TrueSift

TrueSift connects WordPress forms to the TrueSift verification service. It starts an automated browser challenge when a protected form is displayed, keeps the form submit action unavailable until an authoritative verification token is issued, and validates and atomically consumes that single-use token on the WordPress server before the protected action continues. The plugin does not implement a separate CAPTCHA protocol. Its browser runtime tracks the public @truesift/next 0.3.0 client contract, and its PHP bridge uses the official TrueSift challenge, verify, and business-proof API contracts. Included integrations

• WordPress login
• WordPress registration
• WordPress password reset request
• WordPress comments
• WooCommerce customer login
• WooCommerce customer registration
• WooCommerce checkout (classic and Checkout Block)
• WooCommerce product reviews
• Contact Form 7
• WPForms
• Fluent Forms
• Elementor Pro Forms
• Manual shortcode and PHP helper integration

The WooCommerce checkout integration supports both the classic shortcode checkout and the Checkout Block. Checkout Block proofs are carried through Store API extension data and validated before checkout processing. Security model The browser sends only an opaque verificationToken as security proof. Client-provided values such as allowed, decision, score, status, failOpen, challengeId, action, path, and origin are never trusted by the protected PHP action. The plugin sends the token together with a signed WordPress form context to the server. The PHP verifier calls TrueSift's proof endpoint with server-owned credentials and expected action, path, and origin. A normal success is accepted only when TrueSift confirms allowed: true, decision: allow, and atomic consumption through either consumed: true or a non-empty consumedAt timestamp. Replayed, expired, invalid, mismatched, reviewed, or blocked proofs are rejected. The bundled SDK 0.3.0 adapter may send only aggregate in-memory interaction counters for the current verification window, such as pointer, keyboard, focus, and blur counts. It does not send pointer coordinates, pressed keys, form contents, device fingerprints, or persistent visitor identifiers. Missing or insufficient behavioral telemetry remains neutral. Visual modes The admin page shows live, non-networked previews of all official layouts:

• Checkbox
• Banner
• Inline
• Badge

Theme, language, size, and appearance can be configured globally. Manual integration Place the shortcode inside a form: [truesift] When used outside a form, the same shortcode renders a standalone visual verification status. Standalone mode does not protect a business action until it is associated with a form and server-side verification. For a form located elsewhere in the DOM: [truesift form_selector="#contact-form" button_selector="button[type=submit]"] A custom PHP handler must also validate the proof before performing its protected action: $proof = truesift_verify_request(); Continue only when the returned value is not a WP_Error and its allowed value is true.

1. Upload the truesift folder to /wp-content/plugins/, or install the ZIP through Plugins > Add New > Upload Plugin.
2. Activate TrueSift.
3. Open Settings > TrueSift.
4. Enter the site key and secret key issued for the site in TrueSift.
5. Save the connection settings, then run the connection test.
6. Choose the visual mode and enable the desired integrations.

Credentials may also be defined in wp-config.php: define( 'TRUESIFT_SITE_KEY', 'bg_site_...' ); define( 'TRUESIFT_SECRET_KEY', '...' ); Optional server constants: TRUESIFT_API_BASE_URL, TRUESIFT_DEFAULT_ACTION, TRUESIFT_FAIL_OPEN, and TRUESIFT_TIMEOUT_MS.

1.0.18

• Fixed a WooCommerce Checkout Blocks conflict where account creation during Store API checkout could trigger a second registration verification and incorrectly return truesift_verification_required.
• Keeps WooCommerce My Account registration protected by woo_register while excluding account creation performed inside an already protected Store API checkout.
• Preserves the dedicated Checkout Block proof lifecycle and prevents the same checkout operation from requiring or consuming a second proof through woocommerce_registration_errors.
• Keeps the official SDK at @truesift/next@0.3.0 and advances the WordPress SDK asset revision to 1.0.18-0.3.0. Older release history is included in CHANGELOG.md in the plugin package.