manifest / security / passive-captcha-gravity-forms

Passive CAPTCHA for Gravity Forms

** In development ** Advanced passive CAPTCHA for Gravity Forms. Blocks bots without user interaction using timing, JS execution, fingerprinting (WebGL/JA3), nonce, session, IP/UA checks, rate limiting & IP lists. Features configurable webhooks. Multisite ready. Just add a hidden "CAPTCHA Token" field to your Gravity Forms.

by Rich Hamilton · github.com/rhamenator/passive-captcha-gravity-forms

★ 0stars

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/rhamenator/passive-captcha-gravity-forms/archive/refs/heads/main.zip

No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.

Readme github.com/rhamenator/passive-captcha-gravity-forms ↗

A lightweight, passive CAPTCHA solution for Gravity Forms that transparently protects your forms against bots by analyzing user interactions and environmental characteristics.

Features

Passive Bot Detection – No visible challenges; uses timing, interaction, WebGL fingerprinting, and invisible math to distinguish humans from bots.
JA3 Integration – Optionally leverage server‑side JA3 TLS fingerprints via nginx or other proxies.
Flexible Thresholds – Configure rate limits, ban durations, session lifetimes, and minimum interaction times.
Customizable Checks – Enable or disable WebGL fingerprinting and invisible math challenges for privacy compliance.
Webhook Alerts – Receive JSON‑formatted POST notifications on validation failures or post‑ban submissions.
IP Management – Whitelist and blacklist specific IPs; specify custom IP headers (e.g., HTTP_CF_CONNECTING_IP).
Detailed Logging – Records all validation events to a dedicated log file with fallback to DB logging if file access is restricted.
Settings UI – Full-featured admin page under Settings → Passive CAPTCHA.
Easy Integration – Automatically enqueues ES‑module bundles (index.js + feature modules) and injects necessary hidden fields.
Graceful Fallbacks – Warns admins if footer.php is missing or scripts fail to load; attempts alternative injection points.

Installation

Upload the passive-captcha-gravity-forms folder to your /wp-content/plugins/ directory.
Activate Passive CAPTCHA from the Plugins menu in WordPress.
Under Settings → Passive CAPTCHA, configure your preferred options and save.
Edit your Gravity Form, add a Hidden field, and set the Field Label to CAPTCHA Token.

Note: The plugin attempts to inject its script after the theme’s wp_footer(); ensure your theme includes footer.php and calls wp_footer().

Folder Structure

passive-captcha-gravity-forms/
├── js/
│ ├── index.js
│ ├── debug-logger.js
│ ├── fingerprint.js
│ ├── ja3Integration.js
│ ├── logger.js
│ ├── mathChallenge.js
│ ├── session.js
│ └── token-handler.js
├── includes/
│ └── settings-page.php
├── dev-only/
│ ├── Dockerfile.node
│ ├── Dockerfile.phpunit
│ ├── docker-compose.yml
│ ├── lint.yml
│ ├── test.yml
│ └── nginx.conf
├── tests/
│ └── tests-passive-captcha.php
├── architecture.md
├── flowchart.md
├── sequence.md
├── Dockerfile (in recycle bin)
├── Makefile
├── phpunit.xml
├── phpcs.xml.dist
├── README.md
├── readme.txt
├── sequence.md
└── passive-captcha.php

Usage

Fill out the settings to control rate limits, time thresholds, and feature toggles.
Place a hidden field labeled CAPTCHA Token in any Gravity Form to automatically enable passive CAPTCHA on that form.
Monitor the Recent Log Entries on the settings page or check wp-content/uploads/pch-logs.log for detailed debug output.

Development & Testing

Build: make build
Lint: make lint
Test: make test
Docker Compose (dev): docker-compose -f dev-only/docker-compose.yml up

Refer to dev-only/ for CI workflows, Docker configurations, and Nginx hardening guidelines.

License

GPL v2 or later. See LICENSE for details.