=== TrueSift ===
Contributors: webdigitech
Tags: captcha, anti-spam, bot protection, human verification, woocommerce
Requires at least: 6.6
Tested up to: 7.0
Requires PHP: 8.1
Stable tag: 1.0.9
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Privacy-first automated human verification for WordPress forms, WooCommerce, and popular form plugins.

== Description ==

TrueSift connects WordPress forms to the TrueSift verification service. It starts an automated browser challenge when a protected form is displayed, keeps the form submit action unavailable until an authoritative verification token is issued, and validates and atomically consumes that single-use token on the WordPress server before the protected action continues.

The plugin does not implement a separate CAPTCHA protocol. Its browser runtime tracks the public `@truesift/next` 0.2.1 client contract, and its PHP bridge uses the official TrueSift challenge, verify, and business-proof API contracts.

= Included integrations =

* WordPress login
* WordPress registration
* WordPress password reset request
* WordPress comments
* WooCommerce customer login
* WooCommerce customer registration
* WooCommerce checkout (classic and Checkout Block)
* WooCommerce product reviews
* Contact Form 7
* WPForms
* Fluent Forms
* Elementor Pro Forms
* Manual shortcode and PHP helper integration

The WooCommerce checkout integration supports both the classic shortcode checkout and the Checkout Block. Checkout Block proofs are carried through Store API extension data and validated before checkout processing.

= Security model =

The browser sends only an opaque `verificationToken` as security proof. Client-provided values such as `allowed`, `decision`, `score`, `status`, `failOpen`, `challengeId`, `action`, `path`, and `origin` are never trusted by the protected PHP action.

The plugin sends the token together with a signed WordPress form context to the server. The PHP verifier calls TrueSift's proof endpoint with server-owned credentials and expected action, path, and origin. A normal success is accepted only when TrueSift confirms `allowed: true`, `decision: allow`, and atomic consumption through either `consumed: true` or a non-empty `consumedAt` timestamp. Replayed, expired, invalid, mismatched, reviewed, or blocked proofs are rejected.

= Visual modes =

The admin page shows live, non-networked previews of all official layouts:

* Checkbox
* Banner
* Inline
* Badge

Theme, language, size, and appearance can be configured globally.

= Manual integration =

Place the shortcode inside a form:

`[truesift]`

When used outside a form, the same shortcode renders a standalone visual verification status. Standalone mode does not protect a business action until it is associated with a form and server-side verification.

For a form located elsewhere in the DOM:

`[truesift form_selector="#contact-form" button_selector="button[type=submit]"]`

A custom PHP handler must also validate the proof before performing its protected action:

`$proof = truesift_verify_request();`

Continue only when the returned value is not a `WP_Error` and its `allowed` value is `true`.

== External services ==

This plugin connects to the external TrueSift service operated by WebDigiTech.

The following requests are made only when TrueSift is configured and a protected form or connection test is used:

* Browser challenge through the local WordPress route, forwarded server-to-server to `https://truesift.webdigitech.de/api/v1/botguard/challenge`
* Browser verification through the local WordPress route, forwarded server-to-server to `https://truesift.webdigitech.de/api/v1/botguard/verify`
* Authoritative single-use proof verification directly from the protected WordPress server action to `https://truesift.webdigitech.de/api/v1/botguard/proof/verify`

Data sent can include the site key, requested action, page path, website origin, browser language, languages, time zone, screen and viewport dimensions, platform information, cookie availability, referrer, current page URL, challenge identifiers, short-lived challenge tokens, verification timing, and the single-use verification token. The secret key is sent only server-to-server and is never exposed to the browser.

TrueSift service information: https://truesift.webdigitech.de/
Privacy policy: https://webdigitech.de/datenschutz
Terms of service: https://webdigitech.de/agb

== Installation ==

1. Upload the `truesift` folder to `/wp-content/plugins/`, or install the ZIP through Plugins > Add New > Upload Plugin.
2. Activate TrueSift.
3. Open Settings > TrueSift.
4. Enter the site key and secret key issued for the site in TrueSift.
5. Save the connection settings, then run the connection test.
6. Choose the visual mode and enable the desired integrations.

Credentials may also be defined in `wp-config.php`:

`define( 'TRUESIFT_SITE_KEY', 'bg_site_...' );`

`define( 'TRUESIFT_SECRET_KEY', '...' );`

Optional server constants:

`TRUESIFT_API_BASE_URL`, `TRUESIFT_DEFAULT_ACTION`, `TRUESIFT_FAIL_OPEN`, and `TRUESIFT_TIMEOUT_MS`.

== Frequently Asked Questions ==

= Does the plugin trust the browser result? =

No. The browser result controls only the user interface. The protected WordPress action validates and consumes the opaque verification token server-to-server.

= Is disabling the submit button the complete protection? =

No. The button lock improves the form flow and prevents ordinary unverified submissions. The PHP proof verifier is the security boundary.

= Are tokens stored in WordPress? =

No. Verification tokens are kept only for the current browser form request and are consumed by TrueSift during server-side proof validation.

= What happens if a token is reused? =

TrueSift rejects the replay and the protected action does not continue.

= Does the plugin collect local analytics? =

No. Version 1.0.9 does not create a local analytics database or visitor profile. Debug mode stores only administrator troubleshooting events and is disabled by default.

= Can I use the shortcode with any form? =

The shortcode can mount and control TrueSift on a custom HTML form. The form's PHP handler must still call `truesift_verify_request()` before performing the protected operation.

== Privacy ==

The plugin adds suggested text to WordPress' Privacy Policy Guide. It does not store visitor verification tokens, browser metadata, or visitor profiles in the WordPress database. Site credentials are stored encrypted when supported by the server, or may be supplied through `wp-config.php` constants.

== Changelog ==

= 1.0.9 =
* Updated the tracked official SDK and browser bundle to `@truesift/next@0.2.1`.
* Added visible plugin/SDK/browser-bundle build metadata and browser diagnostics.
* Added the combined SDK cache revision `1.0.9-0.2.1`.
* Preserved the verified login proof flow and resilient fallback previews.

= 1.0.9 =
* Adds resilient visual-style previews with SDK-generated fallback images.
* Retries live preview initialization when optimization plugins delay the official SDK bundle.
* Invalidates stale cached SDK adapter assets on every plugin release.

= 1.0.7 =

* Fixed proof validation for the official TrueSift 0.2 response contract, which confirms one-time token consumption with a non-empty `consumedAt` timestamp.
* Continued to support `consumed: true` when that explicit boolean is present.
* Kept strict action, path, origin, decision, and challenge checks.

= 1.0.6 =

* Added administrator-only safe debug mode for challenge, verify, proof consumption, signed context, and integration outcomes.
* Added Tools log viewing, JSON report download, and protected log clearing.
* Added HTTP status, duration, response field, and proof-contract diagnostics without credentials or full tokens.
* Kept proof verification fail-closed and unchanged.

= 1.0.5 =

* Fixed WordPress login proof serialization when login/security plugins mutate the form DOM.
* Added `formdata` serialization for the one-time verification token and signed context.
* Kept server-side proof verification unchanged.

= 1.0.4 =

* Added WooCommerce Checkout Block rendering before the Place order action.
* Added Checkout Store extension-data transport for the one-time verification token and signed context.
* Added Checkout Block validation through the official checkout event registry.
* Added early Store API proof validation through `rest_authentication_errors`.
* Added automatic TrueSift reset after Checkout Block processing failures.
* Declared WooCommerce Cart and Checkout Blocks compatibility.

= 1.0.3 =

* Fixed standalone `[truesift]` rendering by enqueueing the SDK runtime before page output whenever the queried post contains the shortcode.
* Preserved late enqueue as a fallback for dynamically generated shortcode content.

= 1.0.2 =

* Fixed the WordPress SDK bundle entry so the official `TrueSiftCheck` component initializes without unresolved optional exports.
* Loaded login-screen SDK and adapter assets in the document head.
* Added resilient automatic mounts for native WordPress login, registration, and lost-password forms.
* Added standalone visual rendering for a plain `[truesift]` shortcode outside a form.
* Preserved PHP-hook form rendering while preventing duplicate mounts.

= 1.0.1 =

* Fixed native WordPress login-page widget rendering by enqueueing the SDK runtime, `wp-element` dependency, configuration, and stylesheet before the login page head is printed.
* Restored submit-button protection for native login, registration, and password-reset-request forms.

= 1.0.0 =

* Initial production release.
* Added official TrueSift 0.2.1 browser verification runtime using the WordPress React package.
* Added secure local challenge and verify REST bridges.
* Added authoritative, single-use server-side proof verification.
* Added WordPress, WooCommerce classic, Contact Form 7, WPForms, Fluent Forms, Elementor Pro Forms, and manual integrations.
* Added live admin previews for checkbox, banner, inline, and badge layouts.
* Added encrypted credential storage, import/export without secrets, diagnostics, safe logging, and uninstall controls.
