{"id":364009,"date":"2026-09-07T04:24:18","date_gmt":"2026-09-07T04:24:18","guid":{"rendered":"https:\/\/wordpress.org\/plugins\/reycob-form-firewall\/"},"modified":"2026-09-07T04:23:53","modified_gmt":"2026-09-07T04:23:53","slug":"reycob-form-firewall","status":"publish","type":"plugin","link":"https:\/\/os.wordpress.org\/plugins\/reycob-form-firewall\/","author":23136067,"comment_status":"closed","ping_status":"closed","template":"","meta":{"version":"1.3.3","stable_tag":"1.3.3","tested":"7.1","requires":"6.0","requires_php":"7.4","requires_plugins":null,"header_name":"Reycob Form Firewall","header_author":"Reycob","header_description":"Capa de protecci\u00f3n para formularios p\u00fablicos: CAPTCHA propio, l\u00edmites de frecuencia, honeypot, prueba de navegador y validaci\u00f3n de origen.","assets_banners_color":"4f628e","last_updated":"2026-09-07 04:23:53","external_support_url":"","external_repository_url":"","donate_link":"","header_plugin_uri":"","header_author_uri":"","rating":0,"author_block_rating":0,"active_installs":0,"downloads":45,"num_ratings":0,"support_threads":0,"support_threads_resolved":0,"author_block_count":0,"sections":["description","installation","faq","changelog"],"tags":{"1.3.3":{"tag":"1.3.3","author":"reycob38","date":"2026-09-07 04:23:53","revision":3684147}},"upgrade_notice":{"1.3.3":"<p>Maintenance update for WordPress.org review feedback about endpoint detection and readable assets.<\/p>"},"ratings":[],"assets_icons":{"icon-128x128.png":{"filename":"icon-128x128.png","revision":3684157,"resolution":"128x128","location":"assets","locale":"","width":128,"height":128},"icon-256x256.png":{"filename":"icon-256x256.png","revision":3684157,"resolution":"256x256","location":"assets","locale":"","width":256,"height":256}},"assets_banners":{"banner-1544x500.png":{"filename":"banner-1544x500.png","revision":3684157,"resolution":"1544x500","location":"assets","locale":"","width":1544,"height":500},"banner-772x250.png":{"filename":"banner-772x250.png","revision":3684157,"resolution":"772x250","location":"assets","locale":"","width":772,"height":250}},"assets_blueprints":{},"all_blocks":[],"tagged_versions":["1.3.3"],"block_files":[],"assets_screenshots":[],"screenshots":[]},"plugin_section":[],"plugin_tags":[362,601,1229,2419,286],"plugin_category":[42,44,45],"plugin_contributors":[270488],"plugin_business_model":[],"class_list":["post-364009","plugin","type-plugin","status-publish","hentry","plugin_tags-captcha","plugin_tags-forms","plugin_tags-login-security","plugin_tags-spam-protection","plugin_tags-woocommerce","plugin_category-contact-forms","plugin_category-discussion-and-community","plugin_category-ecommerce","plugin_contributors-reycob38","plugin_committers-reycob38"],"banners":{"banner":"https:\/\/ps.w.org\/reycob-form-firewall\/assets\/banner-772x250.png?rev=3684157","banner_2x":"https:\/\/ps.w.org\/reycob-form-firewall\/assets\/banner-1544x500.png?rev=3684157","banner_rtl":false,"banner_2x_rtl":false},"icons":{"svg":false,"icon":"https:\/\/ps.w.org\/reycob-form-firewall\/assets\/icon-128x128.png?rev=3684157","icon_2x":"https:\/\/ps.w.org\/reycob-form-firewall\/assets\/icon-256x256.png?rev=3684157","generated":false},"screenshots":[],"raw_content":"<!--section=description-->\n<p>Reycob Form Firewall adds a lightweight protection layer for public forms without using an external CAPTCHA service.<\/p>\n\n<p>Main features:<\/p>\n\n<ul>\n<li>Local math CAPTCHA loaded only when the visitor interacts with the checkbox.<\/li>\n<li>Browser proof token, honeypot field, and origin validation for protected forms.<\/li>\n<li>Rate limits per visitor and per endpoint.<\/li>\n<li>Specific protection for WooCommerce product reviews against links, duplicated spam, and repeated abusive submissions.<\/li>\n<li>Automatic exclusions for WooCommerce cart, checkout, payments, coupons, shipping, Store API, REST API, webhooks, cron, and server-to-server requests.<\/li>\n<li>Admin settings for limits, CAPTCHA, browser proof mode, IP source, and excluded paths.<\/li>\n<li>Developer opt-out with <code>data-rffw-skip=\"1\"<\/code> and opt-in for custom admin-post or admin-ajax actions through the <code>rffw_protected_actions<\/code> filter.<\/li>\n<\/ul>\n\n<p>The plugin is designed for visible public forms. It does not modify global <code>fetch<\/code> or <code>XMLHttpRequest<\/code>, does not call third-party APIs, and does not log IP addresses or submitted form contents.<\/p>\n\n<p>The JavaScript and CSS files distributed with the plugin are the human-readable source files. No minification, bundling, compilation, npm, webpack, or other build step is required.<\/p>\n\n<h3>Privacy<\/h3>\n\n<p>The plugin does not collect analytics, does not send data to external services, and does not store submitted form contents.<\/p>\n\n<p>Temporary tokens and hashed rate-limit keys may be stored in WordPress transients to validate CAPTCHA challenges, browser proof checks, and request frequency. These temporary values expire automatically.<\/p>\n\n<!--section=installation-->\n<ol>\n<li>Upload the plugin folder to <code>\/wp-content\/plugins\/reycob-form-firewall\/<\/code>, or install it through the WordPress Plugins screen.<\/li>\n<li>Activate <strong>Reycob Form Firewall<\/strong>.<\/li>\n<li>Go to <strong>Settings &gt; Form Firewall<\/strong>.<\/li>\n<li>Review the default limits and clear any page cache\/CDN cache after activation.<\/li>\n<li>Test your public contact forms, login, registration, comments, product reviews, cart, checkout, and payment flow.<\/li>\n<\/ol>\n\n<!--section=faq-->\n<dl>\n<dt id=\"does%20it%20use%20google%20recaptcha%20or%20another%20external%20service%3F\"><h3>Does it use Google reCAPTCHA or another external service?<\/h3><\/dt>\n<dd><p>No. The CAPTCHA is generated and verified locally by WordPress.<\/p><\/dd>\n<dt id=\"does%20it%20protect%20woocommerce%20checkout%3F\"><h3>Does it protect WooCommerce checkout?<\/h3><\/dt>\n<dd><p>No. Checkout, cart, coupons, payment callbacks, shipping calculations, Store API, and product add-to-cart actions are intentionally excluded so normal store operations keep working.<\/p><\/dd>\n<dt id=\"does%20it%20protect%20woocommerce%20reviews%3F\"><h3>Does it protect WooCommerce reviews?<\/h3><\/dt>\n<dd><p>Yes. Product reviews use the general form protections plus an additional review-specific spam check.<\/p><\/dd>\n<dt id=\"can%20i%20exclude%20a%20form%3F\"><h3>Can I exclude a form?<\/h3><\/dt>\n<dd><p>Yes. Add <code>data-rffw-skip=\"1\"<\/code> to the form element. Administrators can also exclude paths from the settings screen.<\/p><\/dd>\n<dt id=\"can%20developers%20protect%20custom%20ajax%20or%20admin-post%20actions%3F\"><h3>Can developers protect custom AJAX or admin-post actions?<\/h3><\/dt>\n<dd><p>Yes. Use the <code>rffw_protected_actions<\/code> filter to return an array of action names that should require the firewall checks.<\/p><\/dd>\n\n<\/dl>\n\n<!--section=changelog-->\n<h4>1.3.3<\/h4>\n\n<ul>\n<li>Use WordPress-generated endpoint paths for admin AJAX, admin post, comments, login, REST, XML-RPC, and admin area detection.<\/li>\n<li>Move CAPTCHA styles into a human-readable CSS source file and enqueue it normally.<\/li>\n<\/ul>\n\n<h4>1.3.2<\/h4>\n\n<ul>\n<li>Prepared WordPress.org readme, centralized sanitized request reads, and adjusted automated review compatibility.<\/li>\n<\/ul>\n\n<h4>1.3.1<\/h4>\n\n<ul>\n<li>Limited protection scope to public forms, login, registration, comments, and WooCommerce product reviews.<\/li>\n<li>Excluded WooCommerce cart, checkout, payments, Store API, webhooks, and license\/API requests.<\/li>\n<li>Removed global request interception and added on-demand CAPTCHA loading.<\/li>\n<\/ul>","raw_excerpt":"Protects public WordPress forms, login, registration, comments, and WooCommerce product reviews with a local CAPTCHA and rate limits.","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/os.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin\/364009","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/os.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin"}],"about":[{"href":"https:\/\/os.wordpress.org\/plugins\/wp-json\/wp\/v2\/types\/plugin"}],"replies":[{"embeddable":true,"href":"https:\/\/os.wordpress.org\/plugins\/wp-json\/wp\/v2\/comments?post=364009"}],"author":[{"embeddable":true,"href":"https:\/\/os.wordpress.org\/plugins\/wp-json\/wporg\/v1\/users\/reycob38"}],"wp:attachment":[{"href":"https:\/\/os.wordpress.org\/plugins\/wp-json\/wp\/v2\/media?parent=364009"}],"wp:term":[{"taxonomy":"plugin_section","embeddable":true,"href":"https:\/\/os.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_section?post=364009"},{"taxonomy":"plugin_tags","embeddable":true,"href":"https:\/\/os.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_tags?post=364009"},{"taxonomy":"plugin_category","embeddable":true,"href":"https:\/\/os.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_category?post=364009"},{"taxonomy":"plugin_contributors","embeddable":true,"href":"https:\/\/os.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_contributors?post=364009"},{"taxonomy":"plugin_business_model","embeddable":true,"href":"https:\/\/os.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_business_model?post=364009"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}