Title: Privacy CAPTCHA for Cap Author: Daniel Sturm Published: 19 birželio, 2026 Last modified: 25 rugsėjo, 2026 --- Ieškoti įskiepiuose ![](https://ps.w.org/privacy-captcha-for-cap/assets/banner-772x250.png?rev=3592811) ![](https://ps.w.org/privacy-captcha-for-cap/assets/icon.svg?rev=3592811) # Privacy CAPTCHA for Cap Autorius [Daniel Sturm](https://profiles.wordpress.org/dsturm/) [Parsisiųsti](https://downloads.wordpress.org/plugin/privacy-captcha-for-cap.1.5.0.zip) * [Informacija](https://lt.wordpress.org/plugins/privacy-captcha-for-cap/#description) * [Atsiliepimai](https://lt.wordpress.org/plugins/privacy-captcha-for-cap/#reviews) * [Diegimas](https://lt.wordpress.org/plugins/privacy-captcha-for-cap/#installation) * [Kūrimas](https://lt.wordpress.org/plugins/privacy-captcha-for-cap/#developers) [Pagalba](https://wordpress.org/support/plugin/privacy-captcha-for-cap/) ## Aprašymas **Privacy CAPTCHA for Cap** integrates [Cap](https://trycap.dev/) — a self-hosted, privacy-friendly, proof-of-work CAPTCHA — into the parts of WordPress that attract the most spam: comments, login, user registration, WooCommerce checkout, and Gravity Forms. Unlike third-party CAPTCHAs (reCAPTCHA, hCaptcha, Turnstile), Cap runs the proof- of-work entirely in the visitor’s browser and verifies the token against your own Cap server. No data leaves your infrastructure. > **Unofficial integration.** Cap is an independent open-source project by tiagozip( > https://trycap.dev/, Apache-2.0). This plugin is a third-party integration and > is **not affiliated with, endorsed by, or sponsored by** the Cap project. „Cap” > refers to that project solely to describe what this plugin works with. #### Features * **First-class Gravity Forms field** — drag a „Privacy CAPTCHA for Cap” into any form from the Advanced Fields group. Per-field display-mode override. * **Contact Form 7** integration — protects every CF7 form automatically. * **WordPress comments, wp-login, registration** integrations — togglable from one settings page. * **WooCommerce** integration — checkout plus the My Account login, registration, and lost-password forms, each its own toggle. Only loads when WooCommerce is active. * **Dashboard widget** — at-a-glance Cap server stats (challenges, verified, failed, hourly chart) right on the WordPress dashboard. * **Granular per-surface toggles** and **developer filters** (`cap_captcha_protect`) to enable/disable protection on any form, even conditionally. * **Three display modes**: inline widget, floating popover, or fully programmatic( auto-solves silently). * **Fully self-hosted assets** — the proof-of-work WebAssembly module, the cap- widget script, and the pako decompression library all ship inside the plugin and are served locally, so no jsdelivr or other third-party CDN is contacted at runtime. DSGVO/GDPR-clean by default. * **WP 6.5+ native script-module API** for proper ES-module loading. * **i18n-ready** with German translations bundled. * **Matches your Gravity Forms design:** in Orbital forms the CAPTCHA takes on the look of the fields around it, including form styles set in the block editor. Everything stays overridable with CSS custom properties. * **Filter hooks** for protection gating, asset URLs, button classes, i18n strings, and the display mode. #### Requirements * WordPress 6.5 or later * PHP 8.3 or later * A reachable Cap server (see https://trycap.dev/) * Gravity Forms 2.5+ (only if you enable the Gravity Forms integration) * WooCommerce (only if you enable the WooCommerce integration) ## Diegimas 1. Upload the `privacy-captcha-for-cap` folder to `/wp-content/plugins/`. 2. Activate the plugin via the _Plugins_ menu in WordPress. 3. Go to **Settings Privacy CAPTCHA for Cap** and enter your Cap endpoint URL, site key, and secret key. 4. Tick the integrations you want to enable. ## DUK ### Is this an official Cap plugin? No. Cap is an independent open-source project by tiagozip (https://trycap.dev/), licensed under Apache-2.0. This plugin is an unofficial third-party integration and is not affiliated with or endorsed by the Cap project. We reference the „Cap” name only to indicate which software this plugin works with. ### Where do I get a Cap endpoint, site key and secret? You provision those in your self-hosted Cap server. See the Cap documentation at https://trycap.dev/. ### Where is the WASM loaded from? By default: from the copies bundled inside this plugin under `wp-content/plugins/ privacy-captcha-for-cap/assets/wasm/`. There are two: `cap_wasm_bg.wasm` for the classic SHA-256 challenge and `hashwx.wasm` for the `hashwx` challenge that newer Cap servers issue by default. You can optionally switch to your own Cap server’s`/ assets/` endpoint under **Settings Privacy CAPTCHA for Cap Privacy**. Either way the files are served from your own infrastructure, and no third-party CDN is contacted. ### Why is a `.wasm` file bundled, and where does it come from? The bundled `assets/wasm/cap_wasm_bg.wasm` and `assets/wasm/hashwx.wasm` are the WebAssembly modules the Cap widget uses to run the proof-of-work challenge in the visitor’s browser. Bundling it locally is the privacy-friendly default: it means no third-party CDN (jsdelivr) is contacted at page load, so visitor IPs are never shared (DSGVO/GDPR-clean). Both are the unmodified upstream files from the `@cap.js/wasm` npm package (Apache- 2.0), part of the open-source Cap project. The plugin does not alter them. Its source and build live in the Cap repository at https://github.com/tiagozip/cap, and the vendoring step is reproducible via `scripts/build-assets.mjs` (`bun run build`), which copies the files verbatim and `bun run build:check` verifies they match upstream. ### Can I store the secret outside the database? Yes. Define `CAP_CAPTCHA_SECRET_KEY` in `wp-config.php` and the plugin will use it instead of the value saved in `wp_options`. ### What is „fail-open” mode? When enabled, the plugin lets submissions through if the Cap server is unreachable. Off by default — only turn it on if temporary outages must not block legitimate users (logins, checkouts). It applies only when Cap genuinely can’t be reached; a CAPTCHA the server actively rejects is always blocked. You can set fail-open ** per form** (e.g. open for logins, closed for contact forms) under the global toggle, and any submission accepted this way is flagged for review (Gravity Forms entries, WooCommerce orders, comments, and new users get a `cap_captcha_fail_open` marker; orders also get a note). ### Does it work with multi-page Gravity Forms and preview steps? Yes. On a multi-page form the CAPTCHA is only required on the page that shows it, or on the final submit. When a form is protected automatically, the field is placed on the **last** page — which on a form built with a preview step (a page break plus`{ all_fields}`) is the preview page, right next to the submit button. If that last page can be hidden by conditional logic, place the CAPTCHA field manually on a page that always renders, or move it with the `cap_captcha_gf_field_page` filter — the plugin will not enforce a CAPTCHA the visitor was never shown. ### Does the bundled `cap-widget` script make any external requests? No third-party CDN requests. All widget assets are bundled and served from this plugin, including the `pako` decompression library (`assets/js/vendor/pako_inflate. min.js`), which older browsers without the native `DecompressionStream` API load locally instead of from jsdelivr. The only network requests the widget makes are to your own Cap endpoint to fetch and verify challenges. ### Can I turn protection on or off per form in code? Yes. Every surface passes through the `cap_captcha_protect` filter — `($enabled, $context)` returning a boolean — before the widget renders and before a submission is verified. For example, to skip the CAPTCHA for logged-in users everywhere: `add_filter(' cap_captcha_protect', fn($on, $ctx) => is_user_logged_in() ? false : $on, 10, 2);`. There is also a per-surface filter, e.g. `cap_captcha_protect_woocommerce_login`. Context ids: gravity_forms, contact_form_7, comments, login, registration, woocommerce_checkout, woocommerce_login, woocommerce_registration, woocommerce_lost_password. ### Can I keep the CAPTCHA off a specific Contact Form 7 or Gravity Forms form? Yes — useful for legally required or accessibility-sensitive forms. For **Contact Form 7**, set the mode to _Manual_ (Settings Form placement) and add the `[cap_captcha]` tag only to the forms you want protected; or, in _Automatic_ mode, add `cap_captcha: off` to a form’s Additional Settings to skip just that one. For **Gravity Forms**, each form has a _Privacy CAPTCHA_ setting (Default / Always / Never) so you can exclude individual forms even when „protect all” is on. ### Can I change how the CAPTCHA looks? In Gravity Forms forms using the Orbital theme it already follows the look of your fields. Anywhere else, or to change a detail, set the widget’s CSS custom properties(`-- cap-background`, `--cap-border-color`, `--cap-border-radius`, `--cap-focus-ring` and others) on `cap-widget` or on the form. In Gravity Forms, set them on the form or the widget rather than on `:root`. ### Are there developer hooks / filters? Yes. The main ones: * `cap_captcha_protect` — master gate for every surface: `($enabled, $context)` returning a boolean. Runs before the widget renders and before a submission is verified. * `cap_captcha_protect_{context}` — per-surface gate, e.g. `cap_captcha_protect_woocommerce_login`. * `cap_captcha_fail_open` — `($open, $context)` the resolved fail-open decision for a surface; plus a `cap_captcha_fail_open_pass` action when a submission is accepted via fail-open. * `cap_captcha_require_token` — `($required, $context)` return `false` to let a surface through when no token was submitted at all. Fail-open does **not** cover this case: it applies only to an unreachable Cap server. * `cap_captcha_gf_field_page` — `($page, $form)` which page the auto-injected Gravity Forms field is placed on (defaults to the last page). * `cap_captcha_gf_verified_ttl` — `($seconds)` how long a solved challenge stays valid across the pages of one multi-page Gravity Forms submission (default one hour); plus a `cap_captcha_gf_skipped_hidden($formId, $fieldId)` action when conditional logic hid the field and enforcement was skipped. * `cap_captcha_widget_src`, `cap_captcha_floating_src`, `cap_captcha_programmatic_src`,` cap_captcha_style_src` — override the script/style URLs (return `''` for the style to disable bundled CSS). * `cap_captcha_wasm_url`, `cap_captcha_hashwx_url`, `cap_captcha_pako_url`: override the WASM / pako URLs (default to the bundled copies). * `cap_captcha_i18n` — override the widget’s `data-cap-i18n-*` strings. * `cap_captcha_floating_button_classes`, `cap_captcha_floating_position`, `cap_captcha_floating_autosubmit_src`— floating-mode tweaks. * `cap_captcha_display_mode` — override the resolved display mode for a specific Gravity Forms field. The full, annotated list with examples is in README.md. ## Atsiliepimai Įskiepis neturi atsiliepimų. ## Programuotojai ir komandos nariai “Privacy CAPTCHA for Cap” yra atviro kodo programa. Prie jos sukūrimo prisidėję žmonės surašyti toliau. Autoriai * [ Daniel Sturm ](https://profiles.wordpress.org/dsturm/) * [ dsturm ](https://profiles.wordpress.org/dsturm-1/) [Išverskite “Privacy CAPTCHA for Cap” į savo kalbą.](https://translate.wordpress.org/projects/wp-plugins/privacy-captcha-for-cap) ### Domina programavimas? [Peržiūrėkite kodą](https://plugins.trac.wordpress.org/browser/privacy-captcha-for-cap/), naršykite [SVN repozitorijoje](https://plugins.svn.wordpress.org/privacy-captcha-for-cap/), arba užsiprenumeruokite [kodo pakeitimų žurnalą](https://plugins.trac.wordpress.org/log/privacy-captcha-for-cap/) per [RSS](https://plugins.trac.wordpress.org/log/privacy-captcha-for-cap/?limit=100&mode=stop_on_copy&format=rss). ## Pakeitimų istorija #### 1.5.0 * Improved: in Gravity Forms forms using the Orbital theme, the CAPTCHA now matches the fields around it (font, colours, border, corners, height), including form styles set in the block editor. * Added: French translation. #### 1.4.0 * Fixed: the CAPTCHA failed with „unsupported format-2 protocol ‘hashwx’” on site keys created with Cap 3.1 or newer, which use the new hashwx challenge by default. Those keys work now, and older keys keep working as before. * Improved: the solver for the new challenge ships inside the plugin like the existing one, so still no third-party CDN is contacted. #### 1.3.2 * Improved: tested and confirmed compatible with WordPress 7.1. #### 1.3.1 * Fixed: a fatal error that took the site down when the plugin ran alongside Gravity Forms 3.0 or newer. If you use Gravity Forms 3.x, please update. #### 1.3.0 * Fixed: multi-page Gravity Forms — including forms with a preview step — now work correctly. Previously the CAPTCHA could not be completed on the final page: depending on your fail-open setting the form was either impossible to send, or could be sent without solving the CAPTCHA at all. * Fixed: fail-open mode no longer lets a submission through when no CAPTCHA was solved at all. It now only applies when the Cap server is genuinely unreachable, as described in the settings. **If you had fail-open enabled, your forms were effectively unprotected — please re-test your forms after updating.** * Improved: when a Gravity Forms submission fails the CAPTCHA, visitors are taken back to the page that actually shows it. * Improved: logins and comments made through the REST API, XML-RPC or WP-CLI are no longer blocked by the CAPTCHA — they never show one. * Fixed: missing spacing between the CAPTCHA and the button below it on the WordPress login form. #### 1.2.5 * Fixed: temporarily deactivating Gravity Forms, Contact Form 7 or WooCommerce and then saving the settings page silently switched that integration off, so protection stayed disabled after reactivating the plugin. Those settings are now preserved. * Fixed: on sites without Gravity Forms, the Gravity Forms integration appeared ticked on a fresh install. #### 1.2.4 * Fixed: the plugin only worked when Gravity Forms was active. Without it, the „ Settings Privacy CAPTCHA for Cap” page never appeared and the comments, login, registration and WooCommerce protection never ran. Gravity Forms and Contact Form 7 are optional again, as documented — each integration is skipped only if its own plugin is missing. * Improved: the plugin now runs from any copy of its source, so downloading it from GitHub works as well as installing from WordPress.org. Installable builds are attached to each GitHub release from now on. * Improved: smaller download — the plugin no longer ships a Composer autoloader it never needed. #### 1.2.2 * Fixed: with an integration enabled but the plugin not yet configured (missing endpoint, site key, or secret), logins and other forms could be blocked with a „CAPTCHA verification failed” error. An unconfigured plugin now never blocks submissions — protection simply stays off (and admins still see the „not configured” notice) until the Cap settings are filled in. #### 1.2.1 * Fixed: creating an account during WooCommerce checkout no longer shows a „CAPTCHA verification failed” error when the CAPTCHA is only enabled for the My Account forms (the widget isn’t rendered on checkout). The My Account registration form is still protected as before. #### 1.2.0 * Added: per-form fail-open — let logins through during a Cap outage while still requiring a valid proof on contact forms (or any mix). Set it per surface, or keep the global default. * Added: submissions accepted during a Cap outage are now flagged for review (Gravity Forms entries, WooCommerce orders, comments, and new users get a „fail-open” marker; orders also get a note). * Improved: a CAPTCHA that the Cap server actively rejects is always blocked — fail-open only applies when Cap genuinely can’t be reached. #### 1.1.0 * Added: Contact Form 7 integration with placement control — automatic on all forms, or manual via the [cap_captcha] tag (so you can keep the CAPTCHA off legally required or accessibility-sensitive forms). * Added: Gravity Forms automatic protection — global „protect all” plus a per-form Default / Always / Never override, alongside the existing field. * Added: WooCommerce My Account login, registration, and lost-password forms (each its own toggle, alongside checkout). * Added: dashboard widget showing your Cap server stats at a glance. * Added: granular per-surface toggles and a `cap_captcha_protect` developer filter to control protection on any form, even conditionally. * Fixed: the Login integration no longer interferes with WooCommerce My Account logins. #### 1.0.0 * Initial release. * Gravity Forms field (inline / floating / programmatic display). * Comments, login, registration, WooCommerce integrations. * Fully self-hosted assets — WASM module, cap-widget script, and pako library all bundled and served locally; no third-party CDN is contacted at runtime. DSGVO- clean by default. * WP 6.5 native script-module loading. * Top-level Settings Privacy CAPTCHA for Cap page with integration toggles, WASM source choice (this plugin or your own Cap server), fail-open switch. * German translations. ## Metainformacija * Version **1.5.0** * Atnaujinta **prieš 2 d.** * Aktyvių instaliacijų **60+** * WordPress versija ** 6.5 ar naujesnė ** * Ištestuota iki **7.1.2** * PHP versija ** 8.3 ar naujesnė ** * Kalba * [English (US)](https://wordpress.org/plugins/privacy-captcha-for-cap/) * Žymos * [captcha](https://lt.wordpress.org/plugins/tags/captcha/)[comments](https://lt.wordpress.org/plugins/tags/comments/) [Proof of Work](https://lt.wordpress.org/plugins/tags/proof-of-work/)[spam](https://lt.wordpress.org/plugins/tags/spam/) [woocommerce](https://lt.wordpress.org/plugins/tags/woocommerce/) * [Daugiau](https://lt.wordpress.org/plugins/privacy-captcha-for-cap/advanced/) ## Įvertinimai No reviews have been submitted yet. [Your review](https://wordpress.org/support/plugin/privacy-captcha-for-cap/reviews/#new-post) [See all reviews](https://wordpress.org/support/plugin/privacy-captcha-for-cap/reviews/) ## Autoriai * [ Daniel Sturm ](https://profiles.wordpress.org/dsturm/) * [ dsturm ](https://profiles.wordpress.org/dsturm-1/) ## Pagalba Turite pastabų? Reikia pagalbos? [Peržiūrėti pagalbos forumą](https://wordpress.org/support/plugin/privacy-captcha-for-cap/)