Title: GridXFlex Captcha Security Author: Grid X Flex Published: 26 آگسٽ 2026 Last modified: 26 آگسٽ 2026 --- پلگ انس ڳولھيو ![](https://ps.w.org/gridxflex-captcha-security/assets/banner-772x250.png?rev=3667576) ![](https://ps.w.org/gridxflex-captcha-security/assets/icon-256x256.png?rev=3667576) # GridXFlex Captcha Security کان: [Grid X Flex](https://profiles.wordpress.org/gridxflex/) [ڊائون لوڊ ڪريو](https://downloads.wordpress.org/plugin/gridxflex-captcha-security.1.0.0.zip) * [تفصيل](https://snd.wordpress.org/plugins/gridxflex-captcha-security/#description) * [جائزو](https://snd.wordpress.org/plugins/gridxflex-captcha-security/#reviews) * [تنصيب](https://snd.wordpress.org/plugins/gridxflex-captcha-security/#installation) * [ترقي](https://snd.wordpress.org/plugins/gridxflex-captcha-security/#developers) [سھائتا](https://wordpress.org/support/plugin/gridxflex-captcha-security/) ## وضاحت GridXFlex Captcha Security adds a self-hosted image CAPTCHA, backed by a silent honeypot layer, to your site’s Login, Registration, Lost Password, and Comments forms. Everything is generated on your own server using PHP’s built-in GD library. No requests are ever sent to a third-party service, no API keys are required, and no personal data is stored beyond a short-lived, one-time-use security token. #### Features * Self-hosted image CAPTCHA (GD-generated, delivered inline as a base64 image — no extra HTTP request) * Silent honeypot field on every protected form, on by default * Per-form protection toggles: Login, Registration, Lost Password, Comments * Configurable character type (alphanumeric / letters / numbers), letter case, and length (3–6 characters) * Option to hide the comment captcha for logged-in users * One-time-use challenge tokens — each code can be attempted exactly once, then it’s gone * No PHP sessions, no cookies set by this plugin, no external requests, no tracking #### Why no PHP sessions? Older captcha plugins commonly call `session_start()` on every front-end request, even on pages that never show a captcha. That has a real performance cost, breaks under object-cache or load-balanced PHP-FPM pools without sticky sessions, and is incompatible with full-page caching. GridXFlex Captcha Security stores each challenge as a short-lived WordPress transient, keyed by a random token embedded in the form. The token is just a lookup key — the actual secret (a hash of the code) stays server- side — so it remains safe even on a cached page, and each challenge is deleted the instant it’s checked, pass or fail. ## تصوير [⌊Settings screen under Settings → GridXFlex Captcha.⌉⌊Settings screen under Settings → GridXFlex Captcha.⌉[ Settings screen under Settings GridXFlex Captcha. [⌊The image CAPTCHA as it appears on the login form.⌉⌊The image CAPTCHA as it appears on the login form.⌉[ The image CAPTCHA as it appears on the login form. ## انسٽاليشن 1. Upload the `gridxflex-captcha-security` folder to `/wp-content/plugins/`. 2. Activate the plugin through the “Plugins” screen in WordPress. 3. Go to **Settings GridXFlex Captcha** to choose which forms are protected and adjust the captcha’s appearance. ## FAQ ### Does this plugin transmit any data externally? No. Code generation, image rendering, and verification all happen on your own server using PHP’s built-in GD library. Nothing is sent to any third-party API or service. ### Why doesn’t this use PHP sessions? For compatibility with page caching and load-balanced hosting. Instead of `$_SESSION`, each challenge is stored as a short-lived WordPress transient keyed by a random token embedded in the form. This works identically behind full-page cache and across load-balanced PHP-FPM pools without sticky sessions, and every challenge is automatically deleted after a single use. ### What is the honeypot layer? A hidden form field that’s invisible to human visitors but often auto-filled by simple bots. If it’s filled in, the submission is rejected the same way a wrong CAPTCHA code would be — no separate “bot detected” message is ever shown, so automated scripts can’t learn which check they failed. ### Does this require an API key? No. This version doesn’t use any third-party CAPTCHA provider. ### Does the plugin work if my host doesn’t have the GD PHP extension? Yes. If GD isn’t available, the image challenge is automatically skipped — protected forms keep working normally, they just fall back to honeypot-only protection instead of erroring out. You’ll see an admin notice explaining this; it clears itself automatically as soon as GD is enabled, no need to reactivate the plugin. ### Does the captcha add any visible branding to my site? An HTML comment — `` — is placed next to the captcha markup wherever it renders (login, registration, lost password, comments). It isn’t visible in the page as displayed, only in page source. ### What happens if someone gets the comment captcha wrong? They’re redirected back to the same post with an inline error message, and their typed name, email, URL, and comment text are restored — nothing is lost and they don’t leave the page. Login, Registration, and Lost Password show their errors the same way, inline on the same page, using WordPress core’s own error-display mechanism for those forms. ## جائزا ھن پلگ ان لاءِ ڪي به رايا ناھن. ## تعاون ڪندڙ & ڊولپرز “GridXFlex Captcha Security” اوپن سورس سافٽ ويئر آهي. ھيٺين ماڻھن ھن پلگ ان ۾ حصو ورتو آھي. تعاون ڪندڙ * [ Grid X Flex ](https://profiles.wordpress.org/gridxflex/) [ترجمو ڪريو “GridXFlex Captcha Security” توهان جي ٻولي ۾.](https://translate.wordpress.org/projects/wp-plugins/gridxflex-captcha-security) ### ڊولپمينٽ ۾ دلچسپي؟ [ڪوڊ براؤز ڪريو](https://plugins.trac.wordpress.org/browser/gridxflex-captcha-security/)، چيڪ ڪريو [SVN مخزن](https://plugins.svn.wordpress.org/gridxflex-captcha-security/)، يا رڪنيت حاصل ڪريو [ڊولپمينٽ لاگ](https://plugins.trac.wordpress.org/log/gridxflex-captcha-security/) پاران [RSS](https://plugins.trac.wordpress.org/log/gridxflex-captcha-security/?limit=100&mode=stop_on_copy&format=rss). ## لاگ تبدیل ڪريو #### 1.0.0 * Initial release: image CAPTCHA + honeypot for Login, Registration, Lost Password, and Comments forms. * Graceful fallback when the GD extension is unavailable: protected forms keep working via the honeypot layer alone instead of erroring; the admin notice re- checks live and clears itself once GD is enabled, no reactivation needed. ## ميٽا * Version **1.0.0** * Last updated **3 هفتا اڳ** * Active installations **10 کان گھٽ** * WordPress version ** 5.7 يا وڌيڪ ** * Tested up to **7.1** * PHP version ** 7.4 يا وڌيڪ ** * Language * [English (US)](https://wordpress.org/plugins/gridxflex-captcha-security/) * Tags * [captcha](https://snd.wordpress.org/plugins/tags/captcha/)[comments](https://snd.wordpress.org/plugins/tags/comments/) [login](https://snd.wordpress.org/plugins/tags/login/)[security](https://snd.wordpress.org/plugins/tags/security/) [spam](https://snd.wordpress.org/plugins/tags/spam/) * [ترقي يافته ڏيک](https://snd.wordpress.org/plugins/gridxflex-captcha-security/advanced/) ## درجه بندي No reviews have been submitted yet. [Your review](https://wordpress.org/support/plugin/gridxflex-captcha-security/reviews/#new-post) [See all reviews](https://wordpress.org/support/plugin/gridxflex-captcha-security/reviews/) ## تعاون ڪندڙ * [ Grid X Flex ](https://profiles.wordpress.org/gridxflex/) ## سھائتا چوڻ لاءِ ڪجهه آهي؟ مدد گهرجي؟ [ڏسو سپورٽ فورم](https://wordpress.org/support/plugin/gridxflex-captcha-security/)