=== LukaCodes Comment Shield === Contributors: Luka2013 Tags: comments, spam, recaptcha, anti-spam, comment protection Requires at least: 6.0 Tested up to: 6.9 Requires PHP: 8.0 Stable tag: 0.3 License: GPLv2 or later License URI: https://www.gnu.org/licenses/gpl-2.0.html Lightweight comment spam protection: remove the website field, strip links, and block bots silently with invisible reCAPTCHA v3. == Description == **LukaCodes Comment Shield** is a lightweight, no-bloat plugin that gives you three independent tools to protect your WordPress comment section from spam: * **Disable Website Field** — Removes the URL/website field from the comment form. Works with all themes, including those that hardcode the field (CSS fallback included). * **Strip Links from Comments** — Automatically removes all `` hyperlinks from comment content — both on display and before saving to the database. Spammers get zero benefit from posting links. * **reCAPTCHA v3** — Adds Google's invisible bot-score protection to your comment form. No checkbox, no puzzle, no friction for real users. Bots are silently blocked server-side. All three features are **independent** — enable only what you need. = Why Comment Shield? = Most anti-spam plugins are heavy, require accounts, or add ugly CAPTCHAs. LukaCodes Comment Shield is different: * ~25 KB total — no external libraries, no jQuery dependency * Settings page with **live key testing** — verify your reCAPTCHA keys before enabling * **Link stripping preview** — paste any comment text and see exactly what gets removed * Graceful fallback: if Google's API is unreachable, comments are held for moderation (never lost) * Trusted users (administrators) bypass reCAPTCHA automatically * WP Coding Standards compliant — fully escaped output, nonce-protected AJAX = reCAPTCHA v3 — How it works = When a visitor submits a comment, our JavaScript silently requests a score token from Google. The token is sent with the comment and verified server-side against your minimum score threshold (configurable from 0.1 to 1.0). No user interaction required. == Installation == 1. Upload the `comment-shield` folder to `/wp-content/plugins/` 2. Activate the plugin through **Plugins → Installed Plugins** 3. Go to **Settings → Disable Website** to configure your options = reCAPTCHA v3 Setup = 1. Visit [Google reCAPTCHA Admin Console](https://www.google.com/recaptcha/admin/create) 2. Create a new site — select **Score based (v3)** 3. Add your domain to the allowed domains list 4. Copy the **Site Key** and **Secret Key** into the plugin settings 5. Use the built-in **🔍 Test Keys** button to verify connectivity before enabling 6. Enable reCAPTCHA v3, set your minimum score, and save == Frequently Asked Questions == = Does this require a Google account? = Yes. You need a Google account to obtain Site and Secret keys from the [reCAPTCHA Admin Console](https://www.google.com/recaptcha/admin/create). The service is free. = Will reCAPTCHA slow down my comment form? = No. Google's script loads asynchronously and the score token is fetched only when the user clicks Submit. Regular page load is unaffected. = What happens if Google's API is unreachable? = The comment is held for moderation instead of being rejected. You will never lose a genuine comment due to a Google outage. = Does the link stripping affect how comments look to the commenter? = Commenters who include links will see their text displayed without the hyperlinks — the words remain, just not clickable. The same stripped version is saved to the database. = Does this work with caching plugins? = Yes. All reCAPTCHA logic runs client-side (JS) and server-side (PHP on comment submission). Caching does not interfere. = Do I need all three features? = No. Each feature has its own toggle. Enable only what your site needs. = Does it work with custom themes that hardcode the URL field? = Yes. The plugin removes the field from WordPress's form array and also injects CSS as a fallback for themes that output the field directly. = Is a `/languages` folder required? = The plugin is translation-ready. An empty `/languages` folder is included for compatibility. Once listed on WordPress.org, the community can contribute translations via GlotPress — no manual `.po` files needed from you. == Screenshots == 1. The main settings dashboard — left column with all options. 2. reCAPTCHA key tester — real-time verification against Google API. 3. Link stripping preview — before/after diff of comment text. 4. Plugin status panel — at-a-glance view of current configuration. == Changelog == = 0.3 = * Added server-side reCAPTCHA verification with action and hostname validation * Added fallback: holds comment for moderation if Google API is unreachable * Added `DWLC_VERSION` constant and activation hook to seed default options * Added `License URI` to plugin header for WordPress.org compliance * Improved score threshold: configurable from 0.1 to 1.0 with live slider * Improved regex for link stripping (possessive quantifier for better performance) = 0.2 = * Integrated Google reCAPTCHA v3 invisible protection on comment form * Added real-time key testing — verify Site Key and Secret Key against Google API without saving * Added domain connectivity check during key test * Fixed race condition: reCAPTCHA script now loads correctly before token execution * Fixed double-submission bug on slow connections * Added iOS-style toggle switches in settings UI * Added live link stripping preview with before/after diff = 0.1 = * Initial release * Remove website field from comment form (filter + CSS fallback) * Strip HTML links from comments on display and before saving to database == Upgrade Notice == = 0.3 = Adds hostname validation and graceful fallback for Google API outages. Recommended update for all users. == Third-Party Services == This plugin optionally uses **Google reCAPTCHA v3**, a third-party service provided by Google LLC. * **What it does:** Detects bots and spam on your comment form without user interaction. * **When data is sent:** Only when reCAPTCHA v3 is enabled in settings. A token is sent to Google's API (`https://www.google.com/recaptcha/api/siteverify`) when a visitor submits a comment. * **What data is sent:** The visitor's IP address and a reCAPTCHA token. * **Google Privacy Policy:** https://policies.google.com/privacy * **Google Terms of Service:** https://policies.google.com/terms This service is entirely optional. If you do not enter API keys or enable reCAPTCHA, no data is sent to Google.