SiteGuarding Math Captcha
| 开发者 | sgplugins |
|---|---|
| 更新时间 | 2026年10月12日 21:29 |
| PHP版本: | 7.4 及以上 |
| WordPress版本: | 7.1 |
| 版权: | GPLv2 or later |
| 版权网址: | 版权信息 |
详情介绍:
- WordPress login, registration (including multisite sign-up), lost password and comment forms
- WooCommerce: login, registration, lost password, checkout (classic checkout and the checkout block), product reviews and the order tracking form
- Contact Form 7, WPForms (Lite and Pro), Formidable Forms, Ninja Forms, Fluent Forms and Forminator: the captcha is added before the submit button of every form automatically (Fluent Forms conversational forms are not covered)
- bbPress new topics and replies
- Your own forms: add the [sgmathcp_captcha] shortcode and check the answer with sgmathcp_verify(), or list pages under "Protected pages" and every form posted to them is checked for you
- Addition, subtraction, multiplication and division with numbers from 1 to 99
- Numbers as digits, as words in the language of your site, or mixed
- Your own title above the example and your own time limit
- Hidden for logged-in users if you wish (login, registration and lost password forms always ask)
- A hidden trap field that only bots fill in
- Works with page caching: a fresh example is loaded when a visitor starts filling a cached form
- Every example can be used only once, so a solved captcha cannot be replayed
- Never show the captcha to trusted IP addresses or countries
- Block IP addresses, ranges (CIDR, wildcards, from-to) and countries, IPv4 and IPv6
- Lock an IP address for a while after too many wrong answers (an IPv6 address is locked with its /64 network)
- Block rules apply to logged-in users too
- Country detection from a free public domain database or from the Cloudflare country header
- The visitor address is taken from the connection; proxy headers are trusted only from Cloudflare or from proxies you list, so bots cannot fake their address
- Failed checks by hour or by day, from today to the last 12 months
- Top countries, top IP addresses with a one-click block, and failures by form and reason
- Optional counter of today's failed checks in the admin bar (off by default)
- Limited retention of IP addresses and an option to store them shortened
安装:
- Install the plugin from the Plugins screen, or upload the plugin folder to /wp-content/plugins/.
- Activate it.
- Open Settings > Math Captcha and choose the forms to protect. Login, registration, lost password and comment forms are on by default.
屏幕截图:
常见问题:
Does it work with page caching?
Yes. Every example works once and expires after the time you set. For forms that are often cached (comments, contact forms) the plugin loads a fresh example as soon as the visitor starts filling the form, and after every AJAX submission.
Can I place the captcha myself in Contact Form 7?
Yes. Add the [sgmathcp your-captcha] tag where you want it. Forms without the tag get the captcha automatically before the submit button. The messages can be changed on the form's Messages tab.
How do I protect my own form?
Put [sgmathcp_captcha] inside the form. If the form sends its data to the same page, add that page to "Protected pages" on the Forms tab and you are done. Otherwise check the answer in your form handler:
$check = sgmathcp_verify(); if ( is_wp_error( $check ) ) { // Show $check->get_error_message() and stop. }
What happens with express payment buttons on the WooCommerce checkout?
Express payment buttons such as Apple Pay and Google Pay send the order without the captcha answer, so the checkout captcha refuses those orders. Go to Settings > Math Captcha > Forms and select their payment methods under "Payment methods without captcha". Orders paid with these methods are placed without the question, and the question is hidden while such a method is selected on the checkout. Bots can choose these methods too, so select only methods where the customer confirms the payment in a wallet. Some payment plugins use one method for cards and express buttons (for example Stripe or WooPayments): selecting it also removes the captcha from card payments. Orders that need no payment always need the answer, and IP and country blocks and the limit of wrong answers still apply. Developers can decide per order with the sgmathcp_wc_checkout_skip filter.
My site is behind Cloudflare or a proxy. Which IP address is used?
By default the connection address. When the request comes from a Cloudflare address, the Cloudflare visitor header is used. For your own proxy or load balancer, choose "Behind my own proxy" on the IP & GEO tab and list the proxy addresses.
I blocked my own IP address or country. How do I get back in?
The plugin warns you before this happens and the Block button refuses your own address. If you are locked out anyway, rename the folder wp-content/plugins/siteguarding-math-captcha with FTP or your hosting file manager, log in, rename it back and fix the rules.
I used WP Advanced Math Captcha. Can I keep my settings?
Yes. The Advanced tab offers to import its settings, and Contact Form 7 forms with the old [mathcaptcha] tag keep working once that plugin is deactivated.
Is a math captcha enough against every bot?
No captcha stops everything. A math captcha stops the automated spam most sites receive. For stronger protection combine it with the attempt limit and the IP and country rules.
更新日志:
- New: WooCommerce payment methods without captcha, for express payment buttons such as Apple Pay and Google Pay. The checkout question is hidden while such a method is selected.
- First release.