=== LukasApps CAPTCHA tools for Contact Form 7 ===
Contributors: 247wd
Tags: contact form 7, captcha, recaptcha, hcaptcha, cloudflare turnstile
Requires at least: 6.2
Tested up to: 7.0.2
Stable tag: 0.1.8
License: GPLv2 or later
License URI: http://www.gnu.org/licenses/gpl-2.0.html

== Description ==

Protect your Contact Form 7 forms with **Google reCAPTCHA V2**, **Google reCAPTCHA V3**, **hCAPTCHA**, or **Cloudflare Turnstile**.

Easy integration and supports multiple forms on a single page.

## Four CAPTCHA Options

Choose the CAPTCHA provider that works best for you:

- **Google reCAPTCHA V2** — Google's classic "I'm not a robot" checkbox.
- **Google reCAPTCHA V3** — Google's invisible, score-based bot verification.
- **hCAPTCHA** — A privacy-first alternative that offers robust bot protection while keeping user data secure.
- **Cloudflare Turnstile** — A modern CAPTCHA that verifies users in the background, only requiring a simple click if the visitor appears suspicious.

## Simple Setup

1. Sign up with your chosen CAPTCHA provider and grab your Site Key and Secret Key.
2. Paste them into **CF7 Captcha** in your WordPress admin.
3. Add protection to any CF7 form in seconds using the shortcode provided in the same settings page.

## Customizable Appearance

Each CAPTCHA widget supports customization options directly from the shortcode:

- **Size** — Choose between normal and compact to fit your form layout.
- **Theme** — Switch between light and dark themes (or auto for Turnstile) to match your site's design.
- **Language** — Force any CAPTCHA to render in a specific language for your audience.

All options are combinable, so you can mix and match to get the exact look you need.

## Submission Insights (NEW in v0.1.7)

Go beyond just blocking spam. Submission Insights gives you full visibility into every form submission:

- **Sender IP** — See the IP address of the person who contacted you.
- **Source Page** — Know exactly which page on your site the form was filled out on.
- **Device & Browser** — Get technical details about the sender's setup.

== Want More? Upgrade to CF7 Captcha Pro ==

This free version gives you solid CAPTCHA protection. **CF7 Captcha Pro** adds six extra layers of spam defense on top of what you already have here, plus a full set of tools to capture and act on every lead your forms collect.

=== What you get with Pro ===

**6-Layer Spam Defense** — additional spam-blocking methods that work quietly in the background:
- **Advanced Honeypot** — invisible trap fields with names that regenerate every 24 hours.
- **Time Limit Validation** — bots submit in 0.2 seconds. Humans take 15–30. This blocks anything that moves too fast (or stays too long).
- **Rate Limiting** — caps submissions per IP so bot networks can't flood your inbox or burn through your email quota.
- **Geographic Blocking** — whitelist only the countries you serve, or blacklist known spam regions.
- **IP Pattern Blocking** — block single IPs, wildcards, CIDR ranges, or entire subnets when you know exactly where an attack is coming from.
- **Word Filter** — scans every submission for spam keywords, phishing URLs, and known scam phrases before it reaches you.

**Lead Recovery** — captures form data in real-time as visitors type, so you don't lose leads from abandoned forms.

**Database Storage & Export** — every submission is saved with full metadata (IP, browser, referrer, timestamp). Export to CSV, Excel, JSON, or PDF whenever you need it. No more lost leads if your email fails.

**Webhooks** — send form data instantly to any URL. Connect to Zapier, Salesforce, Slack, Google Sheets, or any custom API. Multiple webhooks per form, with retry logic built in.

**Mailchimp Integration** — submissions automatically added to your Mailchimp lists. Field mapping, tags, opt-in handling.

**Twilio SMS** — receive instant alerts for every submission or send automated SMS replies to your clients.

**Comprehensive Logging** — every spam block, webhook call, and integration event is logged. Debug any issue in minutes instead of hours.

👉 **[Get CF7 Captcha Pro](https://lukasapps.de/wordpress/plugins/cf7-captcha-pro/)**

== External services ==

This plugin relies on third-party CAPTCHA providers to detect and block spam submissions on your Contact Form 7 forms. Only the service(s) you configure and activate in the plugin settings are contacted.

**Google reCAPTCHA (v2 and v3)**
This plugin loads the Google reCAPTCHA script and sends the CAPTCHA response token to Google's verification API when a protected form is submitted, in order to confirm the submission is not from a bot. The visitor's IP address is also sent as part of this verification.
This service is provided by Google: [Terms of Service](https://policies.google.com/terms), [Privacy Policy](https://policies.google.com/privacy).

**hCaptcha**
This plugin loads the hCaptcha script and sends the CAPTCHA response token to hCaptcha's verification API when a protected form is submitted, in order to confirm the submission is not from a bot.
This service is provided by hCaptcha: [Terms of Service](https://www.hcaptcha.com/terms), [Privacy Policy](https://www.hcaptcha.com/privacy).

**Cloudflare Turnstile**
This plugin loads the Cloudflare Turnstile script and sends the CAPTCHA response token to Cloudflare's verification API when a protected form is submitted, in order to confirm the submission is not from a bot.
This service is provided by Cloudflare: [Terms of Service](https://www.cloudflare.com/website-terms/), [Privacy Policy](https://www.cloudflare.com/privacypolicy/).

These services are only contacted when the corresponding CAPTCHA type is enabled and configured with valid API keys.

== Installation ==

1. Upload the entire contents of the zip file to your plugin directory
2. Activate the plugin through the 'Plugins' menu in WordPress
3. Configure plugin from Admin => CF7 Captcha

== Changelog ==

= 0.1.8 =
* Fix: Updated "Requires at least" version to match plugin headers and readme.
* Fix: Reduced tags list to comply with the 5-tag limit.
* Improvement: Documented third-party services (Google reCAPTCHA, hCaptcha, Cloudflare Turnstile) in the readme.
* Improvement: Revised plugin description to remove unverifiable marketing claims.
* Security: Added proper output escaping to shortcode callbacks to prevent XSS.

= 0.1.7 =
* New: Introduced [cf7sr-insights] tag - easily collect sender's IP, Source Page, and Browser info.
* New: Added support for Google reCAPTCHA v3 Invisible
* Improvement: Security upgrade - Switched CAPTCHA verification to POST method.
* Improvement: Enhanced bot detection by including 'remoteip' in API verification calls.
* Improvement: Performance boost - Optimized form validation to bypass expensive shortcode rendering.
* Improvement: Cleaned up and consolidated language files for a smaller plugin footprint.
* Fix: Modernized script enqueuing system to eliminate conflicts with modern themes/popups.
* Fix: Corrected Hungarian translation and refined admin notice dismissal behavior.
* Fix: Resolved a bug in the admin notice dismissal logic.
