Skip to content

v0.3.0

Choose a tag to compare

View all tags
@oxyc oxyc released this 02 Jun 16:39
· 5 commits to main since this release
v0.3.0
804c9eb

Stronger anti-bot + opt-in spam layers

Builds on the opt-in settings with layered, first-party protection — every layer is opt-in and tuned to never block real users (fuzzy layers mark spam, recoverable, rather than rejecting).

  • Proof-of-work: "Protection strength" preset dropdown (site-wide + per-form), ~20× stronger default; replay protection (each challenge single-use).
  • Rate limiting (default 3/hour/IP, configurable): IP resolved independently of GF and kept only as a salted HMAC in a transient — raw IP never stored.
  • Content heuristics: word-boundary keywords + combined weak signals (link farms, URL in the name field, injected markup, wrong-script text); scans composite name/address fields; ignores zero-width evasion.
  • Email validation (Bouncer, off by default): per-verdict checkboxes (undeliverable/risky/disposable); fails open.
  • Tests: unit + Brain\Monkey mocked suites in CI (PHP 8.2–8.4); real-WP wp-phpunit integration suite for DDEV/wp-env.

See #2.

Assets 3
Loading