=== LukaCodes Comment Shield === Contributors: Luka2013 Tags: anti-spam, comment spam, spam protection, recaptcha, turnstile Requires at least: 6.0 Tested up to: 6.9 Requires PHP: 8.0 Donate link: https://www.paypal.com/donate/?hosted_button_id=942LJ42XE4HVW Stable tag: 1.0.1 License: GPLv2 or later License URI: https://www.gnu.org/licenses/gpl-2.0.html Lightweight comment spam protection: remove the website field, strip links, and block bots with invisible reCAPTCHA v3 or Cloudflare Turnstile. == Description == **LukaCodes Comment Shield** is a lightweight, no-bloat plugin that gives you four independent tools to protect your WordPress comment section from spam: * **Disable Website Field** — Removes the URL/website field from the comment form. Works with all themes, including those that hardcode the field (CSS fallback included). * **Strip Links from Comments** — Automatically removes all `` hyperlinks from comment content — both on display and before saving to the database. Spammers get zero benefit from posting links. * **reCAPTCHA v3** — Adds Google's invisible bot-score protection to your comment form. No checkbox, no puzzle, no friction for real users. Bots are silently blocked server-side. * **Cloudflare Turnstile** — A privacy-friendly CAPTCHA alternative that shows a visible widget on the comment form. Verified server-side against Cloudflare's API. Mutually exclusive with reCAPTCHA v3 — enabling one automatically disables the other. All features are **independent** — enable only what you need. = Why Comment Shield? = Most anti-spam plugins are heavy, require accounts, or add ugly CAPTCHAs. LukaCodes Comment Shield is different: * ~25 KB total — no external libraries, no jQuery dependency * Settings page with **live key testing** — verify your reCAPTCHA or Turnstile keys before enabling * **Link stripping preview** — paste any comment text and see exactly what gets removed * Graceful fallback: if Google's or Cloudflare's API is unreachable, comments are held for moderation (never lost) * Trusted users (administrators) bypass CAPTCHA checks automatically * **Mutual exclusion**: reCAPTCHA v3 and Cloudflare Turnstile cannot be active at the same time — switching one on turns the other off automatically, both in the UI and on the server * WP Coding Standards compliant — fully escaped output, nonce-protected AJAX = reCAPTCHA v3 — How it works = When a visitor submits a comment, our JavaScript silently requests a score token from Google. The token is sent with the comment and verified server-side against your minimum score threshold (configurable from 0.1 to 1.0). No user interaction required. = Cloudflare Turnstile — How it works = A Turnstile widget is rendered inside the comment form. When the visitor completes the challenge, a token is generated and submitted with the comment. The token is verified server-side against the Cloudflare API before the comment is accepted. == Installation == 1. Upload the `lukacodes-comment-shield` folder to `/wp-content/plugins/` 2. Activate the plugin through **Plugins → Installed Plugins** 3. Go to **Settings → Comment Shield** to configure your options = reCAPTCHA v3 Setup = 1. Visit [Google reCAPTCHA Admin Console](https://www.google.com/recaptcha/admin/create) 2. Create a new site — select **Score based (v3)** 3. Add your domain to the allowed domains list 4. Copy the **Site Key** and **Secret Key** into the plugin settings 5. Use the built-in **🔍 Test Keys** button to verify connectivity before enabling 6. Enable reCAPTCHA v3, set your minimum score, and save = Cloudflare Turnstile Setup = 1. Visit [Cloudflare Turnstile Dashboard](https://dash.cloudflare.com/?to=/:account/turnstile) 2. Create a new site and select your widget type (Managed recommended) 3. Copy the **Site Key** and **Secret Key** into the plugin settings 4. Use the built-in **🔍 Test Turnstile Keys** button to verify connectivity before enabling 5. Enable Cloudflare Turnstile and save — reCAPTCHA v3 will be disabled automatically == Frequently Asked Questions == = Does this require a Google account? = Only if you use reCAPTCHA v3. You need a Google account to obtain keys from the [reCAPTCHA Admin Console](https://www.google.com/recaptcha/admin/create). The service is free. Cloudflare Turnstile requires a free Cloudflare account instead. = Can I use both reCAPTCHA and Turnstile at the same time? = No — they are mutually exclusive. Enabling one will automatically disable the other, both in the settings UI and on the server. This prevents conflicts and double verification. = Will reCAPTCHA slow down my comment form? = No. Google's script loads asynchronously and the score token is fetched only when the user clicks Submit. Regular page load is unaffected. = What happens if Google's or Cloudflare's API is unreachable? = The comment is held for moderation instead of being rejected. You will never lose a genuine comment due to an API outage. = Does the link stripping affect how comments look to the commenter? = Commenters who include links will see their text displayed without the hyperlinks — the words remain, just not clickable. The same stripped version is saved to the database. = Does this work with caching plugins? = Yes. All CAPTCHA logic runs client-side (JS) and server-side (PHP on comment submission). Caching does not interfere. = Do I need all features? = No. Each feature has its own toggle. Enable only what your site needs. = Does it work with custom themes that hardcode the URL field? = Yes. The plugin removes the field from WordPress's form array and also injects CSS as a fallback for themes that output the field directly. = Is a `/languages` folder required? = The plugin is translation-ready. An empty `/languages` folder is included for compatibility. Once listed on WordPress.org, the community can contribute translations via GlotPress — no manual `.po` files needed from you. == Screenshots == 1. The main settings dashboard — left column with all options including Cloudflare Turnstile. 2. reCAPTCHA key tester — real-time verification against Google API. 3. Turnstile key tester — real-time verification against Cloudflare API. 4. Link stripping preview — before/after diff of comment text. 5. Plugin status panel — at-a-glance view of current configuration. == Changelog == = 1.0.1 = * Added Cloudflare Turnstile as a second CAPTCHA option (privacy-friendly alternative to reCAPTCHA) * Added mutual exclusion logic: enabling reCAPTCHA disables Turnstile and vice versa, both client-side (JS toggle) and server-side (sanitizer + DB update) * Added server-side Turnstile token verification against Cloudflare API with moderation fallback * Added live Turnstile key tester in the settings panel * Added Turnstile status row in the Plugin Status panel * Updated plugin header description and admin UI subtitle * Updated uninstall.php to clean up Turnstile options on deletion * Bumped version to 1.0.1 = 0.3 = * Added server-side reCAPTCHA verification with action and hostname validation * Added fallback: holds comment for moderation if Google API is unreachable * Added `COMMSH_VERSION` constant and activation hook to seed default options * Added `License URI` to plugin header for WordPress.org compliance * Improved score threshold: configurable from 0.1 to 1.0 with live slider * Improved regex for link stripping (possessive quantifier for better performance) = 0.2 = * Integrated Google reCAPTCHA v3 invisible protection on comment form * Added real-time key testing — verify Site Key and Secret Key against Google API without saving * Added domain connectivity check during key test * Fixed race condition: reCAPTCHA script now loads correctly before token execution * Fixed double-submission bug on slow connections * Added iOS-style toggle switches in settings UI * Added live link stripping preview with before/after diff = 0.1 = * Initial release * Remove website field from comment form (filter + CSS fallback) * Strip HTML links from comments on display and before saving to database == Upgrade Notice == = 1.0.1 = Adds Cloudflare Turnstile as a privacy-friendly CAPTCHA alternative with full mutual exclusion from reCAPTCHA v3. Recommended update for all users. == Third-Party Services == This plugin optionally uses the following third-party services: = Google reCAPTCHA v3 = A service provided by Google LLC. * **What it does:** Detects bots and spam on your comment form without user interaction. * **When data is sent:** Only when reCAPTCHA v3 is enabled in settings. A token is sent to Google's API (`https://www.google.com/recaptcha/api/siteverify`) when a visitor submits a comment. * **What data is sent:** The visitor's IP address and a reCAPTCHA token. * **Google Privacy Policy:** https://policies.google.com/privacy * **Google Terms of Service:** https://policies.google.com/terms = Cloudflare Turnstile = A service provided by Cloudflare, Inc. * **What it does:** Presents a privacy-friendly CAPTCHA widget on the comment form and verifies the response server-side. * **When data is sent:** Only when Cloudflare Turnstile is enabled in settings. A token is sent to Cloudflare's API (`https://challenges.cloudflare.com/turnstile/v0/siteverify`) when a visitor submits a comment. * **What data is sent:** The visitor's IP address and a Turnstile token. * **Cloudflare Privacy Policy:** https://www.cloudflare.com/privacypolicy/ * **Cloudflare Terms of Service:** https://www.cloudflare.com/website-terms/ Both services are entirely optional. If you do not enter API keys or enable either CAPTCHA, no data is sent to any third party.