnstile-Token or similar headers and are handled automatically by the plugin.
Elementor Pro (Forms and Popups)
- Elementor Pro Forms (including popups and dynamically loaded forms)
- All CF7 forms
[kitgenix_turnstile] is available for manual placement. In Shortcode-only mode, CF7 forms are passed through do_shortcode() so manual placement works reliably.
Fluent Forms
- All Fluent Forms
- All Formidable Forms
- All Forminator forms
- All Gravity Forms
- Jetpack Contact Forms
- Kadence form blocks
- WPForms Lite and Pro
- Create Topic and Reply forms
- Loads the Cloudflare Turnstile API\
https://challenges.cloudflare.com/turnstile/v0/api.js?render=explicit\ using the WordPress Script API (async for WordPress 6.3+). - Injects a widget into enabled forms\ Handles AJAX, multi-step forms, popups and other dynamic DOM changes.
- Verifies tokens server-side\
Uses Cloudflare’s
/v0/siteverifyendpoint with your secret key and request IP (when appropriate). - Enforces replay protection\ Caches recent tokens (hashed) and rejects re-use (TTL is filterable).
- Blocks on failure\ Submissions with invalid, expired or reused tokens are blocked with a clear, user-friendly message.
- Install and activate from Plugins → Add New by searching for “Kitgenix Turnstile”.
- Go to Settings → Cloudflare Turnstile.
- Enter your Site Key and Secret Key from the Cloudflare Turnstile dashboard.
- Enable the integrations and specific forms you want to protect.
- Save changes, then test login, registration, comments, checkout and form pages.
- Async by default using the WordPress Script API with
strategy=asyncon WordPress 6.3+. - Conditional loading so Turnstile assets load only where protection is enabled.
- Works with caching and optimisation plugins:
- Allowlist
https://challenges.cloudflare.comin defer/optimise settings. - Avoid inlining, combining or heavily delaying the Turnstile script.
- Exclude login, account and checkout pages from full-page caching where possible.
- Resource hints (preconnect/dns-prefetch) for
https://challenges.cloudflare.comto speed up first paint.
- Replay protection is enabled by default; adjust duration using
kitgenix_turnstile_replay_ttl. - Configure trusted proxies when using Cloudflare/CDN/reverse-proxy so the correct client IP is used.
- Use Developer Mode (warn-only) on staging to log failures without blocking users.
- Whitelisting (logged-in users, IPs and user agents) is supported but should be used sparingly.
- Confirm Site and Secret Keys are correct.
- Check that the integration and specific form location are enabled.
- Verify you are not whitelisted (user, IP or user agent).
- Clear caches (page, object, CDN).
- Allowlist
challenges.cloudflare.comin optimisation plugins. - Check the browser console for blocked or failed scripts.
- Token may be expired or invalid.
- Reduce page cache TTL on form pages.
- Do not full-page cache auth or checkout pages.
- Ensure your server can reach Cloudflare (no firewall blocks).
- Avoid over-deferring Elementor or form plugin JavaScript.
- The plugin listens to Elementor events and re-renders containers dynamically.
- Avoid caching dynamic fragments.
- Confirm the widget renders before the Place order button.
- If using custom checkout flows, ensure the token is forwarded correctly.
安装:
- Install via Plugins → Add New and search for “Kitgenix Turnstile”, or upload the ZIP file to
/wp-content/plugins/. - Activate the plugin from the Plugins screen.
- Go to Settings → Cloudflare Turnstile.
- Enter your Site Key and Secret Key from the Cloudflare Turnstile dashboard.
- Enable the integrations and forms you want to protect.
- Save and test your login, registration, comments, checkout and form pages.
屏幕截图:
常见问题:
Do I need a Cloudflare account?
Yes. A free Cloudflare account is enough to create a Turnstile Site Key and Secret Key.
Does this support Elementor Free?
We officially support Elementor Pro Forms. A fallback injector helps with general Elementor forms (including popups), but Elementor Pro Forms is the primary target for reliability.
Is this compatible with caching and optimisation plugins?
Yes. Scripts are async and conditionally loaded. You may need to allowlist challenges.cloudflare.com and avoid over-aggressive script deferral. Avoid full-page caching for login, account and checkout pages.
Can I skip validation for certain users?
Yes. You can whitelist logged-in users, IPs (exact, wildcard or CIDR) and user agents. There is also a filter to adjust whitelist decisions programmatically.
How is this different from Google reCAPTCHA?
Cloudflare Turnstile is a privacy-first, low-friction alternative. It avoids user tracking, aims to minimise data collection and still blocks bots effectively.
Which form plugins are supported?
WPForms, Fluent Forms, Gravity Forms, Formidable Forms, Forminator, Contact Form 7, Jetpack Forms, Kadence Forms, plus Elementor Pro Forms and core WordPress and WooCommerce forms.
Can I change the widget theme, size and language?
Yes. You can choose auto, light or dark, select small, normal, large or flexible sizes, switch interaction mode (always or interaction-only) and set language (auto or a specific locale code).
Why are there collapsible sections on the Settings page?
To make the page easier to scan. Groups such as Shortcode, Display, Security and Integrations are collapsible, and their open or closed state is remembered per browser.
How do I quickly find a setting?
Use the filter box on the left side of the settings page. Typing text hides non-matching navigation links and cards. Clear it with the “×” button.
What does the floating “Unsaved changes” bar mean?
It appears after you modify at least one field and reminds you to save. Click the Save button in the bar or the normal Save Settings button. Once saved, the bar disappears.
How do I copy the Turnstile shortcode?
Open the Shortcode and Manual Placement section and click the Copy button next to [kitgenix_turnstile].
Can I disable the collapsible behaviour?
Yes. A developer can dequeue the admin JavaScript or filter the settings page output to remove <details> wrappers. Native <details> elements degrade gracefully if scripting is disabled.
Can I pin or self-host the Turnstile script?
Yes. Use the kitgenix_captcha_for_cloudflare_turnstile_script_url filter to override the script URL or append query arguments.
Does it work on Multisite?
Yes. Settings are per-site. Uninstalling via Network Admin removes settings network-wide.
Is the plugin GDPR compliant?
The plugin itself does not store personal data. Cloudflare Turnstile processes IP and user agent to verify challenges. Review Cloudflare’s documentation and your legal requirements for your specific use case.
更新日志:
1.0.14 (09 December 2025)
- Fix: WooCommerce Blocks checkout widget now renders reliably even when Classic Checkout is disabled. The renderer no longer waits for the container to be visible before calling
turnstile.render()for Blocks, preventing missed render windows. - Improvement: Public JS detects
data-kitgenix-captcha-for-cloudflare-turnstile-owner="woocommerce-blocks"and performs an immediate render, then falls back to visibility guard for other owners. - Stability: Keeps existing behaviour for Classic, core and form plugins; no changes to validation flows or token forwarding (header + Store API
extensions). - Placement: Ensures the widget is injected directly above the “Place order” area in WooCommerce Blocks checkout (handles submit button, text node, and actions wrapper variants).
- UI: Split WooCommerce settings into two blocks — “WooCommerce Classic” and “WooCommerce Blocks (Store API)” — with separate injection mode controls and clearer guidance.
- Clarification: Unchecking “Checkout Form (Classic)” does not affect Blocks Checkout; disable Blocks auto-injection via its “Shortcode only” mode if desired.
- Respect Shortcode-only: When Blocks is set to “Shortcode only”, auto-rendering is suppressed and server-side validation only enforces when a token is present (i.e. when you place the shortcode). Without a shortcode/token, checkout proceeds without Turnstile.
- Admin UI: Modernized settings page with sidebar navigation (icons), status overview card, accessible collapsible sections, and improved layout. Kept the floating “Unsaved changes” bar.
- Shortcode UX: Added a copy button next to
[kitgenix_turnstile]in the settings for easy manual placement. - Branding: Updated accent color across admin and public CSS to
#f38120. - Removed: Export/Import Settings feature — UI removed and handlers disabled (
class-settings-transfer.phpno longer registers actions). Any old direct Import/Export URLs are no-ops. - Cleanup: Removed the Simple/Advanced mode toggle from the settings UI and scripts.
- Dev: Dropped the unused
kitgenix_turnstile_validate_keysAJAX nonce localization from admin scripts.
- Security Fix: Critical validation bypass in Elementor Pro Forms and Forminator Forms where missing tokens were incorrectly allowing form submissions instead of blocking them.
- Fix: Elementor Pro Forms now properly fail validation when Turnstile token is missing or empty (previously skipped validation entirely).
- Fix: Forminator Forms now properly fail validation when Turnstile token is missing or empty (previously skipped validation entirely).
- Fix: Removed
wp_kses_post()wrapper from Forminator submit button HTML that could strip required attributes. - Security: Audit confirmed all other integrations (Contact Form 7, Gravity Forms, Formidable Forms, WPForms, Fluent Forms, Jetpack Forms, Kadence Forms, WooCommerce, WordPress Core, bbPress, BuddyPress) correctly validate and fail when tokens are missing.
- Important: This update fixes a security vulnerability where forms could be submitted without completing CAPTCHA verification. Update immediately.
- Fix: Reverted to 1.0.11 until secuirty update was released.
- New: Global shortcode
[kitgenix_turnstile]to render the Turnstile widget manually inside custom HTML fields, form content or page templates. - Improvement: Auto-inject versus Shortcode behaviour is now mutually exclusive and consistent across integrations.
- Added:
includes/core/class-turnstile-shortcode.phpwith a robust shortcode renderer and recursive detection helperhas_shortcode_in()that detects literal shortcodes and rendered widget markers (class="cf-turnstile",data-kitgenix-shortcodeor hiddenname="cf-turnstile-response"). - Updated: Integration adapters to use the new helper and treat literal shortcode text separately from rendered markup so Auto mode is not blocked by leftover shortcode tokens.
- Updated: When an integration needs to run
do_shortcode()in Auto mode, it temporarily removes the plugin shortcode, runsdo_shortcode()and then immediately re-registers the shortcode so it is never left unregistered. - Fix: CF7 shortcode rendering in Shortcode-only mode – Contact Form 7 form HTML is now passed through
do_shortcode()when the integration is set to Shortcode-only. - Improvement: Ensured Shortcode-only mode works across all supported form plugins via defensive
do_shortcode()passthroughs and field-level filters, while Auto mode detection ignores literal shortcode tokens. - UI: Only show the global Shortcode guidance card when at least one supported forms integration is present. Removed Auto/Shortcode radio controls from the WordPress Core card; core forms use the Enable checkbox and per-form toggles only.
- Dev: Reworked temporary shortcode removal logic to guarantee re-registration after
do_shortcode(). Fixed edge-case uninitialised variable and parse issues. - Dev: Standardised detection and injection semantics and added comments and guards for missing site keys, filters and plugin version differences.
- Note: The stored
mode_wp_coresetting is retained for compatibility but no longer exposed in the UI. It can be removed in a future release if needed.
- Fix: Elementor AJAX regression — prevented a brief layout “bump” where interaction-only lost
.kitgenix-ts-collapsedduring the AJAX send; the container now stays collapsed unless a visible challenge is explicitly required.
- Fix: Elementor Popups — reliably initializes the Turnstile challenge when a popup opens (even if the widget was inserted while hidden). Clears stale render flags, resets hidden iframes, and triggers a fresh render on show.
- Fix: Hidden input — always ensures
input[name="cf-turnstile-response"]exists for Elementor forms (including popups) so the token is properly captured and validated. - Fix: Interaction Only empty gaps — placeholders are now fully collapsed until the widget actually renders (via
data-rendered). After successful AJAX submits, the container is collapsed/hidden to prevent any blank space. - Fix: Multiple forms on a page — consistent collapsed behavior across instances; prevents duplicate containers in Elementor popups and re-renders only when needed.
- Improvement: Event-driven rendering — added
kgx:turnstile-containers-addedevent from injectors; public script listens and re-initializes rendering automatically for dynamically added containers. - Improvement: Stability and UX — defensive re-render guards, explicit
data-renderedattribute for CSS control, and safer visibility checks to avoid rendering inside hidden containers.
- Fix: “Disable Submit Button” now respects “Interaction Only” — submit stays enabled when Turnstile can verify invisibly, and is disabled only if a visible challenge is actually required (unsupported/timeout/error). Applies to Elementor, WordPress Core forms, WooCommerce, Gravity Forms, Formidable, Forminator, Jetpack, Fluent Forms, and Kadence.
- Improvement: Proactive reveal for Interaction Only — if auto-verification doesn’t complete after a short period (~5s), the widget is surfaced and the challenge is triggered so users aren’t left waiting.
- Improvement: Submit-time guards — for regular forms and Elementor AJAX; when no token is present, we halt that submission, reveal the widget, scroll it into view, and start a fresh challenge.
- Improvement: Streamlined inline messaging to align with Cloudflare’s own phrasing; reduced redundant prompts to let Cloudflare’s UI lead the experience.
- Dev: Standardized render locks and defensive pre-render cleanup across remaining integrations to prevent duplicate iframes and race conditions.
- Fix: Interaction Only placeholder stays collapsed (no gap/shadow) after invisible validation; it only expands when UI is truly required (via
unsupported/timeout/errorcallbacks or actual visible challenge). - Fix: Prevent loader overlay, no spinner is injected for Interaction Only while the API loads; collapsed state fully hides any inner spinner and spinners never intercept clicks.
- Fix: Elementor popup - reliably renders Turnstile when popups open after page load (e.g., delayed by timer); if a widget initialized while hidden, it is reset and re-rendered on open.
- Fix: Elementor popup duplicates - de-duplicated popup/form event listeners and centralized rendering to avoid multiple widget instances; idempotent guards ensure one render per container.
- Fix: Prevent duplicate renders on Gravity Forms, Formidable, Forminator, and Jetpack by adding per-element render locks and pre-render cleanup.
- Improvement: Deferred render - widgets now render when their container is visible (Elementor + generic paths), reducing layout thrash and improving perceived load times across dynamic UIs.
- Dev: Simplified collapse logic by removing the previous mutation-based watcher and relying on Turnstile callbacks + visibility checks.
- New: Added "Flexible (100% width)" widget size (Cloudflare Turnstile
data-size="flexible") for fully responsive, container-width layouts. (Thank You: @kammsw) - New: Interaction Only UX refinement – collapses initial blank gap (no more 50+px empty space) until the user interacts or the widget needs to expand. (Thank You: @kammsw)
- Improvement: Unified size handling in JS (
flexiblepasses straight through; existing custom sizes still map to Cloudflare equivalents). - Improvement: Consistent collapsed/expand logic across Elementor, Gravity Forms, Formidable, Forminator, Jetpack, Fluent Forms, Kadence, WPForms, and core render paths.
- Improvement: CSS enhancements for flexible width + reduced gap state (
.kitgenix-ts-collapsed). - Prep: Foundation laid for upcoming modal/delayed form robustness (MutationObserver structure ready for attribute watching & visibility checks in a future release).
- Dev: Sanitization now allows
flexible; admin settings UI updated with help text.
- Improvement: Updated plugin assets (banners, icons, screenshots with clearer cropping/labels).
- Improvement: Updated readme.txt — full integrations list, screenshot captions, Support Development section, improved tags/short description, and clarified WooCommerce Blocks/Store API notes.
- Fix: Expose
window.KitgenixCaptchaForCloudflareTurnstileso Cloudflare onload can reliably callrenderWidgets()(prevents “no widget → no token”). - Fix: Guarded “render once” logic to prevent duplicate widget rendering across core, WooCommerce and form plugins.
- Fix: Contact Form 7 injects once and resets cleanly on CF7 validation/error events.
- Fix: WooCommerce login/checkout placement (Classic & Blocks / Store API), including correct “Place order” positioning.
- Fix: Prevent Turnstile overlapping submit buttons for Gravity Forms and WPForms; adjusted spacing and placement heuristics.
- Fix: Admin: detect duplicate Turnstile API loader and show a dismissible notice on Settings and Plugins screens.
- Fix: “Disable Submit Until Verified” now disables buttons on render and re-enables only after a valid token callback.
- Fix: Token handling — canonical token channel, auto-create hidden
cf-turnstile-responseinput,getLastToken()helper, andkitgenixcaptchaforcloudflareturnstile:token-updatedevent. - Fix: Sanitization & import/export hardening — preserve CIDR & wildcard IP patterns.
- Fix: Guard Elementor script enqueue to avoid PHP warnings in REST/AJAX or early hooks.
- Improvement: More reliable widget injection and cleanup on AJAX/dynamic DOM events; tighter re-render/reset behavior.
- Security: Replay protection enabled by default (TTL filterable via
kitgenix_turnstile_replay_ttl).
- Fix: Position Turnstile above the WooCommerce reviews submit button. Thank You @carlbensy16.
- Fix: Prevent Turnstile from rendering inline with the submit button on Gravity Forms. Thank You @carlbensy16.
- Fix: Add spacing so Turnstile no longer overlaps the WPForms submit button. Thank You @carlbensy16.
- Fix: "Save Settngs" button not working after a few attempts
- Fix: Run Turnstile validation only on POST submissions for core forms (login, register, lost password, reset password, comments). Prevents the “Please complete the Turnstile challenge” message on refresh or wrong password.
- Fix: Added widget render on resetpass_form and proper validation via validate_password_reset; lost password now validates via lostpassword_post.
- Fix: Reintroduced inline centering on wp-login/wp-admin to stabilize layout across all auth screens.
- Fix: Expose the public module globally as window.KitgenixCaptchaForCloudflareTurnstile so the Cloudflare API onload callback can actually call renderWidgets() (prevents “no widget → no token” failures).
- Fix: Guarded “render once” logic so widgets don’t duplicate across hooks (core + WooCommerce + form plugins).
- Fix: Contact Form 7 integrates cleanly (single injection, resets on CF7 error events).
- Fix: WooCommerce login handles both modern woocommerce_process_login_errors and legacy woocommerce_login_errors.
- Fix: Duplicate Turnstile API loader detection with a dismissible admin notice (surfaces on our Settings page and Plugins screen).
- Improvement: When Disable Submit Button is enabled, submit buttons are now disabled immediately on render and re-enabled only after a valid token callback (previously disabled only on error/expired).
- Improvement: Added a canonical token channel. (getLastToken() helper and kitgenixcaptchaforcloudflareturnstile:token-updated event dispatched on each token change.) (Hidden cf-turnstile-response input is auto-created in forms that don’t already have it.)
- Improvement: Token freshness & UX. (Idle timer and token-age timer auto-reset widgets after ~150s (filterable via kitgenix_turnstile_freshness_ms).) (Gentle inline “Expired / Verification error — please verify again.” message displayed next to the widget.)
- Improvement: Add preconnect/dns-prefetch resource hints for https://challenges.cloudflare.com to speed up first paint.
- Improvement: Public CSS greatly reduced in scope (fewer global !importants), small min-height to prevent CLS, better RTL + reduced-motion support, and per-integration spacing.
- Improvement: Admin CSS fully scoped to the settings wrapper, compact modern fields, focus-visible styles, and reduced-motion fallback.
- Improvement: “Test widget” is rendered only via a tight inline onload callback (prevents double-render / undefined globals).
- Improvement: Site Health test (“Cloudflare Turnstile readiness”) reporting keys presence, duplicate loader detection, last verification snapshot, and possible JS delay/defer from optimization plugins (with guidance).
- Improvement: Export / Import JSON for settings (merge/replace). Optional inclusion of Secret Key (explicitly allowed).
- Improvement: Onboarding screen with one-time activation redirect, quick start steps, and helpful links.
- Improvement: Late alignment helpers for consistent widget placement on login/admin.
- Improvement: Housekeeping—centralized render flow, lightweight MutationObserver to catch dynamically added forms, safer class/existence guards.
- Improvement: Ensure hidden input + container are present; don’t inject a container if no site key is available. (Elementor)
- Improvement: Include token in Elementor Pro AJAX payloads; re-render in popups and dynamic forms; reset widget on submit/errors.
- Improvement: Server-side validation hook support (elementor_pro/forms/validation).
- Improvement: Consistent widget + validation across checkout/login/register/lost password. (WooCommerce Classic)
- Improvement: Checkout protected via woocommerce_checkout_process and woocommerce_after_checkout_validation. (WooCommerce Classic)
- Improvement: Inject container next to the “Place order” area via render_block_woocommerce/checkout-actions-block. (WooCommerce Blocks)
- Improvement: Validate Store API POSTs early via REST auth filter; token accepted from X-Turnstile-Token header or extensions. (WooCommerce Blocks)
- Improvement: Reliable widget injection before submit, spinner cleanup, and re-render on each plugin’s AJAX/DOM events.
- Improvement: Server-side validation mapped to each plugin’s native API.
- Improvement: Preserve CIDR and wildcard IP patterns instead of stripping them; sanitize lines while keeping valid patterns.
- New: Added advanced fields - respect_proxy_headers and trusted_proxy_ips (legacy), plus new trust_proxy and trusted_proxies (current).
- New: Developer Mode (warn-only) — Turnstile failures are logged and annotated inline for admins but do not block submissions (great for staging/troubleshooting).
- New: Replay protection — caches recent Turnstile tokens (hashed) for ~10 minutes and rejects re-use. Enabled by default; duration filterable via kitgenix_turnstile_replay_ttl.
- Security: Added Cloudflare/Proxy-aware client IP handling. New Trust Cloudflare/Proxy headers + Trusted Proxy IPs/CIDRs settings. We only honor CF-Connecting-IP / X-Forwarded-For when the request comes from a trusted proxy; otherwise fall back to REMOTE_ADDR.
- Security: Whitelist supports logged-in bypass, IPs with exact/wildcard/CIDR (IPv4/IPv6), and UA wildcards; decision cached per request and filterable via kitgenix_turnstile_is_whitelisted.
- Security: Validator accepts token from POST, X-Turnstile-Token header, or custom filter; memoized siteverify; robust HTTP args; remote IP + URL + timeouts filterable; friendly error mapping; last verify snapshot stored for diagnostics.
- Fix: Center Cloudflare Turnstile on all
wp-login.phpvariants (login, lost password, reset, register) and across wp-admin. - Change: Overhauled includes/core/class-script-handler.php to use the modern Script API (async strategy on WP 6.3+, attribute helpers on 5.7–6.2) and eliminated raw output.
- Dev: Public/admin assets now use filemtime() for cache-busting.
- Dev: Added filter
kitgenix_captcha_for_cloudflare_turnstile_script_urlfor advanced control. - Docs: Expanded readme and updated links.
- New: Initial release
- New: WordPress Login Integration
- New: WordPress Registration Integration
- New: WordPress Lost Password Integration
- New: WordPress Comment Integration
- New: WooCommerce Checkout Integration
- New: WooCommerce Login Integration
- New: WooCommerce Registration Integration
- New: WooCommerce Lost Password Integration
- New: Elementor Forms Integration
- New: WPForms Integration
- New: Kandence Forms Integration
- New: Jetpack Forms Integration
- New: Gravity Forms Integration
- New: Forminator Forms Integration
- New: Formidable Forms Integration
- New: Fluent Forms Integration
- New: Contact Form 7 Integration
- New: Conditional Script Loading for Performance
- New: Widget Size, Theme, and Appearance Options
- New: Defer Scripts and Disable-Submit Logic
- New: Whitelist by IP, User Agent, or Logged-in Users
- New: Custom Error and Fallback Messages
- New: Modern Admin UI with Onboarding Wizard
- New: Optional Plugin Badge
- New: Multisite Support
- New: Works With Elementor Element Cache
- New: GDPR-friendly, No Cookies or Tracking
- New: Optimized for Caching, AJAX, and Dynamic Forms
- New: No Impact on Core Web Vitals
- New: Site Key & Secret Key Management
- New: Per-Form and Per-Integration Enable/Disable
- New: Language Selection for Widget
- New: Customizable Widget Appearance
- New: Server-Side Validation for All Supported Forms
- New: CSRF Protection (Nonce Fields)
- New: Error Handling and User Feedback
- New: Support for AJAX and Dynamic Form Rendering
- New: Admin Notices and Settings Errors
- New: Plugin Translations/Localization