Changeset 3714007

Timestamp:

09/26/2026 08:40:01 AM (3 weeks ago)

Author:

pluginos

Message:

new update

Location:

spamoff-bot-protection/tags/1.0.0

Files:

• assets/css/spamoff-bot-protection-style.css (modified) (2 diffs)
• assets/js/spamoff-bot-protection-blocks-checkout.js (modified) (7 diffs)
• assets/js/spamoff-bot-protection-handler.js (modified) (1 diff)
• includes/class-spamoff-bot-protection-admin.php (modified) (2 diffs)
• includes/class-spamoff-bot-protection-captcha.php (modified) (2 diffs)
• includes/class-spamoff-bot-protection-frontend.php (modified) (10 diffs)
• includes/class-spamoff-bot-protection-helper.php (modified) (7 diffs)
• includes/class-spamoff-bot-protection-settings.php (modified) (15 diffs)
• languages/spamoff-bot-protection.pot (modified) (2 diffs)
• readme.txt (modified) (1 diff)
• spamoff-bot-protection.php (modified) (5 diffs)
• uninstall.php (modified) (1 diff)

spamoff-bot-protection/tags/1.0.0/assets/css/spamoff-bot-protection-style.css

@@ -1 +1 @@
 /* =========================================================
-   SpamOff – Spam & Bot Protection for WordPress — Checkout captcha styling
+   SpamOff – Spam & Bot Protection for WordPress — captcha styling
    ========================================================= */
 
-/* Remove box, background, border from the captcha wrapper */
+.spamoff-bot-protection-v2 {
+    margin: 12px 0 16px 0;
+    clear: both;
+}
+
+/* Google's notice, shown in forms when the v3 badge is hidden */
+.spamoff-bot-protection-notice {
+    margin: 8px 0;
+    font-size: 0.8em;
+    opacity: 0.8;
+}
+
+/* Only added by the handler when the notice above is on the page, as Google requires */
+.spamoff-bot-protection-hide-badge .grecaptcha-badge {
+    visibility: hidden !important;
+}
+
+/* Remove box, background, border from the checkout captcha wrapper */
 .woocommerce-checkout .spamoff-bot-protection-container,
 .woocommerce-checkout .spamoff-bot-protection-v2,
@@ -37 +54 @@
     box-shadow: none !important;
 }
-
-/* Disable old mobile scaling (handled via JS now) */
-@media (max-width: 768px) {
-    .spamoff-bot-protection-v2 {
-        transform: none !important;
-    }
-}

spamoff-bot-protection/tags/1.0.0/assets/js/spamoff-bot-protection-blocks-checkout.js

@@ -5 +5 @@
  * where it's read server-side by SpamOff_Bot_Protection_Frontend::validate_blocks_checkout.
  *
- * Google v3 tokens expire after 120s. WC Blocks reads the token from the store at
- * submission time, so a token sitting idle for the customer's full checkout dwell
- * would be rejected as `timeout-or-duplicate`. We refresh on a timer (well inside
- * the TTL) and immediately on tab-focus, so the token in the store is always recent.
+ * Google v3 tokens expire after 120s and are single-use. WC Blocks reads the token from
+ * the store at submission time, so we refresh it on a timer (well inside the TTL), on
+ * tab focus, and after every order attempt that doesn't complete — that attempt has
+ * already spent the token on the server.
  */
 (function () {
@@ -14 +14 @@
         return;
     }
+
+    var STORE_KEY = 'wc/store/checkout';
+    var NAMESPACE = 'spamoff-bot-protection';
 
     // Refresh well before Google's 120s TTL.
@@ -25 +28 @@
 
     var initialized = false;
+    var wasProcessing = false;
     var refreshTimer = null;
+
+    function getSiteKey() {
+        return window.spamoff_bot_protection && window.spamoff_bot_protection.v3SiteKey;
+    }
 
     function clearTimer() {
@@ -35 +43 @@
 
     function setExtensionToken(token) {
-        wp.data
-            .dispatch('wc/store/checkout')
-            .setExtensionData('spamoff-bot-protection', {
-                token: token,
-                action: 'checkout',
-            });
+        wp.data.dispatch(STORE_KEY).setExtensionData(NAMESPACE, {
+            token: token,
+            action: 'checkout',
+        });
     }
 
@@ -46 +52 @@
         clearTimer();
 
-        if (
-            !window.spamoff_bot_protection ||
-            !window.spamoff_bot_protection.siteKey ||
-            typeof grecaptcha === 'undefined' ||
-            !grecaptcha.ready
-        ) {
+        if (!getSiteKey() || typeof grecaptcha === 'undefined' || !grecaptcha.ready) {
             refreshTimer = setTimeout(fetchAndSetToken, GRECAPTCHA_WAIT_MS);
             return;
@@ -57 +58 @@
 
         grecaptcha.ready(function () {
-            grecaptcha.execute(window.spamoff_bot_protection.siteKey, { action: 'checkout' })
+            grecaptcha.execute(getSiteKey(), { action: 'checkout' })
                 .then(function (token) {
                     setExtensionToken(token);
@@ -70 +71 @@
     }
 
-    var unsubscribe = wp.data.subscribe(function () {
-        if (initialized) return;
-        if (!wp.data.select('wc/store/checkout')) return;
+    wp.data.subscribe(function () {
+        var checkout = wp.data.select(STORE_KEY);
+        if (!checkout) {
+            return;
+        }
 
-        initialized = true;
-        if (typeof unsubscribe === 'function') {
-            unsubscribe();
+        if (!initialized) {
+            initialized = true;
+            fetchAndSetToken();
+            return;
         }
-        fetchAndSetToken();
+
+        // An order attempt finished without completing (validation or payment error):
+        // its token is spent, so get a new one before the customer retries.
+        var processing = checkout.isProcessing() || checkout.isBeforeProcessing() || checkout.isAfterProcessing();
+        if (wasProcessing && !processing && !checkout.isComplete()) {
+            fetchAndSetToken();
+        }
+        wasProcessing = processing;
     });
 

spamoff-bot-protection/tags/1.0.0/assets/js/spamoff-bot-protection-handler.js

@@ -1 +1 @@
 /**
  * SpamOff – Spam & Bot Protection for WordPress — classic form handler.
- * Handles reCAPTCHA v2 and v3 token execution and form submission for non-Blocks forms.
+ *
+ * v3: when a protected form is submitted, fetch a token, then submit the form again
+ *     with the button the visitor clicked, so handlers that check it (WooCommerce's
+ *     `login` and `register`) still see it.
+ * v2: render each checkbox explicitly so its widget ID is known and it can be reset
+ *     after a failed classic checkout.
  */
-(function($) {
+(function ($) {
     'use strict';
 
-    // Google v3 tokens expire after 120s. Treat anything older than this as stale
-    // and re-execute on form submit, so a slow customer never sends an expired token.
+    var config = window.spamoff_bot_protection || {};
+
+    // Google v3 tokens expire after 120s; fetch a new one past this age.
     var TOKEN_FRESH_MS = 90 * 1000;
 
-    function hasFreshToken($tokenField) {
-        if (!$tokenField || !$tokenField.length) return false;
-        if (!$tokenField.val()) return false;
-        var fetchedAt = parseInt($tokenField.data('spamoff-bot-protection-fetched-at') || 0, 10);
-        return (Date.now() - fetchedAt) < TOKEN_FRESH_MS;
-    }
-
-    function stampToken($tokenField, token) {
-        $tokenField.val(token);
-        $tokenField.data('spamoff-bot-protection-fetched-at', Date.now());
-    }
-
-    var SpamOffBotProtection = {
-        init: function() {
-            if (typeof spamoff_bot_protection === 'undefined') {
+    // Give up waiting for Google's script (blocked by an extension, offline) after this.
+    var READY_TIMEOUT_MS = 15 * 1000;
+    var READY_POLL_MS = 100;
+
+    var readyCallbacks = null;
+
+    /**
+     * Run onReady once grecaptcha is usable, or onFail if it never loads.
+     */
+    function whenReady(onReady, onFail) {
+        if (window.grecaptcha && typeof window.grecaptcha.ready === 'function') {
+            window.grecaptcha.ready(onReady);
+            return;
+        }
+
+        if (!readyCallbacks) {
+            readyCallbacks = [];
+            var waited = 0;
+            var timer = setInterval(function () {
+                waited += READY_POLL_MS;
+                var loaded = window.grecaptcha && typeof window.grecaptcha.ready === 'function';
+                if (!loaded && waited < READY_TIMEOUT_MS) {
+                    return;
+                }
+                clearInterval(timer);
+                var callbacks = readyCallbacks;
+                readyCallbacks = null;
+                callbacks.forEach(function (callback) {
+                    if (loaded) {
+                        window.grecaptcha.ready(callback.onReady);
+                    } else if (callback.onFail) {
+                        callback.onFail();
+                    }
+                });
+            }, READY_POLL_MS);
+        }
+
+        readyCallbacks.push({ onReady: onReady, onFail: onFail });
+    }
+
+    /* ------------------------------------------------------------------ v3 */
+
+    function getTokenField(form) {
+        return form.querySelector('input[name="spamoff_bot_protection_token"]');
+    }
+
+    function hasFreshToken(field) {
+        var fetchedAt = parseInt(field.getAttribute('data-fetched-at') || '0', 10);
+        return field.value !== '' && Date.now() - fetchedAt < TOKEN_FRESH_MS;
+    }
+
+    function getAction(field) {
+        var container = field.closest('.spamoff-bot-protection-container');
+        return (container && container.getAttribute('data-action')) || 'general';
+    }
+
+    function defaultSubmitter(form) {
+        return form.querySelector('button[type="submit"][name], input[type="submit"][name], button:not([type])[name]');
+    }
+
+    /**
+     * Submit the form again as if the visitor had clicked `submitter`.
+     */
+    function resubmit(form, submitter) {
+        if (typeof form.requestSubmit === 'function') {
+            // Fires the submit event again, so other handlers (e.g. WooCommerce's AJAX
+            // checkout) still run, and includes the clicked button in the form data.
+            try {
+                form.requestSubmit(submitter && submitter.form === form ? submitter : undefined);
                 return;
-            }
-
-            if (spamoff_bot_protection.type === 'v3') {
-                this.initV3();
-            } else if (spamoff_bot_protection.type === 'v2') {
-                this.initV2();
-            }
-        },
-
-        initV3: function() {
-            var self = this;
-
-            if (typeof grecaptcha === 'undefined') {
-                setTimeout(function() {
-                    self.initV3();
-                }, 100);
+            } catch (e) {
+                form.requestSubmit();
                 return;
             }
-
-            this.handleForm('form.login, form.woocommerce-form-login', 'login');
-            this.handleForm('form.register, form.woocommerce-form-register', 'registration');
-            this.handleCheckoutForm();
-            this.handleForm('form.lost_reset_password, form.woocommerce-ResetPassword', 'lost_password');
-            this.handleForm('form#commentform', 'comments');
-
-            // Custom forms with shortcode.
-            $('[id^="spamoff_bot_protection_token_"]').each(function() {
-                var action = $(this).attr('id').replace('spamoff_bot_protection_token_', '');
-                var form = $(this).closest('form');
-                if (form.length) {
-                    self.handleForm(form, action);
+        }
+
+        // Older browsers: forms submitted over AJAX by jQuery handlers.
+        if ($(form).is('form.checkout')) {
+            $(form).trigger('submit');
+            return;
+        }
+
+        // Carry the clicked button's name/value by hand, and call the prototype method
+        // because a control named "submit" (WordPress comment form) shadows form.submit.
+        if (submitter && submitter.name) {
+            var hidden = document.createElement('input');
+            hidden.type = 'hidden';
+            hidden.name = submitter.name;
+            hidden.value = submitter.value;
+            form.appendChild(hidden);
+        }
+        HTMLFormElement.prototype.submit.call(form);
+    }
+
+    /**
+     * Capture-phase submit listener: runs before any handler bound on the form itself,
+     * so a submission never leaves without a fresh token.
+     */
+    function onSubmit(event) {
+        var form = event.target;
+        if (!(form instanceof HTMLFormElement) || !config.v3SiteKey) {
+            return;
+        }
+
+        var field = getTokenField(form);
+        if (!field) {
+            return;
+        }
+
+        // Token fetch failed: let the submission through; the server shows the error.
+        if (form.getAttribute('data-spamoff-bot-protection-skip') === '1') {
+            form.removeAttribute('data-spamoff-bot-protection-skip');
+            return;
+        }
+
+        if (hasFreshToken(field)) {
+            // Tokens are single-use. Keep the value for this submission (payment gateways
+            // may re-trigger it), but make the next one fetch a new token.
+            field.setAttribute('data-fetched-at', '0');
+            return;
+        }
+
+        event.preventDefault();
+        event.stopImmediatePropagation();
+
+        if (form.getAttribute('data-spamoff-bot-protection-pending') === '1') {
+            return;
+        }
+        form.setAttribute('data-spamoff-bot-protection-pending', '1');
+
+        var submitter = event.submitter || defaultSubmitter(form);
+
+        function done(token) {
+            form.removeAttribute('data-spamoff-bot-protection-pending');
+            if (token) {
+                field.value = token;
+                field.setAttribute('data-fetched-at', String(Date.now()));
+            } else {
+                form.setAttribute('data-spamoff-bot-protection-skip', '1');
+            }
+            resubmit(form, submitter);
+        }
+
+        whenReady(function () {
+            window.grecaptcha.execute(config.v3SiteKey, { action: getAction(field) }).then(done, function () {
+                done('');
+            });
+        }, function () {
+            done('');
+        });
+    }
+
+    document.addEventListener('submit', onSubmit, true);
+
+    /* ------------------------------------------------------------------ v2 */
+
+    function renderV2Widgets() {
+        var widgets = document.querySelectorAll('.spamoff-bot-protection-v2 .g-recaptcha[data-sitekey]:not([data-widget-id])');
+        if (!widgets.length) {
+            return;
+        }
+
+        whenReady(function () {
+            Array.prototype.forEach.call(widgets, function (el) {
+                if (el.hasAttribute('data-widget-id')) {
+                    return;
+                }
+                try {
+                    var widgetId = window.grecaptcha.render(el, {
+                        sitekey: el.getAttribute('data-sitekey'),
+                        theme: el.getAttribute('data-theme') || 'light',
+                        size: el.getAttribute('data-size') || 'normal'
+                    });
+                    el.setAttribute('data-widget-id', String(widgetId));
+                } catch (e) {
+                    // Already rendered.
                 }
             });
-        },
-
-        initV2: function() {
-            // v2 is handled automatically by Google's script after rendering the div.
-        },
-
-        handleCheckoutForm: function() {
-            var $checkoutForm = $('form.checkout, form.woocommerce-checkout');
-
-            if (!$checkoutForm.length) {
+            fitV2Widgets();
+        });
+    }
+
+    function resetV2Widgets(scope) {
+        if (!window.grecaptcha || typeof window.grecaptcha.reset !== 'function') {
+            return;
+        }
+        Array.prototype.forEach.call(scope.querySelectorAll('.g-recaptcha[data-widget-id]'), function (el) {
+            try {
+                window.grecaptcha.reset(parseInt(el.getAttribute('data-widget-id'), 10));
+            } catch (e) {
+                // Widget gone.
+            }
+        });
+    }
+
+    /**
+     * Google's widget has a fixed width; scale it down when its column is narrower.
+     */
+    function fitV2Widgets() {
+        Array.prototype.forEach.call(document.querySelectorAll('.spamoff-bot-protection-v2'), function (box) {
+            var widget = box.querySelector('.g-recaptcha');
+            if (!widget) {
                 return;
             }
-
-            // For v2, ensure the widget renders.
-            if (spamoff_bot_protection.type === 'v2') {
-                setTimeout(function() {
-                    if (typeof grecaptcha !== 'undefined' && grecaptcha.render) {
-                        $('.g-recaptcha[data-sitekey="' + spamoff_bot_protection.siteKey + '"]').each(function() {
-                            if (!$(this).attr('data-rendered')) {
-                                try {
-                                    grecaptcha.render(this, {
-                                        'sitekey': spamoff_bot_protection.siteKey,
-                                        'theme': $(this).data('theme') || 'light',
-                                        'size': $(this).data('size') || 'normal'
-                                    });
-                                    $(this).attr('data-rendered', 'true');
-                                } catch(e) {
-                                    // noop
-                                }
-                            }
-                        });
-                    }
-                }, 1000);
-            }
-
-            // Pre-execute a v3 token so quick submitters don't see a delay. Slow
-            // submitters get a fresh token on click — see hasFreshToken() check below.
-            // handleCheckoutForm() can re-run on every ajaxComplete, so skip the
-            // pre-execute if a recent token is already in the field.
-            if (spamoff_bot_protection.type === 'v3') {
-                var $tokenField = $('input[id^="spamoff_bot_protection_token_checkout"]');
-                var needsPreExecute = $tokenField.length
-                    && !hasFreshToken($tokenField.first())
-                    && typeof grecaptcha !== 'undefined'
-                    && grecaptcha.ready;
-                if (needsPreExecute) {
-                    grecaptcha.ready(function() {
-                        grecaptcha.execute(spamoff_bot_protection.siteKey, {action: 'checkout'})
-                            .then(function(token) {
-                                $tokenField.each(function() {
-                                    stampToken($(this), token);
-                                });
-                            })
-                            .catch(function() {
-                                // noop — submit-time handler will retry.
-                            });
-                    });
-                }
-            }
-
-            // Place Order click: always ensure a fresh token. The previous version
-            // only intercepted when the field was empty, so a stale pre-fetched
-            // token (>120s old, Google's TTL) would be sent and rejected.
-            $(document).off('click', '#place_order').on('click', '#place_order', function(e) {
-                if (spamoff_bot_protection.type !== 'v3') return;
-
-                var tokenField = $('input[id^="spamoff_bot_protection_token_checkout"]').first();
-                if (!tokenField.length) return;
-                if (hasFreshToken(tokenField)) return; // existing token is recent — let the submit proceed
-
-                e.preventDefault();
-                e.stopImmediatePropagation();
-
-                if (typeof grecaptcha !== 'undefined' && grecaptcha.ready) {
-                    grecaptcha.ready(function() {
-                        grecaptcha.execute(spamoff_bot_protection.siteKey, {action: 'checkout'})
-                            .then(function(token) {
-                                stampToken(tokenField, token);
-                                $checkoutForm.submit();
-                            })
-                            .catch(function() {
-                                if (typeof wc_add_notice !== 'undefined') {
-                                    wc_add_notice('Verification failed. Please try again.', 'error');
-                                }
-                            });
-                    });
-                }
-                return false;
-            });
-
-            // Also handle regular form submit as fallback (e.g. Enter key in a field).
-            this.handleForm('form.checkout, form.woocommerce-checkout', 'checkout');
-        },
-
-        handleForm: function(selector, action) {
-            var $form = $(selector);
-
-            if (!$form.length) {
-                return;
-            }
-
-            if ($form.data('spamoff-bot-protection-handled')) {
-                return;
-            }
-
-            $form.data('spamoff-bot-protection-handled', true);
-
-            // Execute the captcha on form submit. A token from page-load pre-execution
-            // is reused only while still fresh (under Google's 120s TTL) — otherwise
-            // we fetch a new one before letting the form submit.
-            var submitHandler = function(e) {
-                var $formElement = $(this);
-                var tokenField = $formElement.find('input[id^="spamoff_bot_protection_token_' + action + '"]').first();
-
-                if (!tokenField.length) return;
-                if (hasFreshToken(tokenField)) return true;
-
-                e.preventDefault();
-                e.stopImmediatePropagation();
-
-                if (typeof grecaptcha !== 'undefined' && grecaptcha.ready) {
-                    grecaptcha.ready(function() {
-                        grecaptcha.execute(spamoff_bot_protection.siteKey, {action: action})
-                            .then(function(token) {
-                                stampToken(tokenField, token);
-                                // Unbind only our handler so WooCommerce's submit handler remains.
-                                $formElement.off('submit', submitHandler).trigger('submit');
-                            })
-                            .catch(function() {
-                                $formElement.off('submit', submitHandler).trigger('submit');
-                            });
-                    });
-                } else {
-                    $formElement.off('submit', submitHandler).trigger('submit');
-                }
-
-                return false;
-            };
-
-            $form.on('submit', submitHandler);
-        }
-    };
-
-
-    // Initialize when document is ready.
-    $(document).ready(function() {
-        SpamOffBotProtection.init();
+            var compact = widget.getAttribute('data-size') === 'compact';
+            var width = compact ? 164 : 304;
+            var height = compact ? 144 : 78;
+            var available = box.clientWidth;
+            var scale = available > 0 && available < width ? available / width : 1;
+
+            widget.style.transform = scale < 1 ? 'scale(' + scale + ')' : '';
+            widget.style.transformOrigin = '0 0';
+            box.style.height = scale < 1 ? Math.ceil(height * scale) + 'px' : '';
+        });
+    }
+
+    /* ------------------------------------------------------------- general */
+
+    /**
+     * A theme that fires a form hook twice would put two captchas in one form, which
+     * would post two tokens/responses under one name. Keep the first.
+     */
+    function removeDuplicateCaptchas() {
+        Array.prototype.forEach.call(document.forms, function (form) {
+            var containers = form.querySelectorAll('.spamoff-bot-protection-container');
+            for (var i = 1; i < containers.length; i++) {
+                containers[i].parentNode.removeChild(containers[i]);
+            }
+        });
+    }
+
+    function init() {
+        removeDuplicateCaptchas();
+        renderV2Widgets();
+
+        // Google allows hiding the v3 badge only when its notice is shown instead.
+        if (document.querySelector('.spamoff-bot-protection-notice')) {
+            document.documentElement.classList.add('spamoff-bot-protection-hide-badge');
+        }
+    }
+
+    $(init);
+
+    // Forms added by AJAX (e.g. a theme's login popup).
+    $(document).ajaxComplete(function () {
+        removeDuplicateCaptchas();
+        renderV2Widgets();
     });
 
-    // Also initialize on AJAX-loaded content (for WooCommerce checkout AJAX updates).
-    $(document.body).on('updated_checkout updated_wc_div checkout_updated', function() {
-        $('form.checkout, form.woocommerce-checkout').removeData('spamoff-bot-protection-handled');
-        // Google tokens are one-time-use. Clear the stored token so the pre-execute
-        // in handleCheckoutForm always fetches a fresh one after any checkout update
-        // (including failed payment attempts where the old token was already consumed).
-        $('input[id^="spamoff_bot_protection_token_checkout"]')
-            .val('')
-            .removeData('spamoff-bot-protection-fetched-at');
-        // Reset v2 widget so the user doesn't resubmit an already-consumed response.
-        if (typeof grecaptcha !== 'undefined' && window.spamoff_bot_protection && spamoff_bot_protection.type === 'v2') {
-            try { grecaptcha.reset(); } catch(e) {}
-        }
-        setTimeout(function() {
-            SpamOffBotProtection.init();
-        }, 500);
+    // A failed classic checkout has already spent the token/response on the server.
+    // Clear it so the next attempt gets a new one. (Checkout refreshes that don't
+    // submit the order leave a ticked v2 box alone.)
+    $(document.body).on('checkout_error', function () {
+        var form = document.querySelector('form.checkout');
+        if (!form) {
+            return;
+        }
+        Array.prototype.forEach.call(form.querySelectorAll('input[name="spamoff_bot_protection_token"]'), function (field) {
+            field.value = '';
+            field.setAttribute('data-fetched-at', '0');
+        });
+        resetV2Widgets(form);
     });
 
-    // Re-initialize after AJAX complete.
-    $(document).ajaxComplete(function() {
-        setTimeout(function() {
-            SpamOffBotProtection.init();
-        }, 100);
+    var resizeTimer = null;
+    $(window).on('resize', function () {
+        clearTimeout(resizeTimer);
+        resizeTimer = setTimeout(fitV2Widgets, 150);
     });
-
-    // Special handling for checkout page load: re-init, then trigger the v2 width-match resize.
-    $(window).on('load', function() {
-        if ($('body').hasClass('woocommerce-checkout')) {
-            setTimeout(function() {
-                SpamOffBotProtection.init();
-                setTimeout(function() {
-                    $(window).trigger('resize');
-                }, 400);
-            }, 300);
-        }
-    });
-
-    // Match the v2 reCAPTCHA widget width to the Place Order button via CSS transform.
-    function matchRecaptchaToPlaceOrder() {
-        var $recaptcha = $('.woocommerce-checkout .g-recaptcha');
-        var $placeOrder = $('.woocommerce-checkout #place_order');
-
-        if (!$recaptcha.length || !$placeOrder.length) return;
-        if (!$recaptcha.find('iframe').length) return;
-
-        var baseWidth = 304; // Google's fixed widget width
-        // Cap at 1 — only scale DOWN for narrow buttons, never upscale beyond natural size.
-        var scale = Math.min(1, $placeOrder.outerWidth() / baseWidth);
-
-        $recaptcha.css({
-            transform: 'scale(' + scale + ')',
-            'transform-origin': 'left top',
-            width: baseWidth + 'px',
-            height: 'auto'
-        });
-    }
-
-    $(document.body).on('updated_checkout updated_wc_div checkout_updated', function() {
-        setTimeout(matchRecaptchaToPlaceOrder, 800);
-    });
-
-    $(window).on('resize', function() {
-        setTimeout(matchRecaptchaToPlaceOrder, 300);
-    });
-
 })(jQuery);

spamoff-bot-protection/tags/1.0.0/includes/class-spamoff-bot-protection-admin.php

@@ -8 +8 @@
     public function __construct() {
         add_filter( 'plugin_action_links_' . SPAMOFF_BOT_PROTECTION_PLUGIN_BASENAME, array( $this, 'add_settings_link' ) );
+        add_action( 'admin_enqueue_scripts', array( $this, 'enqueue_settings_script' ) );
+        add_action( 'admin_init', array( $this, 'add_privacy_policy_content' ) );
+    }
+
+    /**
+     * Suggested text for the site's privacy policy (Settings → Privacy → Policy Guide),
+     * since protected forms send visitor data to Google.
+     */
+    public function add_privacy_policy_content() {
+        if ( ! function_exists( 'wp_add_privacy_policy_content' ) ) {
+            return;
+        }
+
+        $content = '<p class="privacy-policy-tutorial">'
+            . esc_html__( 'SpamOff adds Google reCAPTCHA to the forms you protect. On pages with a protected form, Google\'s reCAPTCHA script runs in the visitor\'s browser, and when the form is submitted your server sends the reCAPTCHA response and the visitor\'s IP address to Google to check it.', 'spamoff-bot-protection' )
+            . '</p><p><strong class="privacy-policy-tutorial">' . esc_html__( 'Suggested text:', 'spamoff-bot-protection' ) . ' </strong>'
+            . esc_html__( 'We use Google reCAPTCHA on our login, registration, password reset, checkout and comment forms to protect this site from spam and abuse. reCAPTCHA collects hardware and software information, such as device and application data, and sends it to Google for analysis. Your use of reCAPTCHA is subject to the Google Privacy Policy and Terms of Service.', 'spamoff-bot-protection' )
+            . ' <a href="https://policies.google.com/privacy">https://policies.google.com/privacy</a>'
+            . ' <a href="https://policies.google.com/terms">https://policies.google.com/terms</a></p>';
+
+        wp_add_privacy_policy_content( __( 'SpamOff – Google reCaptcha for WooCommerce', 'spamoff-bot-protection' ), wp_kses_post( $content ) );
     }
 
@@ -16 +37 @@
         return $links;
     }
+
+    /**
+     * Show only the selected version's key fields on the General Settings screen.
+     */
+    public function enqueue_settings_script( $hook_suffix ) {
+        // phpcs:disable WordPress.Security.NonceVerification.Recommended -- Read-only screen detection.
+        $is_settings_tab = 'woocommerce_page_wc-settings' === $hook_suffix
+            && isset( $_GET['tab'] )
+            && 'spamoff-bot-protection' === sanitize_key( wp_unslash( $_GET['tab'] ) );
+        // phpcs:enable WordPress.Security.NonceVerification.Recommended
+
+        if ( ! $is_settings_tab ) {
+            return;
+        }
+
+        wp_enqueue_script(
+            'spamoff-bot-protection-admin',
+            SPAMOFF_BOT_PROTECTION_PLUGIN_URL . 'assets/js/spamoff-bot-protection-admin.js',
+            array(),
+            SPAMOFF_BOT_PROTECTION_PLUGIN_VERSION,
+            array( 'in_footer' => true )
+        );
+
+        wp_localize_script(
+            'spamoff-bot-protection-admin',
+            'spamoff_bot_protection_admin',
+            array(
+                // The Checkout block always uses the v3 keys, so keep them visible when it's in use.
+                'alwaysShowV3' => SpamOff_Bot_Protection_Helper::checkout_page_uses_blocks() ? '1' : '',
+            )
+        );
+    }
 }

spamoff-bot-protection/tags/1.0.0/includes/class-spamoff-bot-protection-captcha.php

@@ -4 +4 @@
 }
 
+/**
+ * Loads Google's reCAPTCHA script and the plugin's assets, only on pages that need them.
+ *
+ * Forms call require_type() as they render a captcha. Google's script is added in the
+ * footer once the page knows which versions it rendered, so pages without a protected
+ * form (including login pages whose toggle is off) never load it — and never show the
+ * v3 badge.
+ */
 class SpamOff_Bot_Protection_Captcha {
 
+    /** @var array<string, bool> reCAPTCHA versions rendered on the current page. */
+    private static $required_types = array();
+
     public function __construct() {
-        add_action( 'wp_enqueue_scripts', array( $this, 'enqueue_scripts' ) );
+        add_action( 'wp_enqueue_scripts', array( __CLASS__, 'register_assets' ), 5 );
+        add_action( 'wp_enqueue_scripts', array( $this, 'maybe_load_everywhere' ) );
+        // Just before footer scripts print, so forms output in wp_footer (login popups) count too.
+        add_action( 'wp_print_footer_scripts', array( __CLASS__, 'enqueue_google_api' ), 1 );
+
+        // The Checkout block has no PHP form hook; detect it as it renders.
+        add_filter( 'render_block_woocommerce/checkout', array( $this, 'on_checkout_block_render' ) );
     }
 
-    public function enqueue_scripts() {
-        $site_key = SpamOff_Bot_Protection_Helper::get_option( 'spamoff_bot_protection_site_key' );
-        if ( empty( $site_key ) ) {
+    public static function register_assets() {
+        if ( wp_script_is( 'spamoff-bot-protection-handler', 'registered' ) ) {
             return;
         }
 
-        if ( is_admin() && ! wp_doing_ajax() ) {
-            return;
-        }
-
-        // Blocks Checkout supports only v3.
-        $recaptcha_type = SpamOff_Bot_Protection_Helper::get_option( 'spamoff_bot_protection_type', 'v3' );
-        if ( SpamOff_Bot_Protection_Helper::is_blocks_checkout() ) {
-            $recaptcha_type = 'v3';
-        }
-
-        $google_api_url = 'v3' === $recaptcha_type
-            ? 'https://www.google.com/recaptcha/api.js?render=' . rawurlencode( $site_key )
-            : 'https://www.google.com/recaptcha/api.js';
-
-        wp_enqueue_script( 'spamoff-bot-protection-api', $google_api_url, array(), SPAMOFF_BOT_PROTECTION_PLUGIN_VERSION, true );
-
-        wp_enqueue_script(
+        wp_register_script(
             'spamoff-bot-protection-handler',
             SPAMOFF_BOT_PROTECTION_PLUGIN_URL . 'assets/js/spamoff-bot-protection-handler.js',
-            array( 'jquery', 'spamoff-bot-protection-api' ),
+            array( 'jquery' ),
             SPAMOFF_BOT_PROTECTION_PLUGIN_VERSION,
-            true
+            array( 'in_footer' => true )
         );
 
-        wp_localize_script(
-            'spamoff-bot-protection-handler',
-            'spamoff_bot_protection',
-            array(
-                'siteKey' => $site_key,
-                'type'    => $recaptcha_type,
-            )
+        wp_register_script(
+            'spamoff-bot-protection-blocks-checkout',
+            SPAMOFF_BOT_PROTECTION_PLUGIN_URL . 'assets/js/spamoff-bot-protection-blocks-checkout.js',
+            array( 'wp-data' ),
+            SPAMOFF_BOT_PROTECTION_PLUGIN_VERSION,
+            array( 'in_footer' => true )
         );
 
-        if ( SpamOff_Bot_Protection_Helper::is_blocks_checkout() ) {
-            wp_enqueue_script(
-                'spamoff-bot-protection-blocks-checkout',
-                SPAMOFF_BOT_PROTECTION_PLUGIN_URL . 'assets/js/spamoff-bot-protection-blocks-checkout.js',
-                array( 'wp-data', 'wp-hooks', 'spamoff-bot-protection-handler' ),
-                SPAMOFF_BOT_PROTECTION_PLUGIN_VERSION,
-                true
-            );
-        }
-
-        wp_enqueue_style(
+        wp_register_style(
             'spamoff-bot-protection-style',
             SPAMOFF_BOT_PROTECTION_PLUGIN_URL . 'assets/css/spamoff-bot-protection-style.css',
@@ -66 +55 @@
         );
     }
+
+    /**
+     * Mark a reCAPTCHA version as used on this page and enqueue the plugin's assets.
+     *
+     * Safe to call while the page body renders: scripts are printed in the footer.
+     */
+    public static function require_type( $type ) {
+        self::register_assets();
+
+        self::$required_types[ $type ] = true;
+
+        wp_enqueue_style( 'spamoff-bot-protection-style' );
+        wp_enqueue_script( 'spamoff-bot-protection-handler' );
+    }
+
+    /**
+     * Opt-in fallback for forms injected by AJAX after the page loads (e.g. login modals),
+     * which render too late to enqueue scripts themselves.
+     */
+    public function maybe_load_everywhere() {
+        /**
+         * Filters whether reCAPTCHA assets load on every front-end page.
+         *
+         * @since 1.1.0
+         *
+         * @param bool $load_everywhere Default false: load only where a protected form renders.
+         */
+        if ( apply_filters( 'spamoff_bot_protection_load_everywhere', false ) && SpamOff_Bot_Protection_Helper::has_keys() ) {
+            self::require_type( SpamOff_Bot_Protection_Helper::get_type() );
+        }
+    }
+
+    /**
+     * Enqueue the Blocks Checkout token script when the Checkout block renders.
+     *
+     * @param string $block_content Rendered block HTML, returned unchanged.
+     * @return string
+     */
+    public function on_checkout_block_render( $block_content ) {
+        if ( SpamOff_Bot_Protection_Frontend::is_blocks_checkout_protected() ) {
+            self::require_type( 'v3' );
+            wp_enqueue_script( 'spamoff-bot-protection-blocks-checkout' );
+        }
+        return $block_content;
+    }
+
+    /**
+     * Add Google's script once the page has rendered every captcha it needs.
+     *
+     * v3 needs the site key in the URL (and shows the badge); v2 widgets are rendered
+     * explicitly by the handler, which also works alongside a v3 script on the same page.
+     */
+    public static function enqueue_google_api() {
+        if ( empty( self::$required_types ) ) {
+            return;
+        }
+
+        $needs_v3 = isset( self::$required_types['v3'] );
+        $v3_key   = SpamOff_Bot_Protection_Helper::get_site_key( 'v3' );
+
+        if ( $needs_v3 && '' !== $v3_key ) {
+            $google_api_url = add_query_arg( 'render', rawurlencode( $v3_key ), 'https://www.google.com/recaptcha/api.js' );
+        } else {
+            $needs_v3       = false;
+            $google_api_url = add_query_arg( 'render', 'explicit', 'https://www.google.com/recaptcha/api.js' );
+        }
+
+        wp_enqueue_script(
+            'spamoff-bot-protection-api',
+            $google_api_url,
+            array(),
+            SPAMOFF_BOT_PROTECTION_PLUGIN_VERSION,
+            array(
+                'in_footer' => true,
+                'strategy'  => 'async',
+            )
+        );
+
+        $config = array(
+            'v3SiteKey'     => $needs_v3 ? $v3_key : '',
+            'failedMessage' => SpamOff_Bot_Protection_Helper::get_error_message( 'failed' ),
+        );
+
+        foreach ( array( 'spamoff-bot-protection-handler', 'spamoff-bot-protection-blocks-checkout' ) as $handle ) {
+            if ( wp_script_is( $handle, 'enqueued' ) ) {
+                wp_localize_script( $handle, 'spamoff_bot_protection', $config );
+            }
+        }
+    }
 }

spamoff-bot-protection/tags/1.0.0/includes/class-spamoff-bot-protection-frontend.php

@@ -4 +4 @@
 }
 
+use Automattic\WooCommerce\StoreApi\Exceptions\RouteException;
+use Automattic\WooCommerce\StoreApi\Schemas\V1\CheckoutSchema;
+use SpamOff_Bot_Protection_Helper as Helper;
+
 class SpamOff_Bot_Protection_Frontend {
 
-    /** Tracks which (action, suffix) pairs have already been rendered to avoid duplicates. */
-    private static $rendered_actions = array();
+    /** Store API extension namespace the Blocks Checkout script writes its token to. */
+    const STORE_API_NAMESPACE = 'spamoff-bot-protection';
+
+    /** Captchas rendered per (action, suffix) on this page, for unique element IDs. */
+    private static $render_counts = array();
 
     public function __construct() {
-        // Blocks Checkout (Store API): reads token from request.extensions and throws on failure.
-        add_action( 'woocommerce_store_api_checkout_update_order_from_request', array( $this, 'validate_blocks_checkout' ), 10, 2 );
-
         // Render captcha on WooCommerce / WP forms.
         add_action( 'woocommerce_login_form', array( $this, 'add_login_captcha' ) );
@@ -21 +25 @@
         add_action( 'comment_form_logged_in_after', array( $this, 'add_comments_captcha' ) );
 
-        // Server-side validation.
+        // WordPress's own forms: wp-login.php, plus login forms made with wp_login_form().
+        add_action( 'login_form', array( $this, 'add_wp_login_captcha' ) );
+        add_filter( 'login_form_middle', array( $this, 'add_wp_login_form_captcha' ) );
+        add_action( 'register_form', array( $this, 'add_wp_register_captcha' ) );
+        add_action( 'lostpassword_form', array( $this, 'add_wp_lost_password_captcha' ) );
+
+        // Server-side validation. Each hook fires only for its own form, after WooCommerce
+        // has checked that form's nonce.
         add_filter( 'woocommerce_process_login_errors', array( $this, 'validate_login' ), 10, 3 );
-        add_action( 'woocommerce_register_post', array( $this, 'validate_registration' ), 10, 3 );
-        add_action( 'woocommerce_checkout_process', array( $this, 'validate_checkout' ), 1 );
-        add_action( 'woocommerce_lostpassword_post', array( $this, 'validate_lost_password' ), 1 );
+        add_filter( 'woocommerce_process_registration_errors', array( $this, 'validate_registration' ), 10, 4 );
+        add_action( 'woocommerce_after_checkout_validation', array( $this, 'validate_checkout' ), 10, 2 );
+        add_action( 'lostpassword_post', array( $this, 'validate_lost_password' ), 10, 2 );
         add_action( 'pre_comment_on_post', array( $this, 'validate_comment' ) );
 
+        // After WordPress checks the password (priority 20), so a failed captcha always wins.
+        add_filter( 'authenticate', array( $this, 'validate_wp_login' ), 30 );
+        add_filter( 'registration_errors', array( $this, 'validate_wp_registration' ) );
+
+        // Blocks Checkout (Store API): reads the token from request.extensions and throws on failure.
+        add_action( 'init', array( $this, 'register_store_api_data' ) );
+        add_action( 'woocommerce_store_api_checkout_update_order_from_request', array( $this, 'validate_blocks_checkout' ), 10, 2 );
+
         add_shortcode( 'spamoff_bot_protection', array( $this, 'shortcode' ) );
     }
 
     /**
-     * Validate the captcha for WooCommerce Blocks Checkout.
-     *
-     * The Blocks JS injects the token via setExtensionData('spamoff-bot-protection', { token, action }),
-     * which arrives here on the Store API request's `extensions` payload.
-     */
-    public function validate_blocks_checkout( $order, $request ) {
-        if ( ! SpamOff_Bot_Protection_Helper::is_form_enabled( 'checkout' ) ) {
-            return;
-        }
-
-        $extensions = is_array( $request['extensions'] ?? null ) ? $request['extensions'] : array();
-        $data       = isset( $extensions['spamoff-bot-protection'] ) && is_array( $extensions['spamoff-bot-protection'] )
-            ? $extensions['spamoff-bot-protection']
-            : array();
-
-        $token  = isset( $data['token'] )  ? sanitize_text_field( (string) $data['token'] )  : '';
-        $action = isset( $data['action'] ) ? sanitize_text_field( (string) $data['action'] ) : 'checkout';
-
-        if ( empty( $token ) ) {
-            throw new \Automattic\WooCommerce\StoreApi\Exceptions\RouteException(
-                'spamoff_bot_protection_missing',
-                esc_html( SpamOff_Bot_Protection_Helper::get_error_message( 'missing' ) ),
-                400
-            );
-        }
-
-        $result = SpamOff_Bot_Protection_Helper::verify_recaptcha( $token, $action );
-
-        if ( empty( $result['success'] ) || true !== $result['success'] ) {
-            $error_type = isset( $result['error'] ) ? $result['error'] : 'failed';
-            throw new \Automattic\WooCommerce\StoreApi\Exceptions\RouteException(
-                'spamoff_bot_protection_failed',
-                esc_html( SpamOff_Bot_Protection_Helper::get_error_message( $error_type ) ),
-                400
-            );
-        }
+     * Blocks Checkout protection. The Checkout block only supports v3, so it always
+     * uses the v3 keys, whichever version is selected for the other forms.
+     */
+    public static function is_blocks_checkout_protected() {
+        return Helper::is_checkout_enabled_for_current_user() && Helper::has_keys( 'v3' );
     }
 
     public function add_login_captcha() {
-        if ( SpamOff_Bot_Protection_Helper::is_form_enabled( 'login' ) ) {
+        if ( Helper::is_form_protected( 'login' ) ) {
             $this->render_captcha( 'login' );
         }
@@ -77 +65 @@
 
     public function add_register_captcha() {
-        if ( SpamOff_Bot_Protection_Helper::is_form_enabled( 'registration' ) ) {
+        if ( Helper::is_form_protected( 'registration' ) ) {
             $this->render_captcha( 'registration' );
         }
@@ -83 +71 @@
 
     public function add_checkout_captcha() {
-        if ( ! SpamOff_Bot_Protection_Helper::is_form_enabled( 'checkout' ) ) {
-            return;
-        }
-
-        if ( empty( SpamOff_Bot_Protection_Helper::get_option( 'spamoff_bot_protection_site_key' ) ) ) {
+        if ( ! Helper::is_checkout_protected() ) {
             return;
         }
@@ -97 +81 @@
 
     public function add_lost_password_captcha() {
-        if ( SpamOff_Bot_Protection_Helper::is_form_enabled( 'lost_password' ) ) {
+        if ( Helper::is_form_protected( 'lost_password' ) ) {
             $this->render_captcha( 'lost_password' );
         }
@@ -103 +87 @@
 
     public function add_comments_captcha() {
-        if ( SpamOff_Bot_Protection_Helper::is_form_enabled( 'comments' ) ) {
+        if ( Helper::is_form_protected( 'comments' ) ) {
             $this->render_captcha( 'comments' );
         }
     }
 
+    public function add_wp_login_captcha() {
+        if ( Helper::is_form_protected( 'wp_login' ) ) {
+            $this->render_captcha( 'wp_login' );
+        }
+    }
+
+    /**
+     * Login forms built with wp_login_form() (theme widgets, custom pages) post to
+     * wp-login.php but don't fire the `login_form` action.
+     *
+     * @param string $content HTML inserted before the form's submit button.
+     * @return string
+     */
+    public function add_wp_login_form_captcha( $content ) {
+        if ( ! Helper::is_form_protected( 'wp_login' ) ) {
+            return $content;
+        }
+
+        ob_start();
+        $this->render_captcha( 'wp_login' );
+        return $content . ob_get_clean();
+    }
+
+    public function add_wp_register_captcha() {
+        if ( Helper::is_form_protected( 'wp_registration' ) ) {
+            $this->render_captcha( 'wp_registration' );
+        }
+    }
+
+    public function add_wp_lost_password_captcha() {
+        if ( Helper::is_form_protected( 'wp_lost_password' ) ) {
+            $this->render_captcha( 'wp_lost_password' );
+        }
+    }
+
     public function validate_login( $validation_error, $username, $password ) {
-        if ( ! SpamOff_Bot_Protection_Helper::is_form_enabled( 'login' ) ) {
+        if ( ! Helper::is_form_protected( 'login' ) || ! $this->should_validate( 'login' ) ) {
             return $validation_error;
         }
@@ -121 +140 @@
     }
 
-    public function validate_registration( $username, $email, $validation_errors ) {
-        if ( ! SpamOff_Bot_Protection_Helper::is_form_enabled( 'registration' ) ) {
-            return;
+    /**
+     * Runs only for the My Account registration form. (`woocommerce_register_post` also
+     * fires for accounts created at checkout, in the admin and over REST, none of which
+     * carry this captcha.)
+     */
+    public function validate_registration( $validation_error, $username, $password, $email ) {
+        if ( ! Helper::is_form_protected( 'registration' ) || ! $this->should_validate( 'registration' ) ) {
+            return $validation_error;
         }
 
         $result = $this->validate_captcha( 'registration' );
         if ( is_wp_error( $result ) ) {
-            $validation_errors->add( 'spamoff_bot_protection_error', $result->get_error_message() );
-        }
-    }
-
-    public function validate_checkout() {
-        if ( ! SpamOff_Bot_Protection_Helper::is_form_enabled( 'checkout' ) ) {
+            $validation_error->add( 'spamoff_bot_protection_error', $result->get_error_message() );
+        }
+
+        return $validation_error;
+    }
+
+    /**
+     * Classic checkout. Runs after WooCommerce's own field validation: Google tokens are
+     * single-use, so spending one on an order that fails for another reason would make
+     * the customer's corrected retry fail verification too.
+     *
+     * @param array    $data   Posted checkout data.
+     * @param WP_Error $errors Checkout validation errors.
+     */
+    public function validate_checkout( $data, $errors ) {
+        if ( ! Helper::is_checkout_protected() || ! $this->should_validate( 'checkout' ) ) {
+            return;
+        }
+
+        if ( $errors->has_errors() || wc_notice_count( 'error' ) > 0 ) {
             return;
         }
@@ -139 +177 @@
         $result = $this->validate_captcha( 'checkout' );
         if ( is_wp_error( $result ) ) {
-            wc_add_notice( $result->get_error_message(), 'error' );
-        }
-    }
-
-    public function validate_lost_password() {
-        if ( ! SpamOff_Bot_Protection_Helper::is_form_enabled( 'lost_password' ) ) {
-            return;
-        }
-
-        $result = $this->validate_captcha( 'lost_password' );
-        if ( is_wp_error( $result ) ) {
-            wc_add_notice( $result->get_error_message(), 'error' );
-        }
+            $errors->add( 'spamoff_bot_protection_error', $result->get_error_message() );
+        }
+    }
+
+    /**
+     * Both lost-password forms fire core's `lostpassword_post`: WooCommerce's (identified by
+     * its hidden `wc_reset_password` field) and wp-login.php's. Each has its own toggle.
+     * Other callers, such as an admin sending a reset link from the Users screen, have no
+     * captcha and are left alone. The reset only stops when the error is added to `$errors`.
+     *
+     * @param WP_Error      $errors    Errors that stop the reset email.
+     * @param WP_User|false $user_data User requesting the reset, if found.
+     */
+    public function validate_lost_password( $errors, $user_data = false ) {
+        if ( ! is_wp_error( $errors ) ) {
+            return;
+        }
+
+        // phpcs:ignore WordPress.Security.NonceVerification.Missing -- Presence check only; validate_captcha() verifies the form nonce.
+        if ( isset( $_POST['wc_reset_password'] ) ) {
+            if ( ! Helper::is_form_protected( 'lost_password' ) || ! $this->should_validate( 'lost_password' ) ) {
+                return;
+            }
+            $result = $this->validate_captcha( 'lost_password' );
+        } elseif ( did_action( 'login_form_lostpassword' ) || did_action( 'login_form_retrievepassword' ) ) {
+            if ( ! Helper::is_form_protected( 'wp_lost_password' ) || ! $this->should_validate( 'wp_lost_password' ) ) {
+                return;
+            }
+            // wp-login.php's form has no nonce; the captcha is the check.
+            $result = self::verify_posted_captcha( 'wp_lost_password' );
+        } else {
+            return;
+        }
+
+        if ( is_wp_error( $result ) ) {
+            $errors->add( 'spamoff_bot_protection_error', $result->get_error_message() );
+        }
+    }
+
+    /**
+     * wp-login.php login. `authenticate` also runs for XML-RPC, application passwords,
+     * WooCommerce's login and other plugins calling wp_signon(); none of those carry this
+     * captcha, so only the wp-login.php login action is checked.
+     *
+     * @param WP_User|WP_Error|null $user Result of the earlier authentication checks.
+     * @return WP_User|WP_Error|null
+     */
+    public function validate_wp_login( $user ) {
+        // wp-login.php also runs authentication when the form is first displayed (GET).
+        // phpcs:ignore WordPress.Security.NonceVerification.Missing -- Presence check only; wp-login.php's form has no nonce.
+        if ( ! did_action( 'login_form_login' ) || ! isset( $_POST['log'] ) ) {
+            return $user;
+        }
+
+        if ( ! Helper::is_form_protected( 'wp_login' ) || ! $this->should_validate( 'wp_login' ) ) {
+            return $user;
+        }
+
+        $result = self::verify_posted_captcha( 'wp_login' );
+        if ( is_wp_error( $result ) ) {
+            return new WP_Error( 'spamoff_bot_protection_error', $result->get_error_message() );
+        }
+
+        return $user;
+    }
+
+    /**
+     * wp-login.php registration. `registration_errors` also fires when other plugins call
+     * register_new_user(), so only the wp-login.php register action is checked.
+     *
+     * @param WP_Error $errors Registration errors.
+     * @return WP_Error
+     */
+    public function validate_wp_registration( $errors ) {
+        if ( ! did_action( 'login_form_register' ) || ! is_wp_error( $errors ) ) {
+            return $errors;
+        }
+
+        if ( ! Helper::is_form_protected( 'wp_registration' ) || ! $this->should_validate( 'wp_registration' ) ) {
+            return $errors;
+        }
+
+        // wp-login.php's form has no nonce; the captcha is the check.
+        $result = self::verify_posted_captcha( 'wp_registration' );
+        if ( is_wp_error( $result ) ) {
+            $errors->add( 'spamoff_bot_protection_error', $result->get_error_message() );
+        }
+
+        return $errors;
     }
 
     public function validate_comment( $post_id ) {
-        if ( ! SpamOff_Bot_Protection_Helper::is_form_enabled( 'comments' ) ) {
-            return;
-        }
-
-        $result = $this->validate_captcha( 'comments' );
+        if ( ! Helper::is_form_protected( 'comments' ) || ! $this->should_validate( 'comments' ) ) {
+            return;
+        }
+
+        // WordPress core puts no nonce on the comment form for visitors, so the
+        // captcha itself is the check here.
+        $result = self::verify_posted_captcha( 'comments' );
         if ( is_wp_error( $result ) ) {
             wp_die(
                 esc_html( $result->get_error_message() ),
                 esc_html__( 'Comment Submission Error', 'spamoff-bot-protection' ),
-                array( 'back_link' => true )
+                array(
+                    'response'  => 403,
+                    'back_link' => true,
+                )
             );
         }
@@ -170 +289 @@
 
     /**
-     * Verify a captcha submission for a classic (non-Blocks) form.
-     *
-     * Always returns either WP_Error or true — never bare false — so callers
-     * can rely on is_wp_error() to decide whether to block the submission.
+     * Describe the Blocks Checkout's extension data so the Store API validates and
+     * sanitizes it.
+     */
+    public function register_store_api_data() {
+        if ( ! function_exists( 'woocommerce_store_api_register_endpoint_data' ) || ! class_exists( CheckoutSchema::class ) ) {
+            return;
+        }
+
+        woocommerce_store_api_register_endpoint_data(
+            array(
+                'endpoint'        => CheckoutSchema::IDENTIFIER,
+                'namespace'       => self::STORE_API_NAMESPACE,
+                'schema_callback' => array( $this, 'get_store_api_schema' ),
+            )
+        );
+    }
+
+    public function get_store_api_schema() {
+        $sanitize = function ( $value ) {
+            return is_string( $value ) ? sanitize_text_field( $value ) : '';
+        };
+
+        return array(
+            'token'  => array(
+                'description' => __( 'reCAPTCHA v3 token for the checkout.', 'spamoff-bot-protection' ),
+                'type'        => array( 'string', 'null' ),
+                'context'     => array(),
+                'arg_options' => array( 'sanitize_callback' => $sanitize ),
+            ),
+            'action' => array(
+                'description' => __( 'reCAPTCHA v3 action the token was created for.', 'spamoff-bot-protection' ),
+                'type'        => array( 'string', 'null' ),
+                'context'     => array(),
+                'arg_options' => array( 'sanitize_callback' => $sanitize ),
+            ),
+        );
+    }
+
+    /**
+     * Validate the captcha for a Store API checkout (the Checkout block, or anything
+     * else posting to /wc/store/v1/checkout).
+     *
+     * The Blocks JS writes the token with setExtensionData('spamoff-bot-protection', { token, action }).
+     *
+     * @param WC_Order        $order   Order being placed.
+     * @param WP_REST_Request $request Store API request.
+     * @throws RouteException When the captcha is missing or fails.
+     */
+    public function validate_blocks_checkout( $order, $request ) {
+        // Only when the order is placed. WooCommerce also fires this hook on the PUT sent
+        // while a customer edits a failed order; a token spent there would be rejected as
+        // a duplicate when they place the order.
+        if ( 'POST' !== $request->get_method() ) {
+            return;
+        }
+
+        if ( ! Helper::is_checkout_enabled_for_current_user() || ! $this->should_validate( 'checkout' ) ) {
+            return;
+        }
+
+        if ( ! Helper::has_keys( 'v3' ) ) {
+            /**
+             * Filters whether Store API checkouts are rejected while checkout protection is
+             * on but no reCAPTCHA v3 keys are saved.
+             *
+             * The Store API only supports v3. Rejecting keeps bots from bypassing a v2-protected
+             * classic checkout by posting to the Store API directly.
+             *
+             * @since 1.1.0
+             *
+             * @param bool $reject Default true.
+             */
+            if ( apply_filters( 'spamoff_bot_protection_store_api_requires_v3_keys', true ) ) {
+                throw new RouteException(
+                    'spamoff_bot_protection_not_configured',
+                    esc_html( Helper::get_error_message( 'failed' ) ),
+                    400
+                );
+            }
+            return;
+        }
+
+        $extensions = $request->get_param( 'extensions' );
+        $data       = is_array( $extensions ) && isset( $extensions[ self::STORE_API_NAMESPACE ] ) && is_array( $extensions[ self::STORE_API_NAMESPACE ] )
+            ? $extensions[ self::STORE_API_NAMESPACE ]
+            : array();
+
+        $token = isset( $data['token'] ) && is_string( $data['token'] ) ? sanitize_text_field( $data['token'] ) : '';
+
+        if ( '' === $token ) {
+            throw new RouteException(
+                'spamoff_bot_protection_missing',
+                esc_html( Helper::get_error_message( 'missing' ) ),
+                400
+            );
+        }
+
+        $result = Helper::verify_recaptcha( $token, 'v3', 'checkout' );
+
+        if ( empty( $result['success'] ) ) {
+            $error_type = isset( $result['error'] ) ? $result['error'] : 'failed';
+            throw new RouteException(
+                'spamoff_bot_protection_failed',
+                esc_html( Helper::get_error_message( $error_type ) ),
+                400
+            );
+        }
+    }
+
+    /**
+     * Check the WooCommerce form's nonce, then the posted captcha.
+     *
+     * WooCommerce has already verified the nonce before these hooks fire; checking it
+     * again fails closed if another plugin calls the hooks outside the real form handler.
      */
     private function validate_captcha( $action ) {
-        $nonce_error = new WP_Error( 'spamoff_bot_protection_nonce_invalid', SpamOff_Bot_Protection_Helper::get_error_message( 'failed' ) );
-
-        // Re-verify the upstream form nonce. Failing closed (WP_Error) prevents
-        // a bypass of WC/WP's own nonce check from silently letting us through.
-        switch ( $action ) {
-            case 'checkout':
-                if ( ! isset( $_POST['woocommerce-process-checkout-nonce'] ) ) {
-                    return $nonce_error;
-                }
-                $nonce = sanitize_text_field( wp_unslash( $_POST['woocommerce-process-checkout-nonce'] ) );
-                if ( ! wp_verify_nonce( $nonce, 'woocommerce-process_checkout' ) ) {
-                    return $nonce_error;
-                }
-                break;
-
-            case 'login':
-                if ( ! isset( $_POST['woocommerce-login-nonce'] ) ) {
-                    return $nonce_error;
-                }
-                $nonce = sanitize_text_field( wp_unslash( $_POST['woocommerce-login-nonce'] ) );
-                if ( ! wp_verify_nonce( $nonce, 'woocommerce-login' ) ) {
-                    return $nonce_error;
-                }
-                break;
-
-            case 'registration':
-                if ( ! isset( $_POST['woocommerce-register-nonce'] ) ) {
-                    return $nonce_error;
-                }
-                $nonce = sanitize_text_field( wp_unslash( $_POST['woocommerce-register-nonce'] ) );
-                if ( ! wp_verify_nonce( $nonce, 'woocommerce-register' ) ) {
-                    return $nonce_error;
-                }
-                break;
-
-            case 'lost_password':
-                if ( ! isset( $_POST['woocommerce-lost-password-nonce'] ) ) {
-                    return $nonce_error;
-                }
-                $nonce = sanitize_text_field( wp_unslash( $_POST['woocommerce-lost-password-nonce'] ) );
-                if ( ! wp_verify_nonce( $nonce, 'lost_password' ) ) {
-                    return $nonce_error;
-                }
-                break;
-
-            case 'comments':
-                if ( isset( $_POST['_wp_unfiltered_html_comment'], $_POST['comment_post_ID'] ) ) {
-                    $post_id = absint( $_POST['comment_post_ID'] );
-                    $nonce   = sanitize_text_field( wp_unslash( $_POST['_wp_unfiltered_html_comment'] ) );
-                    if ( ! wp_verify_nonce( $nonce, 'unfiltered-html-comment_' . $post_id ) ) {
-                        return $nonce_error;
-                    }
-                } elseif ( isset( $_POST['_wpnonce'], $_POST['comment_post_ID'] ) ) {
-                    $post_id = absint( $_POST['comment_post_ID'] );
-                    $nonce   = sanitize_text_field( wp_unslash( $_POST['_wpnonce'] ) );
-                    if ( ! wp_verify_nonce( $nonce, 'comment-post_' . $post_id ) ) {
-                        return $nonce_error;
-                    }
-                } else {
-                    return $nonce_error;
-                }
-                break;
-
-            default:
-                return $nonce_error;
-        }
-
-        $recaptcha_type = SpamOff_Bot_Protection_Helper::get_option( 'spamoff_bot_protection_type', 'v3' );
-
-        if ( 'v3' === $recaptcha_type ) {
-            $token        = isset( $_POST['spamoff_bot_protection_token'] )
-                ? sanitize_text_field( wp_unslash( $_POST['spamoff_bot_protection_token'] ) )
-                : '';
-            $action_param = isset( $_POST['spamoff_bot_protection_action'] )
-                ? sanitize_text_field( wp_unslash( $_POST['spamoff_bot_protection_action'] ) )
-                : $action;
+        if ( ! $this->verify_form_nonce( $action ) ) {
+            return new WP_Error( 'spamoff_bot_protection_nonce_invalid', Helper::get_error_message( 'failed' ) );
+        }
+
+        return self::verify_posted_captcha( $action );
+    }
+
+    private function verify_form_nonce( $action ) {
+        $nonces = array(
+            'checkout'      => array( 'woocommerce-process-checkout-nonce', 'woocommerce-process_checkout' ),
+            'login'         => array( 'woocommerce-login-nonce', 'woocommerce-login' ),
+            'registration'  => array( 'woocommerce-register-nonce', 'woocommerce-register' ),
+            'lost_password' => array( 'woocommerce-lost-password-nonce', 'lost_password' ),
+        );
+
+        if ( ! isset( $nonces[ $action ] ) ) {
+            return false;
+        }
+
+        list( $field, $nonce_action ) = $nonces[ $action ];
+
+        // WooCommerce templates older than 3.3 used the generic `_wpnonce` field.
+        if ( isset( $_POST[ $field ] ) ) {
+            $nonce = sanitize_text_field( wp_unslash( $_POST[ $field ] ) );
+        } elseif ( isset( $_POST['_wpnonce'] ) ) {
+            $nonce = sanitize_text_field( wp_unslash( $_POST['_wpnonce'] ) );
         } else {
-            $token        = isset( $_POST['g-recaptcha-response'] )
-                ? sanitize_text_field( wp_unslash( $_POST['g-recaptcha-response'] ) )
-                : '';
-            $action_param = '';
-        }
-
-        if ( empty( $token ) ) {
-            return new WP_Error( 'spamoff_bot_protection_missing', SpamOff_Bot_Protection_Helper::get_error_message( 'missing' ) );
-        }
-
-        $result = SpamOff_Bot_Protection_Helper::verify_recaptcha( $token, $action_param );
-
-        if ( empty( $result['success'] ) || true !== $result['success'] ) {
+            return false;
+        }
+
+        return false !== wp_verify_nonce( $nonce, $nonce_action );
+    }
+
+    /**
+     * Verify the captcha response posted with the current request.
+     *
+     * Callers must check the form's own nonce first, where the form has one.
+     *
+     * @param string $action Form action; for v3 the token must have been created for it.
+     * @return true|WP_Error
+     */
+    public static function verify_posted_captcha( $action ) {
+        $type   = Helper::get_type();
+        $action = Helper::sanitize_action( $action );
+
+        // phpcs:disable WordPress.Security.NonceVerification.Missing -- Callers verify the form nonce; core's comment form has none.
+        $field = 'v3' === $type ? 'spamoff_bot_protection_token' : 'g-recaptcha-response';
+        $token = isset( $_POST[ $field ] ) && is_string( $_POST[ $field ] ) ? sanitize_text_field( wp_unslash( $_POST[ $field ] ) ) : '';
+        // phpcs:enable WordPress.Security.NonceVerification.Missing
+
+        if ( '' === $token ) {
+            return new WP_Error( 'spamoff_bot_protection_missing', Helper::get_error_message( 'missing' ) );
+        }
+
+        $result = Helper::verify_recaptcha( $token, $type, 'v3' === $type ? $action : '' );
+
+        if ( empty( $result['success'] ) ) {
             $error_type = isset( $result['error'] ) ? $result['error'] : 'failed';
-            return new WP_Error( 'spamoff_bot_protection_failed', SpamOff_Bot_Protection_Helper::get_error_message( $error_type ) );
+            return new WP_Error( 'spamoff_bot_protection_failed', Helper::get_error_message( $error_type ) );
         }
 
@@ -274 +470 @@
 
     /**
+     * Lets developers skip validation in special cases, such as an express-payment
+     * button that places orders without the checkout form.
+     */
+    private function should_validate( $form ) {
+        /**
+         * Filters whether the captcha is checked for a form submission.
+         *
+         * @since 1.1.0
+         *
+         * @param bool   $should_validate Default true.
+         * @param string $form            wp_login, wp_registration, wp_lost_password, comments, login,
+         *                                registration, lost_password or checkout.
+         */
+        return (bool) apply_filters( 'spamoff_bot_protection_should_validate', true, $form );
+    }
+
+    /**
      * Render the captcha markup for a given action.
      *
-     * For v3 this is hidden inputs that the JS populates with a token.
-     * For v2 it's the standard `g-recaptcha` div that Google's script auto-renders.
+     * For v3 this is a hidden input that the JS fills with a token on submit.
+     * For v2 it's a `g-recaptcha` div that the JS renders explicitly.
      */
     public function render_captcha( $action = 'general', $id_suffix = '' ) {
-        $recaptcha_type = SpamOff_Bot_Protection_Helper::get_option( 'spamoff_bot_protection_type', 'v3' );
-        $site_key       = SpamOff_Bot_Protection_Helper::get_option( 'spamoff_bot_protection_site_key' );
-        $customization  = SpamOff_Bot_Protection_Helper::get_option( 'spamoff_bot_protection_customization', array() );
-
-        if ( empty( $site_key ) ) {
-            return;
-        }
-
-        $render_key = $action . ( $id_suffix ? '_' . $id_suffix : '' );
-        if ( isset( self::$rendered_actions[ $render_key ] ) ) {
-            return;
-        }
-        self::$rendered_actions[ $render_key ] = true;
-
-        $id = $action . ( $id_suffix ? '_' . $id_suffix : '' );
-
-        if ( 'v3' === $recaptcha_type ) {
+        $type     = Helper::get_type();
+        $site_key = Helper::get_site_key( $type );
+
+        if ( '' === $site_key ) {
+            return;
+        }
+
+        // Several forms of one kind can share a page (e.g. a theme's header login box on
+        // the My Account page), so every call renders a captcha with its own ID. If a hook
+        // fires twice inside one form, the handler keeps only the first captcha.
+        $action = Helper::sanitize_action( $action );
+        $base   = $action . ( $id_suffix ? '_' . $id_suffix : '' );
+
+        self::$render_counts[ $base ] = isset( self::$render_counts[ $base ] ) ? self::$render_counts[ $base ] + 1 : 1;
+
+        $count = self::$render_counts[ $base ];
+        $id    = sanitize_html_class( 1 === $count ? $base : $base . '_' . $count );
+
+        SpamOff_Bot_Protection_Captcha::require_type( $type );
+
+        if ( 'v3' === $type ) {
             echo '<div class="spamoff-bot-protection-container spamoff-bot-protection-v3" data-action="' . esc_attr( $action ) . '">';
             echo '<input type="hidden" name="spamoff_bot_protection_token" id="spamoff_bot_protection_token_' . esc_attr( $id ) . '" value="">';
-            echo '<input type="hidden" name="spamoff_bot_protection_action" value="' . esc_attr( $action ) . '">';
+            if ( $this->is_badge_hidden() ) {
+                $this->render_google_notice();
+            }
             echo '</div>';
-        } elseif ( 'v2' === $recaptcha_type ) {
-            $theme = isset( $customization['v2_theme'] ) ? $customization['v2_theme'] : 'light';
-            $size  = isset( $customization['v2_size'] ) ? $customization['v2_size'] : 'normal';
-
-            echo '<div class="spamoff-bot-protection-container spamoff-bot-protection-v2" data-action="' . esc_attr( $action ) . '" style="display: block !important; visibility: visible !important;">';
-            echo '<div class="g-recaptcha" data-sitekey="' . esc_attr( $site_key ) . '" data-theme="' . esc_attr( $theme ) . '" data-size="' . esc_attr( $size ) . '" data-spamoff-bot-protection-id="' . esc_attr( $id ) . '" style="display: inline-block !important;"></div>';
-            echo '</div>';
-        }
+            return;
+        }
+
+        $customization = Helper::get_option( 'spamoff_bot_protection_customization', array() );
+        $theme         = is_array( $customization ) && isset( $customization['v2_theme'] ) && 'dark' === $customization['v2_theme'] ? 'dark' : 'light';
+        $size          = is_array( $customization ) && isset( $customization['v2_size'] ) && 'compact' === $customization['v2_size'] ? 'compact' : 'normal';
+
+        echo '<div class="spamoff-bot-protection-container spamoff-bot-protection-v2" data-action="' . esc_attr( $action ) . '">';
+        echo '<div class="g-recaptcha" id="spamoff_bot_protection_widget_' . esc_attr( $id ) . '" data-sitekey="' . esc_attr( $site_key ) . '" data-theme="' . esc_attr( $theme ) . '" data-size="' . esc_attr( $size ) . '"></div>';
+        echo '</div>';
+    }
+
+    private function is_badge_hidden() {
+        $customization = Helper::get_option( 'spamoff_bot_protection_customization', array() );
+        return is_array( $customization ) && isset( $customization['hide_v3_badge'] ) && 'yes' === $customization['hide_v3_badge'];
+    }
+
+    /**
+     * Google allows hiding the v3 badge only if this notice appears in the user flow.
+     */
+    private function render_google_notice() {
+        echo '<p class="spamoff-bot-protection-notice">';
+        echo wp_kses(
+            sprintf(
+                /* translators: 1: Google Privacy Policy URL, 2: Google Terms of Service URL. */
+                __( 'This site is protected by reCAPTCHA and the Google <a href="%1$s" target="_blank" rel="noopener noreferrer">Privacy Policy</a> and <a href="%2$s" target="_blank" rel="noopener noreferrer">Terms of Service</a> apply.', 'spamoff-bot-protection' ),
+                'https://policies.google.com/privacy',
+                'https://policies.google.com/terms'
+            ),
+            array(
+                'a' => array(
+                    'href'   => array(),
+                    'target' => array(),
+                    'rel'    => array(),
+                ),
+            )
+        );
+        echo '</p>';
     }
 
     public function shortcode( $atts ) {
-        $atts   = shortcode_atts( array( 'action' => 'general' ), $atts, 'spamoff_bot_protection' );
-        $action = $atts['action'];
-
-        // SpamOff_Bot_Protection_Captcha::enqueue_scripts has already registered the real handles
-        // on wp_enqueue_scripts; nudge them in case the shortcode is the only consumer.
-        wp_enqueue_script( 'spamoff-bot-protection-api' );
-        wp_enqueue_script( 'spamoff-bot-protection-handler' );
-        wp_enqueue_style( 'spamoff-bot-protection-style' );
+        $atts = shortcode_atts( array( 'action' => 'general' ), $atts, 'spamoff_bot_protection' );
+
+        if ( ! Helper::has_keys() ) {
+            return '';
+        }
 
         ob_start();
-        $this->render_captcha( $action );
+        $this->render_captcha( $atts['action'] );
         return ob_get_clean();
     }

spamoff-bot-protection/tags/1.0.0/includes/class-spamoff-bot-protection-helper.php

@@ -6 +6 @@
 class SpamOff_Bot_Protection_Helper {
 
+    /** Supported reCAPTCHA versions. Each keeps its own key pair. */
+    const TYPES = array( 'v3', 'v2' );
+
+    /** Forms that can be toggled under Advanced Settings. The wp_* keys are WordPress's own wp-login.php forms. */
+    const FORMS = array( 'wp_login', 'wp_registration', 'wp_lost_password', 'comments', 'login', 'registration', 'lost_password', 'checkout', 'guest_checkout' );
+
     public static function get_option( $key, $default = '' ) {
         return get_option( $key, $default );
+    }
+
+    /**
+     * The reCAPTCHA version selected in General Settings.
+     */
+    public static function get_type() {
+        $type = self::get_option( 'spamoff_bot_protection_type', 'v3' );
+        return in_array( $type, self::TYPES, true ) ? $type : 'v3';
+    }
+
+    public static function get_site_key( $type = null ) {
+        $type = self::normalize_type( $type );
+        return trim( (string) self::get_option( 'spamoff_bot_protection_' . $type . '_site_key', '' ) );
+    }
+
+    public static function get_secret_key( $type = null ) {
+        $type = self::normalize_type( $type );
+        return trim( (string) self::get_option( 'spamoff_bot_protection_' . $type . '_secret_key', '' ) );
+    }
+
+    /**
+     * Both keys for a version are saved. Without them the captcha can't render or
+     * verify, so forms are left unprotected rather than locking every visitor out.
+     */
+    public static function has_keys( $type = null ) {
+        return '' !== self::get_site_key( $type ) && '' !== self::get_secret_key( $type );
     }
 
@@ -16 +48 @@
 
     /**
-     * Check if reCAPTCHA is enabled for a given form key (login, checkout, …).
+     * Check if reCAPTCHA is switched on for a given form key (login, checkout, …).
      */
     public static function is_form_enabled( $form ) {
@@ -24 +56 @@
 
     /**
+     * Switched on and usable with the selected version's keys.
+     */
+    public static function is_form_protected( $form ) {
+        return self::is_form_enabled( $form ) && self::has_keys();
+    }
+
+    /**
+     * Whether the current checkout needs a captcha, before looking at keys.
+     *
+     * "Checkout" covers every customer; "Guest Checkout" covers only visitors who
+     * aren't logged in.
+     */
+    public static function is_checkout_enabled_for_current_user() {
+        if ( self::is_form_enabled( 'checkout' ) ) {
+            return true;
+        }
+        return self::is_form_enabled( 'guest_checkout' ) && ! is_user_logged_in();
+    }
+
+    /**
+     * Classic checkout protection, using the selected version.
+     */
+    public static function is_checkout_protected() {
+        return self::is_checkout_enabled_for_current_user() && self::has_keys();
+    }
+
+    /**
      * Verify a reCAPTCHA token with Google's siteverify endpoint.
-     */
-    public static function verify_recaptcha( $token, $action = '' ) {
-        $secret_key = self::get_option( 'spamoff_bot_protection_secret_key' );
-
-        if ( empty( $secret_key ) || empty( $token ) ) {
+     *
+     * @param string      $token           Token (v3) or g-recaptcha-response (v2) from the client.
+     * @param string|null $type            'v3' or 'v2'; defaults to the selected version.
+     * @param string      $expected_action v3 action the token must have been created for. Empty skips the check.
+     * @return array Google's response with `success` => true, or `success` => false and an `error` code.
+     */
+    public static function verify_recaptcha( $token, $type = null, $expected_action = '' ) {
+        $type       = self::normalize_type( $type );
+        $secret_key = self::get_secret_key( $type );
+
+        if ( '' === $secret_key ) {
             return array(
                 'success' => false,
                 'error'   => 'missing_credentials',
             );
+        }
+
+        if ( empty( $token ) ) {
+            return array(
+                'success' => false,
+                'error'   => 'missing',
+            );
+        }
+
+        $body = array(
+            'secret'   => $secret_key,
+            'response' => $token,
+        );
+
+        $remote_ip = self::get_user_ip();
+        if ( '' !== $remote_ip ) {
+            $body['remoteip'] = $remote_ip;
         }
 
@@ -39 +121 @@
             'https://www.google.com/recaptcha/api/siteverify',
             array(
-                'body'    => array(
-                    'secret'   => $secret_key,
-                    'response' => $token,
-                    'remoteip' => self::get_user_ip(),
-                ),
+                'body'    => $body,
                 'timeout' => 10,
             )
@@ -56 +134 @@
         }
 
-        $body = wp_remote_retrieve_body( $response );
-        $data = json_decode( $body, true );
+        $data = json_decode( wp_remote_retrieve_body( $response ), true );
 
         if ( ! is_array( $data ) ) {
@@ -67 +144 @@
 
         if ( ! isset( $data['success'] ) || true !== $data['success'] ) {
-            $error_codes = isset( $data['error-codes'] ) ? $data['error-codes'] : array( 'unknown_error' );
             return array(
                 'success'     => false,
                 'error'       => 'verification_failed',
-                'error_codes' => $error_codes,
-            );
-        }
-
-        // For v3, enforce the configured minimum score.
-        $recaptcha_type = self::get_option( 'spamoff_bot_protection_type', 'v3' );
-        if ( 'v3' === $recaptcha_type ) {
+                'error_codes' => isset( $data['error-codes'] ) ? (array) $data['error-codes'] : array( 'unknown_error' ),
+            );
+        }
+
+        // The token must have been issued for this site, not harvested from another one.
+        if ( ! empty( $data['hostname'] ) && ! in_array( strtolower( $data['hostname'] ), self::get_allowed_hostnames(), true ) ) {
+            return array(
+                'success'  => false,
+                'error'    => 'hostname_mismatch',
+                'hostname' => $data['hostname'],
+            );
+        }
+
+        if ( 'v3' === $type ) {
+            // A token minted for one form (e.g. comments) must not unlock another (e.g. checkout).
+            if ( '' !== $expected_action && isset( $data['action'] ) && $data['action'] !== $expected_action ) {
+                return array(
+                    'success' => false,
+                    'error'   => 'action_mismatch',
+                    'action'  => $data['action'],
+                );
+            }
+
             $score         = isset( $data['score'] ) ? floatval( $data['score'] ) : 0.0;
             $minimum_score = self::sanitize_score( self::get_option( 'spamoff_bot_protection_minimum_score', '0.5' ) );
@@ -97 +189 @@
 
     /**
-     * Resolve the visitor's IP, preferring proxy headers when present.
+     * Hostnames Google may report for a valid token on this site.
+     */
+    public static function get_allowed_hostnames() {
+        $hosts = array();
+        foreach ( array( home_url(), site_url() ) as $url ) {
+            $host = wp_parse_url( $url, PHP_URL_HOST );
+            if ( $host ) {
+                $host    = strtolower( $host );
+                $hosts[] = $host;
+                $hosts[] = 0 === strpos( $host, 'www.' ) ? substr( $host, 4 ) : 'www.' . $host;
+            }
+        }
+
+        // Google's published test keys report this hostname.
+        $hosts[] = 'testkey.google.com';
+
+        /**
+         * Filters the hostnames accepted in Google's verification response.
+         *
+         * Add every domain the protected forms are served from, e.g. for multi-domain setups.
+         *
+         * @since 1.1.0
+         *
+         * @param string[] $hosts Lowercase hostnames.
+         */
+        $hosts = apply_filters( 'spamoff_bot_protection_allowed_hostnames', $hosts );
+
+        return array_values( array_unique( array_map( 'strtolower', (array) $hosts ) ) );
+    }
+
+    /**
+     * The visitor's IP address, sent to Google as an optional hint.
+     *
+     * Only REMOTE_ADDR is trusted: proxy headers can be forged by the client. Sites
+     * behind a trusted proxy or CDN can supply the real address through the filter.
      */
     public static function get_user_ip() {
-        $ip_keys = array( 'HTTP_CLIENT_IP', 'HTTP_X_FORWARDED_FOR', 'REMOTE_ADDR' );
-
-        foreach ( $ip_keys as $key ) {
-            if ( isset( $_SERVER[ $key ] ) ) {
-                foreach ( explode( ',', sanitize_text_field( wp_unslash( $_SERVER[ $key ] ) ) ) as $ip ) {
-                    $ip = trim( $ip );
-                    if ( filter_var( $ip, FILTER_VALIDATE_IP, FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE ) !== false ) {
-                        return $ip;
-                    }
-                }
-            }
-        }
-
-        return isset( $_SERVER['REMOTE_ADDR'] ) ? sanitize_text_field( wp_unslash( $_SERVER['REMOTE_ADDR'] ) ) : '';
+        $ip = isset( $_SERVER['REMOTE_ADDR'] ) ? sanitize_text_field( wp_unslash( $_SERVER['REMOTE_ADDR'] ) ) : '';
+
+        /**
+         * Filters the visitor IP address sent to Google's siteverify endpoint.
+         *
+         * @since 1.1.0
+         *
+         * @param string $ip IP address from REMOTE_ADDR.
+         */
+        $ip = (string) apply_filters( 'spamoff_bot_protection_remote_ip', $ip );
+
+        return false !== filter_var( $ip, FILTER_VALIDATE_IP ) ? $ip : '';
     }
 
     /**
      * Get the error message shown to the user for a given failure type.
+     *
+     * The customizable message covers failed checks; a missing captcha keeps its own
+     * wording so v2 users know they still need to tick the box.
      */
     public static function get_error_message( $error_type = 'failed' ) {
+        if ( 'missing' === $error_type ) {
+            return __( 'Please complete the verification.', 'spamoff-bot-protection' );
+        }
+
         $customization = self::get_option( 'spamoff_bot_protection_customization', array() );
 
-        if ( isset( $customization['error_message_failed'] ) && '' !== $customization['error_message_failed'] ) {
+        if ( is_array( $customization ) && isset( $customization['error_message_failed'] ) && '' !== $customization['error_message_failed'] ) {
             return $customization['error_message_failed'];
         }
 
-        $messages = array(
-            'failed'    => __( 'Verification failed. Please try again.', 'spamoff-bot-protection' ),
-            'missing'   => __( 'Please complete the verification.', 'spamoff-bot-protection' ),
-            'low_score' => __( 'Verification failed. Please try again.', 'spamoff-bot-protection' ),
-        );
-
-        return isset( $messages[ $error_type ] ) ? $messages[ $error_type ] : $messages['failed'];
-    }
-
-    /**
-     * Check if the current request is rendering the WooCommerce Blocks Checkout.
-     */
-    public static function is_blocks_checkout() {
-        if ( ! function_exists( 'has_block' ) ) {
+        return __( 'Verification failed. Please try again.', 'spamoff-bot-protection' );
+    }
+
+    /**
+     * Whether the page configured as the WooCommerce checkout uses the Checkout block.
+     *
+     * Used for admin warnings only; the front end detects the block as it renders.
+     */
+    public static function checkout_page_uses_blocks() {
+        if ( ! function_exists( 'has_block' ) || ! function_exists( 'wc_get_page_id' ) ) {
             return false;
         }
-        // Check the configured checkout page directly — more reliable than the global
-        // $post during wp_enqueue_scripts, where some caching plugins may not set it.
-        $checkout_page_id = function_exists( 'wc_get_page_id' ) ? wc_get_page_id( 'checkout' ) : 0;
-        if ( $checkout_page_id > 0 ) {
-            return has_block( 'woocommerce/checkout', $checkout_page_id );
-        }
-        return has_block( 'woocommerce/checkout' );
+        $checkout_page_id = wc_get_page_id( 'checkout' );
+        return $checkout_page_id > 0 && has_block( 'woocommerce/checkout', $checkout_page_id );
+    }
+
+    /**
+     * Google action names allow only letters, numbers, slashes and underscores.
+     */
+    public static function sanitize_action( $action ) {
+        $action = preg_replace( '/[^A-Za-z0-9_\/]/', '_', (string) $action );
+        return '' === $action ? 'general' : $action;
+    }
+
+    private static function normalize_type( $type ) {
+        return in_array( $type, self::TYPES, true ) ? $type : self::get_type();
     }
 }
+
+if ( ! function_exists( 'spamoff_bot_protection_verify_submission' ) ) {
+    /**
+     * Verify the captcha posted by a custom form that uses the [spamoff_bot_protection] shortcode.
+     *
+     * Call it from the form's own submission handler, after checking the form's nonce.
+     *
+     * @since 1.1.0
+     *
+     * @param string $action The `action` attribute given to the shortcode (default "general").
+     * @return true|WP_Error True when verified, WP_Error with a user-facing message otherwise.
+     */
+    function spamoff_bot_protection_verify_submission( $action = 'general' ) {
+        return SpamOff_Bot_Protection_Frontend::verify_posted_captcha( $action );
+    }
+}

spamoff-bot-protection/tags/1.0.0/includes/class-spamoff-bot-protection-settings.php

@@ -4 +4 @@
 }
 
+use SpamOff_Bot_Protection_Helper as Helper;
+
 class SpamOff_Bot_Protection_Settings {
 
@@ -32 +34 @@
         $this->output_settings_tabs();
         echo '</div>';
+
+        $this->output_configuration_notices();
 
         echo '<div class="spamoff-bot-protection-settings-content">';
@@ -61 +65 @@
     }
 
+    /**
+     * Warn about settings that leave forms unprotected or would reject orders.
+     */
+    private function output_configuration_notices() {
+        $notices = array();
+        $type    = Helper::get_type();
+        $forms   = get_option( 'spamoff_bot_protection_forms', array() );
+        $any_on  = is_array( $forms ) && in_array( 'yes', $forms, true );
+
+        if ( $any_on && ! Helper::has_keys( $type ) ) {
+            $notices[] = sprintf(
+                /* translators: %s: reCAPTCHA version, e.g. v3. */
+                __( 'Protection is off: add the reCAPTCHA %s Site Key and Secret Key under General Settings.', 'spamoff-bot-protection' ),
+                $type
+            );
+        }
+
+        $checkout_on = Helper::is_form_enabled( 'checkout' ) || Helper::is_form_enabled( 'guest_checkout' );
+        if ( $checkout_on && ! Helper::has_keys( 'v3' ) && Helper::checkout_page_uses_blocks() ) {
+            $notices[] = __( 'Your checkout page uses the Checkout block, which only supports reCAPTCHA v3. Orders placed there are rejected until you save v3 keys. Select v3 under General Settings to enter them; they stay saved if you switch back to v2.', 'spamoff-bot-protection' );
+        }
+
+        foreach ( $notices as $notice ) {
+            echo '<div class="notice notice-warning inline"><p>' . esc_html( $notice ) . '</p></div>';
+        }
+    }
+
     public function output_settings_content( $section ) {
         switch ( $section ) {
@@ -96 +127 @@
     }
 
+    /**
+     * Each version keeps its own key pair, so switching between v3 and v2 never
+     * loses the other version's keys. The admin script shows the selected version's rows.
+     */
     public function get_general_settings() {
         return array(
@@ -101 +136 @@
                 'name' => __( 'General Settings', 'spamoff-bot-protection' ),
                 'type' => 'title',
-                'desc' => __( 'Configure your basic reCAPTCHA settings and API keys.', 'spamoff-bot-protection' ),
+                'desc' => __( 'Configure your basic reCAPTCHA settings and API keys.', 'spamoff-bot-protection' ) . ' '
+                    . __( 'Protected forms send visitor data to Google reCAPTCHA; suggested privacy-policy text is under Settings → Privacy → Policy Guide.', 'spamoff-bot-protection' ),
                 'id'   => 'spamoff_bot_protection_general_title',
             ),
             array(
                 'name'    => __( 'reCAPTCHA Type', 'spamoff-bot-protection' ),
-                'desc'    => __( 'Choose between reCAPTCHA v3 (invisible) and v2 (checkbox).', 'spamoff-bot-protection' ),
+                'desc'    => __( 'Choose between reCAPTCHA v3 (invisible) and v2 (checkbox). Google issues separate keys for each; both sets stay saved when you switch.', 'spamoff-bot-protection' ),
                 'id'      => 'spamoff_bot_protection_type',
                 'type'    => 'select',
@@ -116 +152 @@
             ),
             array(
-                'name' => __( 'Site Key', 'spamoff-bot-protection' ),
-                'desc' => __( 'Enter your Google reCAPTCHA site key.', 'spamoff-bot-protection' ),
-                'id'   => 'spamoff_bot_protection_site_key',
-                'type' => 'text',
-                'css'  => 'min-width: 400px;',
-            ),
-            array(
-                'name' => __( 'Secret Key', 'spamoff-bot-protection' ),
-                'desc' => __( 'Enter your Google reCAPTCHA secret key.', 'spamoff-bot-protection' ),
-                'id'   => 'spamoff_bot_protection_secret_key',
-                'type' => 'password',
-                'css'  => 'min-width: 400px;',
-            ),
-            array(
-                'name'    => __( 'Minimum Score for reCAPTCHA v3', 'spamoff-bot-protection' ),
-                'desc'    => __( 'Minimum score required (0.0 - 1.0). Submissions below this score will be rejected.', 'spamoff-bot-protection' ),
-                'id'      => 'spamoff_bot_protection_minimum_score',
-                'type'    => 'number',
-                'default' => '0.5',
-                'step'    => '0.1',
-                'min'     => '0.0',
-                'max'     => '1.0',
-                'css'     => 'width: 80px;',
+                'name'      => __( 'v3 Site Key', 'spamoff-bot-protection' ),
+                'desc'      => __( 'Enter your Google reCAPTCHA v3 site key. The Checkout block always uses the v3 keys.', 'spamoff-bot-protection' ),
+                'id'        => 'spamoff_bot_protection_v3_site_key',
+                'type'      => 'text',
+                'css'       => 'min-width: 400px;',
+                'row_class' => 'spamoff-bot-protection-v3',
+            ),
+            array(
+                'name'              => __( 'v3 Secret Key', 'spamoff-bot-protection' ),
+                'desc'              => __( 'Enter your Google reCAPTCHA v3 secret key.', 'spamoff-bot-protection' ),
+                'id'                => 'spamoff_bot_protection_v3_secret_key',
+                'type'              => 'password',
+                'css'               => 'min-width: 400px;',
+                'row_class'         => 'spamoff-bot-protection-v3',
+                'custom_attributes' => array( 'autocomplete' => 'new-password' ),
+            ),
+            array(
+                'name'      => __( 'Minimum Score for reCAPTCHA v3', 'spamoff-bot-protection' ),
+                'desc'      => __( 'Minimum score required (0.0 - 1.0). Submissions below this score will be rejected.', 'spamoff-bot-protection' ),
+                'id'        => 'spamoff_bot_protection_minimum_score',
+                'type'      => 'number',
+                'default'   => '0.5',
+                'css'       => 'width: 80px;',
+                'row_class' => 'spamoff-bot-protection-v3',
+                'custom_attributes' => array(
+                    'step' => '0.1',
+                    'min'  => '0',
+                    'max'  => '1',
+                ),
+            ),
+            array(
+                'name'      => __( 'v2 Site Key', 'spamoff-bot-protection' ),
+                'desc'      => __( 'Enter your Google reCAPTCHA v2 ("I\'m not a robot" Checkbox) site key.', 'spamoff-bot-protection' ),
+                'id'        => 'spamoff_bot_protection_v2_site_key',
+                'type'      => 'text',
+                'css'       => 'min-width: 400px;',
+                'row_class' => 'spamoff-bot-protection-v2',
+            ),
+            array(
+                'name'              => __( 'v2 Secret Key', 'spamoff-bot-protection' ),
+                'desc'              => __( 'Enter your Google reCAPTCHA v2 secret key.', 'spamoff-bot-protection' ),
+                'id'                => 'spamoff_bot_protection_v2_secret_key',
+                'type'              => 'password',
+                'css'               => 'min-width: 400px;',
+                'row_class'         => 'spamoff-bot-protection-v2',
+                'custom_attributes' => array( 'autocomplete' => 'new-password' ),
             ),
             array(
@@ -185 +244 @@
     }
 
+    /**
+     * Labels for the Advanced Settings toggles, keyed like Helper::FORMS.
+     */
+    private function get_form_labels() {
+        return array(
+            'wp_login'         => __( 'WordPress Login (wp-login.php)', 'spamoff-bot-protection' ),
+            'wp_registration'  => __( 'WordPress Registration (wp-login.php)', 'spamoff-bot-protection' ),
+            'wp_lost_password' => __( 'WordPress Lost Password (wp-login.php)', 'spamoff-bot-protection' ),
+            'comments'         => __( 'WordPress Comments', 'spamoff-bot-protection' ),
+            'login'            => __( 'WooCommerce Login (My Account and checkout)', 'spamoff-bot-protection' ),
+            'registration'     => __( 'WooCommerce Registration (My Account)', 'spamoff-bot-protection' ),
+            'lost_password'    => __( 'WooCommerce Lost Password (My Account)', 'spamoff-bot-protection' ),
+            'checkout'         => __( 'WooCommerce Checkout: all customers', 'spamoff-bot-protection' ),
+            'guest_checkout'   => __( 'WooCommerce Checkout: guests only', 'spamoff-bot-protection' ),
+        );
+    }
+
     public function output_forms_table() {
         $forms = get_option( 'spamoff_bot_protection_forms', array() );
@@ -190 +266 @@
             $forms = array();
         }
-
-        $form_list = array(
-            'login'          => __( 'Customer Login', 'spamoff-bot-protection' ),
-            'registration'   => __( 'Customer Registration', 'spamoff-bot-protection' ),
-            'checkout'       => __( 'Checkout Page', 'spamoff-bot-protection' ),
-            'guest_checkout' => __( 'Guest Checkout', 'spamoff-bot-protection' ),
-            'lost_password'  => __( 'Lost Password', 'spamoff-bot-protection' ),
-            'comments'       => __( 'WordPress Comments', 'spamoff-bot-protection' ),
-        );
         ?>
-        <tr valign="top">
+        <tr>
             <th scope="row" class="titledesc"><?php esc_html_e( 'Protected Forms', 'spamoff-bot-protection' ); ?></th>
             <td class="forminp">
@@ -211 +278 @@
                     </thead>
                     <tbody>
-                        <?php foreach ( $form_list as $key => $label ) :
-                            $checked = ( isset( $forms[ $key ] ) && 'yes' === $forms[ $key ] ) ? 'checked' : '';
-                        ?>
+                        <?php foreach ( $this->get_form_labels() as $key => $label ) : ?>
                             <tr>
-                                <td style="padding: 10px;"><?php echo esc_html( $label ); ?></td>
+                                <td style="padding: 10px;"><label for="spamoff_bot_protection_forms_<?php echo esc_attr( $key ); ?>"><?php echo esc_html( $label ); ?></label></td>
                                 <td style="padding: 10px;">
-                                    <input type="checkbox" name="spamoff_bot_protection_forms[<?php echo esc_attr( $key ); ?>]" value="yes" <?php echo esc_attr( $checked ); ?>>
+                                    <input type="checkbox" id="spamoff_bot_protection_forms_<?php echo esc_attr( $key ); ?>" name="spamoff_bot_protection_forms[<?php echo esc_attr( $key ); ?>]" value="yes" <?php checked( isset( $forms[ $key ] ) && 'yes' === $forms[ $key ] ); ?>>
                                 </td>
                             </tr>
@@ -223 +288 @@
                     </tbody>
                 </table>
+                <p class="description"><?php esc_html_e( '"Checkout: guests only" skips customers who are logged in. It has no effect while "Checkout: all customers" is on.', 'spamoff-bot-protection' ); ?></p>
+                <p class="description"><?php esc_html_e( 'WordPress Login also covers login forms made with wp_login_form(). XML-RPC and application-password logins have no form and are not covered.', 'spamoff-bot-protection' ); ?></p>
             </td>
         </tr>
@@ -237 +304 @@
         $v2_size      = isset( $customization['v2_size'] ) ? $customization['v2_size'] : 'normal';
         $error_failed = isset( $customization['error_message_failed'] ) ? $customization['error_message_failed'] : __( 'Verification failed. Please try again.', 'spamoff-bot-protection' );
+        $hide_badge   = isset( $customization['hide_v3_badge'] ) && 'yes' === $customization['hide_v3_badge'];
         ?>
-        <tr valign="top">
+        <tr>
             <th scope="row" class="titledesc"><?php esc_html_e( 'Customization Options', 'spamoff-bot-protection' ); ?></th>
             <td class="forminp">
@@ -247 +315 @@
                             <td style="padding: 10px;">
                                 <code>[spamoff_bot_protection]</code>
-                                <p class="description"><?php esc_html_e( 'Use this shortcode to manually place the captcha anywhere.', 'spamoff-bot-protection' ); ?></p>
+                                <p class="description"><?php esc_html_e( 'Places the captcha inside a custom form. The form\'s handler must verify it by calling spamoff_bot_protection_verify_submission().', 'spamoff-bot-protection' ); ?></p>
                             </td>
                         </tr>
                         <tr>
-                            <td style="padding: 10px;"><?php esc_html_e( 'reCAPTCHA v2 Theme', 'spamoff-bot-protection' ); ?></td>
+                            <td style="padding: 10px;"><label for="spamoff_bot_protection_v2_theme"><?php esc_html_e( 'reCAPTCHA v2 Theme', 'spamoff-bot-protection' ); ?></label></td>
                             <td style="padding: 10px;">
-                                <select name="spamoff_bot_protection_customization[v2_theme]">
+                                <select id="spamoff_bot_protection_v2_theme" name="spamoff_bot_protection_customization[v2_theme]">
                                     <option value="light" <?php selected( $v2_theme, 'light' ); ?>><?php esc_html_e( 'Light', 'spamoff-bot-protection' ); ?></option>
                                     <option value="dark" <?php selected( $v2_theme, 'dark' ); ?>><?php esc_html_e( 'Dark', 'spamoff-bot-protection' ); ?></option>
@@ -260 +328 @@
                         </tr>
                         <tr>
-                            <td style="padding: 10px;"><?php esc_html_e( 'reCAPTCHA v2 Size', 'spamoff-bot-protection' ); ?></td>
+                            <td style="padding: 10px;"><label for="spamoff_bot_protection_v2_size"><?php esc_html_e( 'reCAPTCHA v2 Size', 'spamoff-bot-protection' ); ?></label></td>
                             <td style="padding: 10px;">
-                                <select name="spamoff_bot_protection_customization[v2_size]">
+                                <select id="spamoff_bot_protection_v2_size" name="spamoff_bot_protection_customization[v2_size]">
                                     <option value="normal" <?php selected( $v2_size, 'normal' ); ?>><?php esc_html_e( 'Normal', 'spamoff-bot-protection' ); ?></option>
                                     <option value="compact" <?php selected( $v2_size, 'compact' ); ?>><?php esc_html_e( 'Compact', 'spamoff-bot-protection' ); ?></option>
@@ -269 +337 @@
                         </tr>
                         <tr>
-                            <td style="padding: 10px;"><?php esc_html_e( 'Failed Verification Message', 'spamoff-bot-protection' ); ?></td>
+                            <td style="padding: 10px;"><label for="spamoff_bot_protection_hide_v3_badge"><?php esc_html_e( 'Hide reCAPTCHA v3 Badge', 'spamoff-bot-protection' ); ?></label></td>
                             <td style="padding: 10px;">
-                                <input type="text" name="spamoff_bot_protection_customization[error_message_failed]" value="<?php echo esc_attr( $error_failed ); ?>" style="width: 100%;">
+                                <input type="checkbox" id="spamoff_bot_protection_hide_v3_badge" name="spamoff_bot_protection_customization[hide_v3_badge]" value="yes" <?php checked( $hide_badge ); ?>>
+                                <p class="description"><?php esc_html_e( 'Hides the floating badge and shows Google\'s required reCAPTCHA notice inside each protected form instead. The Checkout block keeps the badge.', 'spamoff-bot-protection' ); ?></p>
+                            </td>
+                        </tr>
+                        <tr>
+                            <td style="padding: 10px;"><label for="spamoff_bot_protection_error_message_failed"><?php esc_html_e( 'Failed Verification Message', 'spamoff-bot-protection' ); ?></label></td>
+                            <td style="padding: 10px;">
+                                <input type="text" id="spamoff_bot_protection_error_message_failed" name="spamoff_bot_protection_customization[error_message_failed]" value="<?php echo esc_attr( $error_failed ); ?>" style="width: 100%;">
                             </td>
                         </tr>
@@ -281 +356 @@
     }
 
+    /**
+     * WooCommerce checks the nonce and capability before saving; check again because
+     * this reads $_POST directly.
+     */
     public function save_forms_settings() {
-        if ( ! isset( $_POST['_wpnonce'] ) ) {
+        if ( ! current_user_can( 'manage_woocommerce' ) || ! isset( $_POST['_wpnonce'] ) || ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_POST['_wpnonce'] ) ), 'woocommerce-settings' ) ) {
             return;
         }
-        $nonce = sanitize_text_field( wp_unslash( $_POST['_wpnonce'] ) );
-        if ( ! wp_verify_nonce( $nonce, 'woocommerce-settings' ) ) {
+
+        // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- Only whitelisted keys with the value "yes" are kept below.
+        $posted = isset( $_POST['spamoff_bot_protection_forms'] ) ? (array) wp_unslash( $_POST['spamoff_bot_protection_forms'] ) : array();
+
+        $forms = array();
+        foreach ( Helper::FORMS as $form ) {
+            if ( isset( $posted[ $form ] ) && 'yes' === $posted[ $form ] ) {
+                $forms[ $form ] = 'yes';
+            }
+        }
+
+        update_option( 'spamoff_bot_protection_forms', $forms );
+    }
+
+    public function save_customization_settings() {
+        if ( ! current_user_can( 'manage_woocommerce' ) || ! isset( $_POST['_wpnonce'] ) || ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_POST['_wpnonce'] ) ), 'woocommerce-settings' ) ) {
             return;
         }
 
-        if ( isset( $_POST['spamoff_bot_protection_forms'] ) ) {
-            // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- Sanitized below.
-            $forms_data = wp_unslash( $_POST['spamoff_bot_protection_forms'] );
-            $forms      = array_map( 'sanitize_text_field', (array) $forms_data );
-            update_option( 'spamoff_bot_protection_forms', $forms );
-        } else {
-            update_option( 'spamoff_bot_protection_forms', array() );
-        }
-    }
-
-    public function save_customization_settings() {
-        if ( ! isset( $_POST['_wpnonce'] ) ) {
+        if ( ! isset( $_POST['spamoff_bot_protection_customization'] ) ) {
             return;
         }
-        $nonce = sanitize_text_field( wp_unslash( $_POST['_wpnonce'] ) );
-        if ( ! wp_verify_nonce( $nonce, 'woocommerce-settings' ) ) {
-            return;
-        }
-
-        if ( isset( $_POST['spamoff_bot_protection_customization'] ) ) {
-            // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- Sanitized below.
-            $customization_data = wp_unslash( $_POST['spamoff_bot_protection_customization'] );
-
-            $customization = array(
-                'v2_theme'             => sanitize_text_field( $customization_data['v2_theme'] ?? 'light' ),
-                'v2_size'              => sanitize_text_field( $customization_data['v2_size'] ?? 'normal' ),
-                'error_message_failed' => sanitize_text_field( $customization_data['error_message_failed'] ?? '' ),
-            );
-
-            update_option( 'spamoff_bot_protection_customization', $customization );
-        }
+
+        // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- Each field is whitelisted or sanitized below.
+        $posted = (array) wp_unslash( $_POST['spamoff_bot_protection_customization'] );
+
+        $customization = array(
+            'v2_theme'             => isset( $posted['v2_theme'] ) && 'dark' === $posted['v2_theme'] ? 'dark' : 'light',
+            'v2_size'              => isset( $posted['v2_size'] ) && 'compact' === $posted['v2_size'] ? 'compact' : 'normal',
+            'hide_v3_badge'        => isset( $posted['hide_v3_badge'] ) && 'yes' === $posted['hide_v3_badge'] ? 'yes' : 'no',
+            'error_message_failed' => isset( $posted['error_message_failed'] ) && is_string( $posted['error_message_failed'] ) ? sanitize_text_field( $posted['error_message_failed'] ) : '',
+        );
+
+        update_option( 'spamoff_bot_protection_customization', $customization );
     }
 }

spamoff-bot-protection/tags/1.0.0/languages/spamoff-bot-protection.pot

@@ -1 +1 @@
 # Copyright (C) 2026 pluginos
-# This file is distributed under the GPLv2 or later license.
+# This file is distributed under the GPLv2 or later.
 msgid ""
 msgstr ""
-"Project-Id-Version: SpamOff – Spam & Bot Protection for WordPress 1.0.0\n"
-"Report-Msgid-Bugs-To: \n"
+"Project-Id-Version: SpamOff – Google reCaptcha for WooCommerce 1.1.0\n"
+"Report-Msgid-Bugs-To: https://wordpress.org/support/plugin/spamoff-bot-protection\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: LANGUAGE <LL@li.org>\n"
@@ -10 +10 @@
 "Content-Type: text/plain; charset=UTF-8\n"
 "Content-Transfer-Encoding: 8bit\n"
-"POT-Creation-Date: 2026-05-21T00:00:00+00:00\n"
+"POT-Creation-Date: 2026-09-25T03:58:02+02:00\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
-"X-Generator: hand-authored template, regenerate with `wp i18n make-pot`\n"
+"X-Generator: WP-CLI 2.12.0\n"
 "X-Domain: spamoff-bot-protection\n"
 
+#. Plugin Name of the plugin
 #: spamoff-bot-protection.php
-msgid "SpamOff – Spam & Bot Protection for WordPress requires WooCommerce to be installed and active."
-msgstr ""
-
-#: includes/class-spamoff-bot-protection-admin.php
+#: includes/class-spamoff-bot-protection-admin.php:30
+msgid "SpamOff – Google reCaptcha for WooCommerce"
+msgstr ""
+
+#. Description of the plugin
+#: spamoff-bot-protection.php
+msgid "Protects WooCommerce and WordPress forms from bots and spam using Google reCAPTCHA v2 and v3, with full WooCommerce Block Checkout support."
+msgstr ""
+
+#. Author of the plugin
+#: spamoff-bot-protection.php
+msgid "pluginos"
+msgstr ""
+
+#: includes/class-spamoff-bot-protection-admin.php:24
+msgid "SpamOff adds Google reCAPTCHA to the forms you protect. On pages with a protected form, Google's reCAPTCHA script runs in the visitor's browser, and when the form is submitted your server sends the reCAPTCHA response and the visitor's IP address to Google to check it."
+msgstr ""
+
+#: includes/class-spamoff-bot-protection-admin.php:25
+msgid "Suggested text:"
+msgstr ""
+
+#: includes/class-spamoff-bot-protection-admin.php:26
+msgid "We use Google reCAPTCHA on our login, registration, password reset, checkout and comment forms to protect this site from spam and abuse. reCAPTCHA collects hardware and software information, such as device and application data, and sends it to Google for analysis. Your use of reCAPTCHA is subject to the Google Privacy Policy and Terms of Service."
+msgstr ""
+
+#: includes/class-spamoff-bot-protection-admin.php:35
 msgid "Settings"
 msgstr ""
 
-#: includes/class-spamoff-bot-protection-frontend.php
+#: includes/class-spamoff-bot-protection-frontend.php:281
 msgid "Comment Submission Error"
 msgstr ""
 
-#: includes/class-spamoff-bot-protection-helper.php
+#: includes/class-spamoff-bot-protection-frontend.php:315
+msgid "reCAPTCHA v3 token for the checkout."
+msgstr ""
+
+#: includes/class-spamoff-bot-protection-frontend.php:321
+msgid "reCAPTCHA v3 action the token was created for."
+msgstr ""
+
+#. translators: 1: Google Privacy Policy URL, 2: Google Terms of Service URL.
+#: includes/class-spamoff-bot-protection-frontend.php:547
+#, php-format
+msgid "This site is protected by reCAPTCHA and the Google <a href=\"%1$s\" target=\"_blank\" rel=\"noopener noreferrer\">Privacy Policy</a> and <a href=\"%2$s\" target=\"_blank\" rel=\"noopener noreferrer\">Terms of Service</a> apply."
+msgstr ""
+
+#: includes/class-spamoff-bot-protection-helper.php:250
+msgid "Please complete the verification."
+msgstr ""
+
+#: includes/class-spamoff-bot-protection-helper.php:259
+#: includes/class-spamoff-bot-protection-settings.php:305
 msgid "Verification failed. Please try again."
 msgstr ""
 
-#: includes/class-spamoff-bot-protection-helper.php
-msgid "Please complete the verification."
-msgstr ""
-
-#: includes/class-spamoff-bot-protection-settings.php
+#: includes/class-spamoff-bot-protection-settings.php:24
 msgid "SpamOff"
 msgstr ""
 
-#: includes/class-spamoff-bot-protection-settings.php
+#: includes/class-spamoff-bot-protection-settings.php:49
+#: includes/class-spamoff-bot-protection-settings.php:136
 msgid "General Settings"
 msgstr ""
 
-#: includes/class-spamoff-bot-protection-settings.php
+#: includes/class-spamoff-bot-protection-settings.php:50
 msgid "Advanced Settings"
 msgstr ""
 
-#: includes/class-spamoff-bot-protection-settings.php
+#: includes/class-spamoff-bot-protection-settings.php:51
+#: includes/class-spamoff-bot-protection-settings.php:230
 msgid "Customization"
 msgstr ""
 
-#: includes/class-spamoff-bot-protection-settings.php
+#. translators: %s: reCAPTCHA version, e.g. v3.
+#: includes/class-spamoff-bot-protection-settings.php:79
+#, php-format
+msgid "Protection is off: add the reCAPTCHA %s Site Key and Secret Key under General Settings."
+msgstr ""
+
+#: includes/class-spamoff-bot-protection-settings.php:86
+msgid "Your checkout page uses the Checkout block, which only supports reCAPTCHA v3. Orders placed there are rejected until you save v3 keys. Select v3 under General Settings to enter them; they stay saved if you switch back to v2."
+msgstr ""
+
+#: includes/class-spamoff-bot-protection-settings.php:138
 msgid "Configure your basic reCAPTCHA settings and API keys."
 msgstr ""
 
-#: includes/class-spamoff-bot-protection-settings.php
+#: includes/class-spamoff-bot-protection-settings.php:139
+msgid "Protected forms send visitor data to Google reCAPTCHA; suggested privacy-policy text is under Settings → Privacy → Policy Guide."
+msgstr ""
+
+#: includes/class-spamoff-bot-protection-settings.php:143
 msgid "reCAPTCHA Type"
 msgstr ""
 
-#: includes/class-spamoff-bot-protection-settings.php
-msgid "Choose between reCAPTCHA v3 (invisible) and v2 (checkbox)."
-msgstr ""
-
-#: includes/class-spamoff-bot-protection-settings.php
+#: includes/class-spamoff-bot-protection-settings.php:144
+msgid "Choose between reCAPTCHA v3 (invisible) and v2 (checkbox). Google issues separate keys for each; both sets stay saved when you switch."
+msgstr ""
+
+#: includes/class-spamoff-bot-protection-settings.php:148
 msgid "reCAPTCHA v3 (Invisible)"
 msgstr ""
 
-#: includes/class-spamoff-bot-protection-settings.php
+#: includes/class-spamoff-bot-protection-settings.php:149
 msgid "reCAPTCHA v2 (Checkbox)"
 msgstr ""
 
-#: includes/class-spamoff-bot-protection-settings.php
-msgid "Site Key"
-msgstr ""
-
-#: includes/class-spamoff-bot-protection-settings.php
-msgid "Enter your Google reCAPTCHA site key."
-msgstr ""
-
-#: includes/class-spamoff-bot-protection-settings.php
-msgid "Secret Key"
-msgstr ""
-
-#: includes/class-spamoff-bot-protection-settings.php
-msgid "Enter your Google reCAPTCHA secret key."
-msgstr ""
-
-#: includes/class-spamoff-bot-protection-settings.php
+#: includes/class-spamoff-bot-protection-settings.php:154
+msgid "v3 Site Key"
+msgstr ""
+
+#: includes/class-spamoff-bot-protection-settings.php:155
+msgid "Enter your Google reCAPTCHA v3 site key. The Checkout block always uses the v3 keys."
+msgstr ""
+
+#: includes/class-spamoff-bot-protection-settings.php:162
+msgid "v3 Secret Key"
+msgstr ""
+
+#: includes/class-spamoff-bot-protection-settings.php:163
+msgid "Enter your Google reCAPTCHA v3 secret key."
+msgstr ""
+
+#: includes/class-spamoff-bot-protection-settings.php:171
 msgid "Minimum Score for reCAPTCHA v3"
 msgstr ""
 
-#: includes/class-spamoff-bot-protection-settings.php
+#: includes/class-spamoff-bot-protection-settings.php:172
 msgid "Minimum score required (0.0 - 1.0). Submissions below this score will be rejected."
 msgstr ""
 
-#: includes/class-spamoff-bot-protection-settings.php
+#: includes/class-spamoff-bot-protection-settings.php:185
+msgid "v2 Site Key"
+msgstr ""
+
+#: includes/class-spamoff-bot-protection-settings.php:186
+msgid "Enter your Google reCAPTCHA v2 (\"I'm not a robot\" Checkbox) site key."
+msgstr ""
+
+#: includes/class-spamoff-bot-protection-settings.php:193
+msgid "v2 Secret Key"
+msgstr ""
+
+#: includes/class-spamoff-bot-protection-settings.php:194
+msgid "Enter your Google reCAPTCHA v2 secret key."
+msgstr ""
+
+#: includes/class-spamoff-bot-protection-settings.php:211
 msgid "Form Protection"
 msgstr ""
 
-#: includes/class-spamoff-bot-protection-settings.php
+#: includes/class-spamoff-bot-protection-settings.php:213
 msgid "Select which forms to protect."
 msgstr ""
 
-#: includes/class-spamoff-bot-protection-settings.php
+#: includes/class-spamoff-bot-protection-settings.php:232
 msgid "Customize the appearance and messages."
 msgstr ""
 
-#: includes/class-spamoff-bot-protection-settings.php
-msgid "Customer Login"
-msgstr ""
-
-#: includes/class-spamoff-bot-protection-settings.php
-msgid "Customer Registration"
-msgstr ""
-
-#: includes/class-spamoff-bot-protection-settings.php
-msgid "Checkout Page"
-msgstr ""
-
-#: includes/class-spamoff-bot-protection-settings.php
-msgid "Guest Checkout"
-msgstr ""
-
-#: includes/class-spamoff-bot-protection-settings.php
-msgid "Lost Password"
-msgstr ""
-
-#: includes/class-spamoff-bot-protection-settings.php
+#: includes/class-spamoff-bot-protection-settings.php:251
+msgid "WordPress Login (wp-login.php)"
+msgstr ""
+
+#: includes/class-spamoff-bot-protection-settings.php:252
+msgid "WordPress Registration (wp-login.php)"
+msgstr ""
+
+#: includes/class-spamoff-bot-protection-settings.php:253
+msgid "WordPress Lost Password (wp-login.php)"
+msgstr ""
+
+#: includes/class-spamoff-bot-protection-settings.php:254
 msgid "WordPress Comments"
 msgstr ""
 
-#: includes/class-spamoff-bot-protection-settings.php
+#: includes/class-spamoff-bot-protection-settings.php:255
+msgid "WooCommerce Login (My Account and checkout)"
+msgstr ""
+
+#: includes/class-spamoff-bot-protection-settings.php:256
+msgid "WooCommerce Registration (My Account)"
+msgstr ""
+
+#: includes/class-spamoff-bot-protection-settings.php:257
+msgid "WooCommerce Lost Password (My Account)"
+msgstr ""
+
+#: includes/class-spamoff-bot-protection-settings.php:258
+msgid "WooCommerce Checkout: all customers"
+msgstr ""
+
+#: includes/class-spamoff-bot-protection-settings.php:259
+msgid "WooCommerce Checkout: guests only"
+msgstr ""
+
+#: includes/class-spamoff-bot-protection-settings.php:270
 msgid "Protected Forms"
 msgstr ""
 
-#: includes/class-spamoff-bot-protection-settings.php
+#: includes/class-spamoff-bot-protection-settings.php:275
 msgid "Form"
 msgstr ""
 
-#: includes/class-spamoff-bot-protection-settings.php
+#: includes/class-spamoff-bot-protection-settings.php:276
 msgid "Enable"
 msgstr ""
 
-#: includes/class-spamoff-bot-protection-settings.php
+#: includes/class-spamoff-bot-protection-settings.php:290
+msgid "\"Checkout: guests only\" skips customers who are logged in. It has no effect while \"Checkout: all customers\" is on."
+msgstr ""
+
+#: includes/class-spamoff-bot-protection-settings.php:291
+msgid "WordPress Login also covers login forms made with wp_login_form(). XML-RPC and application-password logins have no form and are not covered."
+msgstr ""
+
+#: includes/class-spamoff-bot-protection-settings.php:309
 msgid "Customization Options"
 msgstr ""
 
-#: includes/class-spamoff-bot-protection-settings.php
+#: includes/class-spamoff-bot-protection-settings.php:314
 msgid "Shortcode"
 msgstr ""
 
-#: includes/class-spamoff-bot-protection-settings.php
-msgid "Use this shortcode to manually place the captcha anywhere."
-msgstr ""
-
-#: includes/class-spamoff-bot-protection-settings.php
+#: includes/class-spamoff-bot-protection-settings.php:317
+msgid "Places the captcha inside a custom form. The form's handler must verify it by calling spamoff_bot_protection_verify_submission()."
+msgstr ""
+
+#: includes/class-spamoff-bot-protection-settings.php:321
 msgid "reCAPTCHA v2 Theme"
 msgstr ""
 
-#: includes/class-spamoff-bot-protection-settings.php
+#: includes/class-spamoff-bot-protection-settings.php:324
 msgid "Light"
 msgstr ""
 
-#: includes/class-spamoff-bot-protection-settings.php
+#: includes/class-spamoff-bot-protection-settings.php:325
 msgid "Dark"
 msgstr ""
 
-#: includes/class-spamoff-bot-protection-settings.php
+#: includes/class-spamoff-bot-protection-settings.php:330
 msgid "reCAPTCHA v2 Size"
 msgstr ""
 
-#: includes/class-spamoff-bot-protection-settings.php
+#: includes/class-spamoff-bot-protection-settings.php:333
 msgid "Normal"
 msgstr ""
 
-#: includes/class-spamoff-bot-protection-settings.php
+#: includes/class-spamoff-bot-protection-settings.php:334
 msgid "Compact"
 msgstr ""
 
-#: includes/class-spamoff-bot-protection-settings.php
+#: includes/class-spamoff-bot-protection-settings.php:339
+msgid "Hide reCAPTCHA v3 Badge"
+msgstr ""
+
+#: includes/class-spamoff-bot-protection-settings.php:342
+msgid "Hides the floating badge and shows Google's required reCAPTCHA notice inside each protected form instead. The Checkout block keeps the badge."
+msgstr ""
+
+#: includes/class-spamoff-bot-protection-settings.php:346
 msgid "Failed Verification Message"
 msgstr ""
+
+#: spamoff-bot-protection.php:61
+msgid "SpamOff – Google reCaptcha for WooCommerce requires WooCommerce to be installed and active."
+msgstr ""

spamoff-bot-protection/tags/1.0.0/readme.txt

@@ -130 +130 @@
 == Changelog ==
 
+= 1.0.2 =
+* Fixed a functionality issue.
+
 = 1.0.1 =
 * Renamed the plugin to SpamOff – Google reCAPTCHA for WooCommerce.

spamoff-bot-protection/tags/1.0.0/spamoff-bot-protection.php

@@ -1 +1 @@
 <?php
 /**
- * Plugin Name: SpamOff – Spam & Bot Protection
+ * Plugin Name: SpamOff – Google reCaptcha for WooCommerce
  * Description: Protects WooCommerce and WordPress forms from bots and spam using Google reCAPTCHA v2 and v3, with full WooCommerce Block Checkout support.
+ * Version: 1.1.0
+ * Requires at least: 6.5
+ * Requires PHP: 7.4
+ * Requires Plugins: woocommerce
+ * Author: pluginos
  * License: GPLv2 or later
  * License URI: https://www.gnu.org/licenses/gpl-2.0.html
- * Version: 1.0.0
- * Author: pluginos
  * Text Domain: spamoff-bot-protection
  * Domain Path: /languages
- * Requires at least: 5.8
- * Requires PHP: 7.4
- * WC requires at least: 6.0
- * WC tested up to: 10.5
+ * WC requires at least: 8.0
+ * WC tested up to: 11.1
  */
 
@@ -22 +23 @@
 define( 'SPAMOFF_BOT_PROTECTION_PLUGIN_PATH', plugin_dir_path( __FILE__ ) );
 define( 'SPAMOFF_BOT_PROTECTION_PLUGIN_BASENAME', plugin_basename( __FILE__ ) );
-define( 'SPAMOFF_BOT_PROTECTION_PLUGIN_VERSION', '1.0.0' );
+define( 'SPAMOFF_BOT_PROTECTION_PLUGIN_VERSION', '1.1.0' );
 
 class SpamOff_Bot_Protection_Plugin {
@@ -57 +58 @@
     public function woocommerce_missing_notice() {
         ?>
-        <div class="error">
-            <p><?php esc_html_e( 'SpamOff – Spam & Bot Protection for WordPress requires WooCommerce to be installed and active.', 'spamoff-bot-protection' ); ?></p>
+        <div class="notice notice-error">
+            <p><?php esc_html_e( 'SpamOff – Google reCaptcha for WooCommerce requires WooCommerce to be installed and active.', 'spamoff-bot-protection' ); ?></p>
         </div>
         <?php
@@ -72 +73 @@
 
     /**
-     * Declare compatibility with WooCommerce HPOS.
+     * Declare compatibility with WooCommerce HPOS and the Cart & Checkout Blocks.
      */
     public function declare_compatibility() {
         if ( class_exists( '\Automattic\WooCommerce\Utilities\FeaturesUtil' ) ) {
             \Automattic\WooCommerce\Utilities\FeaturesUtil::declare_compatibility( 'custom_order_tables', __FILE__, true );
+            \Automattic\WooCommerce\Utilities\FeaturesUtil::declare_compatibility( 'cart_checkout_blocks', __FILE__, true );
         }
+    }
+
+    /**
+     * 1.0.0 stored one key pair. Since 1.1.0 each reCAPTCHA version has its own, so move
+     * the old pair into the slot for the version that was selected.
+     */
+    private function maybe_upgrade() {
+        $db_version = get_option( 'spamoff_bot_protection_db_version', '1.0.0' );
+        if ( version_compare( $db_version, '1.1.0', '>=' ) ) {
+            return;
+        }
+
+        $type = get_option( 'spamoff_bot_protection_type', 'v3' );
+        $type = in_array( $type, array( 'v3', 'v2' ), true ) ? $type : 'v3';
+
+        foreach ( array( 'site_key', 'secret_key' ) as $key ) {
+            $legacy = get_option( 'spamoff_bot_protection_' . $key, '' );
+            if ( '' !== $legacy && '' === get_option( 'spamoff_bot_protection_' . $type . '_' . $key, '' ) ) {
+                update_option( 'spamoff_bot_protection_' . $type . '_' . $key, $legacy );
+            }
+            delete_option( 'spamoff_bot_protection_' . $key );
+        }
+
+        update_option( 'spamoff_bot_protection_db_version', '1.1.0' );
     }
 
@@ -86 +112 @@
 
         $this->load_files();
+        $this->maybe_upgrade();
 
         new SpamOff_Bot_Protection_Captcha();

spamoff-bot-protection/tags/1.0.0/uninstall.php

@@ -11 +11 @@
 $spamoff_bot_protection_options = array(
     'spamoff_bot_protection_type',
-    'spamoff_bot_protection_site_key',
-    'spamoff_bot_protection_secret_key',
+    'spamoff_bot_protection_v3_site_key',
+    'spamoff_bot_protection_v3_secret_key',
+    'spamoff_bot_protection_v2_site_key',
+    'spamoff_bot_protection_v2_secret_key',
     'spamoff_bot_protection_minimum_score',
     'spamoff_bot_protection_forms',
     'spamoff_bot_protection_customization',
+    'spamoff_bot_protection_db_version',
+    // Single key pair used before 1.1.0.
+    'spamoff_bot_protection_site_key',
+    'spamoff_bot_protection_secret_key',
 );