CreaCaptcha

Captcha

Packages

GitUpdate

Classes

Analytics: Records security events into per-day and per-hour aggregate counters and, when the detailed event log is enabled, into a dedicated database table.
EmailObfuscator: Obfuscates mailto: links and plain-text email addresses in front-end output. The real address is XOR-hex encoded into a data-cce attribute and restored client-side by the decoder script. Two modes share this class: the content-filter mode (process()) and the full-page-buffer mode (process_page()). See the module-7 and module-8 design specs.
Engine: Wraps the bundled ALTCHA library for the WordPress plugin.
Firewall: Blocks requests by client IP or user-agent before WordPress processes them.
Interceptor: Inspects front-end POST requests and enforces a valid ALTCHA payload for requests whose path matches a configured pattern. See the module-2 design spec for the bypass chain (§6) and the guard decision (§7/§8).
RateLimiter: Counts requests per client IP in a fixed time window and blocks with HTTP 429 once the configured limit is exceeded. See the module-4 design spec §6.
UnderAttack: Gates anonymous front-end page views behind an interstitial proof-of-work challenge while under-attack mode is active. See the module-5 design spec.
Cloudflare_Command: `wp creacaptcha cloudflare …` — refresh, clear and status for the cached Cloudflare IP-range list.
Command: Inspects and controls CreaCaptcha from the command line.
Doctor_Command: `wp creacaptcha doctor`
List_Command: Manages one list-type setting — IP block/allow list, UA block list or the interceptor path list. The same class backs the blocklist, allowlist, ua-blocklist and paths command namespaces.
Log_Command: Inspects and maintains the optional event-log table.
Settings_Command: Reads, writes, exports, imports and resets CreaCaptcha settings.
Test_Bypass_Command: `wp creacaptcha test-bypass`

Constants

CREATIONELL_CAPTCHA_EXPORT_MAX_ROWS = 50000: The default upper bound on rows in a single CSV export.
CREATIONELL_CAPTCHA_EXPORT_SCHEMA = 1: Schema version of the settings-export format.
CREATIONELL_CAPTCHA_HARDENING_DISMISS_ARG = 'creationell_captcha_hardening_dismiss': Query-Parameter des Ausblenden-Links.
CREATIONELL_CAPTCHA_HARDENING_DISMISS_META = 'creationell_captcha_hardening_dismissed': User-Meta-Schlüssel, unter dem ein Benutzer den Hinweis wegklickt.
CREATIONELL_CAPTCHA_LOCALE_MAP = [ // Deutsch 'de_DE' => 'de', 'de_DE_formal' => 'de', 'de_AT' => 'de', 'de_CH' => 'de', 'de_CH_informal' => 'de', // Englisch 'en_US' => 'en', 'en_GB' => 'en', 'en_AU' => 'en', 'en_CA' => 'en', 'en_NZ' => 'en', 'en_ZA' => 'en', // Französisch 'fr_FR' => 'fr-fr', 'fr_BE' => 'fr-fr', 'fr_LU' => 'fr-fr', 'fr_CH' => 'fr-fr', 'fr_CA' => 'fr-ca', // Spanisch (Europa) 'es_ES' => 'es-es', // Spanisch (LatAm — alle nach es-419) 'es_AR' => 'es-419', 'es_CL' => 'es-419', 'es_CO' => 'es-419', 'es_CR' => 'es-419', 'es_DO' => 'es-419', 'es_EC' => 'es-419', 'es_GT' => 'es-419', 'es_HN' => 'es-419', 'es_MX' => 'es-419', 'es_PA' => 'es-419', 'es_PE' => 'es-419', 'es_PR' => 'es-419', 'es_UY' => 'es-419', 'es_VE' => 'es-419', // Portugiesisch 'pt_PT' => 'pt-pt', 'pt_AO' => 'pt-pt', 'pt_BR' => 'pt-br', // Italienisch / Niederländisch / Polnisch 'it_IT' => 'it', 'nl_NL' => 'nl', 'nl_BE' => 'nl', 'pl_PL' => 'pl', // Tschechisch / Slowakisch 'cs_CZ' => 'cs', 'sk_SK' => 'sk', // Nordisch 'da_DK' => 'da', 'sv_SE' => 'sv', 'fi' => 'fi', 'nb_NO' => 'nb', 'nn_NO' => 'nb', // Sonstige EU 'hu_HU' => 'hu', 'ro_RO' => 'ro', 'el' => 'el', ]: Maps WordPress locales to the matching ALTCHA i18n locale bundle.
CREATIONELL_CAPTCHA_PURPOSE_UA_CTX = 'underattack-ctx': Purpose label of the under-attack code-challenge suppression token (`ctx`).
CREATIONELL_CAPTCHA_PURPOSE_UA_PASS = 'underattack-pass': Purpose label of the under-attack pass-cookie key.
CREATIONELL_CAPTCHA_SANITIZE_FORM = 'form': Sanitiser context: the settings form (`options.php`).
CREATIONELL_CAPTCHA_SANITIZE_PROGRAMMATIC = 'programmatic': Sanitiser context: programmatischer Schreibvorgang (Import, Werksreset, „Standardwerte laden", WP-CLI).
CREATIONELL_CAPTCHA_SANITIZE_RESET = 'reset': Sanitiser context: Werksreset (`creationell_captcha_reset_settings()`).
CREATIONELL_CAPTCHA_UA_CTX_TTL = 120: Lifetime (seconds) of a `ctx` suppression token. The interstitial widget fetches the challenge on load, i.e. within seconds of the 503 being rendered; two minutes is generous for that and replaces the ~10 minutes the old 5-minute-bucket pair accepted (BK-4).

Functions

creationell_captcha_register_admin_menu() : void: Registers the top-level "CreaCaptcha" admin menu entry.
creationell_captcha_render_settings_page() : void: Renders the tabbed settings page.
creationell_captcha_render_import_warning() : void: Renders the "an import replaces everything" warning on the Werkzeuge page.
creationell_captcha_render_trust_notice() : void: Renders the "proxy mode on but trust-set empty" admin notice on plugin pages.
creationell_captcha_tabbed_page_hooks() : array<int, string>: Records and reports the admin-page hook suffixes of the plugin's tab-organised pages.
creationell_captcha_active_tab() : string: Determines the active tab from the request, whitelisted against $tabs.
creationell_captcha_render_nav_tabs() : void: Renders the no-JavaScript fallback style and the nav-tab bar.
creationell_captcha_csv_cell() : string: Neutralises a CSV cell against spreadsheet formula injection.
creationell_captcha_export_events() : void: Streams the filtered event log as a CSV download.
creationell_captcha_register_analytics_page() : void: Registers the "Statistik" submenu page under the CreaCaptcha menu.
creationell_captcha_analytics_labels() : array<string, string>: Human-readable labels for the seven event types.
creationell_captcha_analytics_groups() : array<int, array{title: string, description: string, types: array}>: Thematic groups for the overview tab: title, explanation and the member event types with their short in-group labels.
creationell_captcha_analytics_tabs() : array<string, string>: The three tabs of the analytics page.
creationell_captcha_sum_recent_days() : array<string, int>: Sums the $days most recent day buckets, per event type.
creationell_captcha_sum_recent_hours() : array<string, int>: Sums the $hours most recent hour buckets, per event type.
creationell_captcha_render_analytics_page() : void: Renders the tabbed analytics dashboard page.
creationell_captcha_render_analytics_overview() : void: Renders the "Übersicht" tab: four 24-hour KPI tiles and one four-window comparison table per thematic group.
creationell_captcha_render_analytics_history() : void: Renders the "Verlauf" tab: the day-by-day table for the last 30 days.
creationell_captcha_events_query_args() : array{search: string, event_type: string, date_from: string, date_to: string}: Reads and sanitises the event-log filter from the request.
creationell_captcha_render_analytics_events() : void: Renders the "Ereignisse" tab: filter toolbar, the event table with a detail link per row, the embedded event data and the detail modal.
creationell_captcha_render_event_modal() : void: Renders the (initially hidden) event-detail modal skeleton.
creationell_captcha_render_events_toolbar() : void: Renders the event-log filter toolbar: search, type filter, date range, the "Filtern"/"Zurücksetzen" controls and the CSV export link.
creationell_captcha_render_events_pagination() : void: Renders the pagination navigation below the event-log table.
creationell_captcha_analytics() : Analytics: Returns the shared analytics recorder instance.
creationell_captcha_record_event() : void: Records a security event of the given type.
creationell_captcha_enqueue_admin_assets() : void: Enqueues admin styles and scripts on the CreaCaptcha admin pages.
creationell_captcha_cloudflare_snapshot() : array{v4: string[], v6: string[], updated_at: string}: Returns the bundled Cloudflare snapshot.
creationell_captcha_cloudflare_ranges() : array<string|int, string>: The active CF range list: cached option (if fresh and valid) → bundled snapshot.
creationell_captcha_refresh_cloudflare_ips_now() : array{ok: bool, v4: int, v6: int, fetched_at: int|null, error: string|null}: Fetches the live Cloudflare ranges and writes them to the cache option.
creationell_captcha_clear_cloudflare_cache() : bool: Deletes the cached Cloudflare-range option. The next read falls back to the bundled snapshot. Returns true when the option existed and was deleted, false when the option was absent or the delete failed.
creationell_captcha_fetch_cloudflare_list() : array<string|int, string>: Fetches one Cloudflare endpoint and returns the valid CIDR entries.
creationell_captcha_sync_cloudflare_cron() : void: Ensures the daily refresh cron slot is in sync with the auto-refresh toggle.
creationell_captcha_code_challenge_font_usable() : bool: Probes whether GD can actually render text with the vendored TTF font.
creationell_captcha_render_code_image() : string: Renders a PNG of the given code and returns the raw bytes. Caller is responsible for emitting headers (`Content-Type: image/png`, `Cache-Control: no-store`) and the body.
creationell_captcha_should_issue_code_challenge() : bool: Decides whether the current /challenge request should attach a code-challenge instruction. Returns true iff:
creationell_captcha_code_charset() : string: Returns the active charset string for the configured option.
creationell_captcha_generate_code() : string: Generates a fresh random code from the configured charset.
creationell_captcha_code_token_issue() : string: Issues a token backed by a server-side WP transient that stores the expected code for at most $expiry_seconds. Returns the opaque ID that `/code-image` and `/code-verify` use to look the code up again.
creationell_captcha_code_token_verify() : string|null: Looks up the code for a token and returns it, or null on: - malformed token (not 32 hex chars) - missing transient (expired or unknown)
creationell_captcha_code_fail_key() : string: Transient name of the per-token failed-attempt counter (CM-3).
creationell_captcha_code_token_fail() : void: Records one wrong image-code submission for a token and invalidates the token once its attempt budget is spent.
creationell_captcha_rest_code_image() : WP_REST_Response: Handles GET /code-image?t=<token>. Looks up the code from the token (server-side transient), renders the PNG, returns 410 on token failure.
creationell_captcha_rest_code_verify() : WP_REST_Response: Handles POST /code-verify. Two body shapes:
creationell_captcha_register_code_challenge_routes() : void: Registers the two code-challenge REST routes. The /challenge handler itself stays in includes/rest.php; Task 11 extends it with the codeChallenge field and the data.ccode embed.
creationell_captcha_register_email_obfuscation() : void: Registers email obfuscation on `init`. The decoder script is always registered; then, unless the kill-switch is set or the feature is off, the configured mode is wired up — the content filters (module 7) or the full-page output buffer (module 8).
creationell_captcha_register_email_buffer() : void: Wires up the full-page-buffer mode: on `template_redirect` for non-feed front-end requests it enqueues the decoder script and starts an output buffer whose callback obfuscates the page body at flush time.
creationell_captcha_email_buffer_filter() : string: The buffer callback itself: decides whether this response gets rewritten and hands it to the obfuscator when it does.
creationell_captcha_response_is_html() : bool: Whether the response being buffered is (still) an HTML document.
creationell_captcha_run_firewall() : void: Runs the IP/user-agent firewall. Hooked on `init` at priority 0 so it fires before the rate limiter, the interceptor and any form-processing handler.
creationell_captcha_comments_active() : bool: Whether comment protection applies to the current request.
creationell_captcha_comments_render() : string: Injects the widget just above the comment form submit button.
creationell_captcha_comments_verify() : array<string, mixed>: Verifies the captcha before a comment is accepted.
creationell_captcha_login_enabled() : bool: Whether login protection is enabled.
creationell_captcha_login_render() : void: Renders the widget inside the login form.
creationell_captcha_login_form_middle() : string: Renders the widget inside `wp_login_form()`-based forms.
creationell_captcha_login_is_interactive() : bool: Whether the current request is an interactive, browser-submitted login attempt — as opposed to XML-RPC, REST/Application-Passwords, AJAX or a programmatic `wp_signon()` call made by other code.
creationell_captcha_login_verify() : WP_User|WP_Error|null: Verifies the captcha during an interactive login.
creationell_captcha_password_reset_enabled() : bool: Whether password-reset protection is enabled.
creationell_captcha_password_reset_render() : void: Renders the widget inside the lost-password form.
creationell_captcha_password_reset_exempt_reason() : string|null: Why the current request is not a public lost-password form submission.
creationell_captcha_password_reset_exempt_label() : string: Human-readable label for an exemption reason, for the event log.
creationell_captcha_password_reset_verify() : void: Verifies the captcha during a password-reset request.
creationell_captcha_registration_enabled() : bool: Whether registration protection is enabled.
creationell_captcha_registration_render() : void: Renders the widget inside the registration form.
creationell_captcha_registration_verify() : WP_Error: Verifies the captcha during registration.
creationell_captcha_hardening_covered_family() : string: Ermittelt, WELCHE Adressfamilie ein gespeicherter Listeneintrag vollständig abdeckt und die Liste für diese Familie damit als Auswahl aufhebt.
creationell_captcha_hardening_mapped_ipv4_cidr() : string: Erkennt einen CIDR-Bereich, der in IPv4-mapped Schreibweise notiert ist (`::ffff:0:0/96`, `::ffff:203.0.113.0/120`), und liefert seine gewöhnliche IPv4-Schreibweise zurück.
creationell_captcha_hardening_is_catch_all_pattern() : bool: Prüft, ob ein `bypass_ua_allow`-Muster jeden Browser-Kennzeichner trifft.
creationell_captcha_hardening_matches_every_user_agent() : bool: Prüft, ob ein `bypass_ua_allow`-Muster jeden realistischen User-Agent trifft, ohne vom Catch-all-Guard aussortiert zu werden (Befund B-M2).
creationell_captcha_hardening_scan() : array<int, array{id: string, liste: string, eintrag: string, wirkung: string, tab: string, meldung: string}>: Durchsucht einen Satz Einstellungen nach gefährlicher Bestandskonfiguration.
creationell_captcha_hardening_findings() : array<int, array{id: string, liste: string, eintrag: string, wirkung: string, tab: string, meldung: string}>: Führt den Scan gegen die aktuell gespeicherten Einstellungen aus.
creationell_captcha_hardening_fingerprint() : string: Kurzkennung des aktuellen Fundbildes.
creationell_captcha_hardening_dismiss_redirect_target() : string: Baut das Ziel des Redirects nach dem Ausblenden-Klick: dieselbe Seite ohne den Ausblenden-Parameter und ohne die Nonce.
creationell_captcha_hardening_handle_dismiss() : void: Nimmt den Ausblenden-Klick entgegen.
creationell_captcha_hardening_render_notice() : void: Zeigt die gefundene Bestandskonfiguration als Admin-Hinweis.
creationell_captcha_resolve_widget_locale() : string|null: Resolves the active WordPress locale to a vendored ALTCHA locale code.
creationell_captcha_get_default_settings() : array<string, mixed>: Default plugin settings.
creationell_captcha_get_settings() : array<string, mixed>: Current plugin settings, merged over the defaults.
creationell_captcha_invalidate_settings_cache() : void: Drops the in-request settings cache. Wired to the option-change hooks below so callers that read settings after an update see the fresh value.
creationell_captcha_is_disabled() : bool: Whether the captcha is globally disabled via the wp-config constant.
creationell_captcha_sodium_available() : bool: Whether ext-sodium (required for Argon2id) is available.
creationell_captcha_generate_secrets() : array{signature: string, key_signature: string}: Generates both HMAC secrets and persists them (non-autoloaded).
creationell_captcha_get_secret() : string: Returns a stored HMAC secret, generating + persisting it on first use.
creationell_captcha_get_hmac_secret() : string: The HMAC signature secret (signs each challenge).
creationell_captcha_get_hmac_key_secret() : string: The HMAC key-signature secret (enables the fast verification path).
creationell_captcha_derive_hmac_key() : string: Derives a purpose-bound HMAC key from the plugin's base signature secret.
creationell_captcha_client_ua() : string: The request's User-Agent, capped at 256 bytes. MAC input for the under-attack tokens — never rendered, never stored.
creationell_captcha_underattack_pass_binding() : string: The fingerprint the under-attack pass cookie is bound to (BK-3).
creationell_captcha_underattack_pass_issue() : string: Mints an under-attack pass token for the current visitor.
creationell_captcha_underattack_pass_check() : bool: Verifies an under-attack pass token against the CURRENT visitor.
creationell_captcha_underattack_ctx_issue() : string: Mints a single-use `ctx` suppression token for one interstitial rendering.
creationell_captcha_underattack_ctx_check() : bool: Verifies a `ctx` suppression token and consumes it.
creationell_captcha_engine() : Engine: Shared captcha engine instance.
creationell_captcha_log() : void: Write a message to the debug log when CREATIONELL_CAPTCHA_DEBUG is active.
creationell_captcha_normalize_ip() : string: Canonicalises an IPv4-mapped IPv6 address (`::ffff:a.b.c.d`) into its plain IPv4 spelling. Every other value — including anything that is not an IP at all — is handed back unchanged.
creationell_captcha_get_client_ip() : string: Resolves the client IP address.
creationell_captcha_ip_in_list() : bool: Whether an IP matches any entry in a list of IPs or CIDR ranges.
creationell_captcha_ip_in_cidr() : bool: Whether an IP falls within a CIDR range. Supports IPv4 and IPv6.
creationell_captcha_is_valid_ip_or_cidr() : bool: Whether a string is a valid IP address or CIDR range (IPv4 or IPv6).
creationell_captcha_wildcard_match() : bool: Whether a subject matches any of the given wildcard patterns (case-insensitive).
creationell_captcha_private_ranges() : array<string|int, string>: Returns the canonical list of private/loopback CIDR ranges used when the `firewall_trust_private_ranges` toggle is active.
creationell_captcha_trusted_proxies_constant() : array<string|int, string>: Reads the optional `CREATIONELL_CAPTCHA_TRUSTED_PROXIES` wp-config constant as a list. Accepts either a string array or a comma/whitespace-separated scalar; invalid entries are dropped.
creationell_captcha_is_trusted_proxy() : bool: Whether the given IP belongs to a trusted upstream proxy.
creationell_captcha_evaluate_bypass() : array{reason: string, source: string}|false: Pure bypass evaluator — checks the three bypass sources against the supplied inputs without touching $_SERVER, $_COOKIE or any static cache. The caller is responsible for providing the values.
creationell_captcha_request_bypassed() : array{reason: string, source: string}|false: Whether the current request is allowed to bypass captcha, under-attack and firewall protections. Reads $_SERVER, $_COOKIE and the request's client IP, then delegates to `creationell_captcha_evaluate_bypass()`.
creationell_captcha_validate_action_pattern() : string|null: Validates a single interceptor-action pattern.
creationell_captcha_validate_cookie_entry() : string|null: Validates a single bypass-cookie entry of the form `name=value`.
creationell_captcha_anonymize_ip() : string: Truncates an IP for DSGVO-compliant storage. IPv4 → last octet zeroed, IPv6 → last 80 bits zeroed. Invalid IPs return ''.
creationell_captcha_request_body_fingerprint() : string: Returns a JSON-encoded fingerprint of $_POST: { field-name: value-byte-length }.
creationell_captcha_block_response() : void: Sends a fail-closed block response and terminates the request.
creationell_captcha_base64url_encode() : string: Base64URL encoder (RFC 4648 §5) — strips standard-base64 padding and replaces +/ with -_ so the value is URL-safe.
creationell_captcha_base64url_decode() : string: Base64URL decoder — accepts unpadded URL-safe input and returns the raw bytes. Returns the empty string on malformed input (no exceptions).
creationell_captcha_ratelimit_current_count() : int: Reads the current rate-limit counter for an IP without incrementing it.
creationell_captcha_cf7_active() : bool: Whether the Contact Form 7 integration is active.
creationell_captcha_cf7_register_tag() : void: Registers the [creationell_captcha] Contact Form 7 form-tag.
creationell_captcha_cf7_tag_handler() : string: Renders the widget for the [creationell_captcha] form-tag.
creationell_captcha_cf7_auto_inject() : string: Auto-injects the widget into CF7 forms without a [creationell_captcha] tag.
creationell_captcha_cf7_verify() : bool: Verifies the captcha on a Contact Form 7 submission.
creationell_captcha_forminator_active() : bool: Whether the Forminator integration is active.
creationell_captcha_forminator_inject() : string: Auto-injects the widget before the submit button of a Forminator custom form.
creationell_captcha_forminator_verify() : array<int, array<string, string>>: Verifies the captcha on a Forminator custom-form submission.
creationell_captcha_woocommerce_active() : bool: Whether any WooCommerce protection applies right now.
creationell_captcha_wc_uses_block_checkout() : bool: Whether the currently configured WooCommerce checkout page uses the Block Checkout (the `woocommerce/checkout` block) rather than the classic `[woocommerce_checkout]` shortcode.
creationell_captcha_wc_checkout_active() : bool: Whether the WooCommerce checkout protection is active.
creationell_captcha_wc_checkout_render() : void: Renders the widget directly before the Place-Order button on the checkout.
creationell_captcha_wc_checkout_verify_cache() : bool|null: Per-request cache of the checkout's own verify verdict, keyed by the raw `altcha` payload currently in `$_POST`.
creationell_captcha_wc_checkout_verify() : void: Verifies the captcha during checkout validation.
creationell_captcha_wc_login_active() : bool: Whether the WooCommerce my-account login protection is active.
creationell_captcha_wc_login_render() : void: Renders the widget at the bottom of the WooCommerce login form.
creationell_captcha_wc_login_verify() : mixed: Verifies the captcha on a WooCommerce my-account login submission.
creationell_captcha_wc_registration_active() : bool: Whether the WooCommerce registration protection is active.
creationell_captcha_wc_registration_render() : void: Renders the widget at the bottom of the WooCommerce registration form.
creationell_captcha_wc_nonce_verifies() : bool: Reads a nonce value the way the given WooCommerce field name(s) would, replicating WooCommerce core's own field-name-agnostic fallback: the dedicated field wins if present, otherwise the generic `_wpnonce` field is used. WooCommerce's own nonce checks do not care WHICH field carried the value — only whether the value itself verifies against the action name.
creationell_captcha_wc_registration_form_context() : bool: Whether the current `wc_create_new_customer()` call originates from a genuine WooCommerce registration- or checkout-form POST, as opposed to a Store-API, programmatic or CLI call that never had a form (and therefore no `altcha` field) in the first place.
creationell_captcha_wc_registration_verify() : mixed: Verifies the captcha during WooCommerce my-account registration.
creationell_captcha_wc_lost_password_active() : bool: Whether the WooCommerce lost-password render is active.
creationell_captcha_wc_lost_password_render() : void: Renders the widget inside the WooCommerce lost-password form.
creationell_captcha_wpforms_active() : bool: Whether the WPForms integration is active.
creationell_captcha_wpforms_inject() : void: Auto-injects the widget directly before the WPForms submit button.
creationell_captcha_wpforms_verify() : void: Verifies the captcha on a WPForms submission.
creationell_captcha_interceptor_inject_buffer_start() : void: Conditionally starts the output buffer on template_redirect priority 0.
creationell_captcha_interceptor_inject_buffer() : string: Buffer callback. Replaces every `<form …>…</form>` with the same form plus an `<altcha-widget>` inserted directly before `</form>`. Idempotent — forms that already contain `<altcha-widget` are returned unchanged.
creationell_captcha_run_interceptor() : void: Runs the request interceptor. Hooked on `init` at priority 1 so it fires before any form-processing handler.
creationell_captcha_protect_path() : void: Registers one or more path patterns to be guarded by the interceptor.
creationell_captcha_activate() : void: Runs on plugin activation: seeds default options and HMAC secrets.
creationell_captcha_deactivate() : void: Runs on plugin deactivation: clears every cron slot the plugin owns, sweeps the expired replay markers out of the options table and lets every module react via the `creationell_captcha_deactivated` action hook.
creationell_captcha_deactivate_site() : void: The deactivation work for exactly one site: clears the three cron slots this plugin owns there and sweeps that site's expired replay markers.
creationell_captcha_deactivate_network() : int: Runs the per-site deactivation work on every site of the network.
creationell_captcha_delete_expired_replay_markers() : int: Deletes those replay-marker options of the current site whose lifetime has already run out.
creationell_captcha_run_rate_limiter() : void: Runs the per-IP rate limiter. Hooked on `init` at priority 0; registered after the firewall so the firewall runs first.
creationell_captcha_request_path() : string: Returns the path portion of the current request, the way WordPress core derives it — NOT the way a URL parser would.
creationell_captcha_request_target() : string: Der aktuelle Request als relativer Ziel-URI: Pfad aus `creationell_captcha_request_path()`, Query aus derselben Zeichenkette.
creationell_captcha_current_rest_route() : string: Returns the REST route the current request actually addresses.
creationell_captcha_normalize_rest_route() : string: Normalises a raw `rest_route` value into the plugin's canonical route form.
creationell_captcha_register_rest_routes() : void: Registers the public challenge route.
creationell_captcha_rest_challenge() : WP_REST_Response: Returns a fresh, single-use challenge. Records the issuance via the standard event channel — aggregate counters always increment, the detail-log entry is gated by the `log_challenge` per-type toggle from Modul 11c.
creationell_captcha_canonical_params_json() : string: Canonical-JSON serialisation of ALTCHA challenge parameters, byte- identical to `altcha-lib-php`'s `ChallengeParameters::toCanonicalJson()` (= ksort top-level + recursive ksort on assoc sub-arrays, JSON-encoded with UNESCAPED_SLASHES | UNESCAPED_UNICODE, null keys dropped).
creationell_captcha_canonical_sort_recursive() : void: Recursive helper used by `canonical_params_json` — mirrors the lib's `sortRecursive`. List arrays (sequential integer keys) keep their order; associative arrays get `ksort`-ed in place.
creationell_captcha_list_setting_keys() : array<int, string>: Setting keys whose value is a list (every `textarea` field).
creationell_captcha_export_settings() : array<string, mixed>: Builds the settings-export payload.
creationell_captcha_import_settings() : array<string, mixed>|WP_Error: Validates and applies a settings-export payload.
creationell_captcha_reset_settings() : void: Full factory reset: writes the complete default settings array, which also empties every list and drops stored keys outside the current field specification. Secrets, analytics counters and the event log are left untouched.
creationell_captcha_load_default_settings() : void: Resets every non-list setting to its default while preserving the current list values (IP block/allow, UA block, interceptor paths).
creationell_captcha_admin_tabs() : array<string, string>: Ordered list of the admin settings tabs.
creationell_captcha_admin_sections() : array<string, array<string, string>>: Settings sections and the tab each one belongs to.
creationell_captcha_settings_fields() : array<string, array<string, mixed>>: Field specification for the captcha settings.
creationell_captcha_register_settings() : void: Registers the plugin setting, the per-tab sections and the fields.
creationell_captcha_sanitize_context() : string|null: Liest — und setzt optional — den angehefteten Sanitizer-Kontext.
creationell_captcha_with_sanitize_context() : mixed: Führt $callback aus, während der Sanitizer-Kontext auf $context festgelegt ist.
creationell_captcha_sanitize_settings_option() : array<string, mixed>: Einstiegspunkt des `sanitize_option_creationell_captcha_settings`-Filters.
creationell_captcha_truncate_setting_text() : string: Kürzt einen Einstellungswert auf höchstens $max_chars Zeichen und garantiert gültiges UTF-8.
creationell_captcha_truncate_chars() : string: Kürzt gültiges UTF-8 ohne mbstring auf $max_chars ZEICHEN.
creationell_captcha_truncate_chars_by_bytes() : string: Dritte und letzte Kürzungsstufe: zählt UTF-8-Startbytes.
creationell_captcha_sanitize_settings() : array<string, mixed>: Sanitises the settings array before it is stored.
creationell_captcha_sync_event_log_table() : void: Legt die Ereignis-Log-Tabelle an, sobald das Detail-Log eingeschaltet GESPEICHERT wurde.
creationell_captcha_store_settings() : void: Der eine Schreibweg des Plugins auf `creationell_captcha_settings`.
creationell_captcha_render_engine_section() : void: Renders the description shown at the top of the Proof-of-Work-Engine section.
creationell_captcha_render_widget_appearance_section() : void: Renders the description shown at the top of the widget-appearance section.
creationell_captcha_render_code_challenge_section() : void: Renders the description shown at the top of the code-challenge section.
creationell_captcha_render_core_forms_section() : void: Renders the description shown at the top of the core-forms section.
creationell_captcha_render_interceptor_section() : void: Renders the description shown at the top of the interceptor section.
creationell_captcha_render_form_plugins_section() : void: Renders the description shown at the top of the form-plugins section.
creationell_captcha_render_proxy_section() : void: Renders the description shown at the top of the proxy section.
creationell_captcha_render_bypass_section() : void: Renders the description shown at the top of the bypass section.
creationell_captcha_render_firewall_section() : void: Renders the description shown at the top of the firewall section.
creationell_captcha_render_ratelimit_section() : void: Renders the description shown at the top of the rate-limiting section.
creationell_captcha_render_underattack_section() : void: Renders the description shown at the top of the under-attack section.
creationell_captcha_render_underattack_appearance_section() : void: Renders the description shown at the top of the under-attack appearance section.
creationell_captcha_render_analytics_section() : void: Renders the description shown at the top of the analytics section.
creationell_captcha_render_email_section() : void: Renders the description shown at the top of the email-protection section.
creationell_captcha_render_field() : void: Renders a single settings field.
creationell_captcha_field_label() : string: Liefert das Label eines Einstellungsfeldes (Fallback: der Schlüssel selbst).
creationell_captcha_field_spec() : array<string, array<string, mixed>>: Request-lokal gehaltene Feldspezifikation für die beiden Label-Helfer.
creationell_captcha_field_option_label() : string: Liefert das Options-Label eines `select`-Feldes (Fallback: der Rohwert).
creationell_captcha_tools_redirect() : never: Stores a one-shot admin notice and redirects back to the Werkzeuge page.
creationell_captcha_tools_guard() : void: Guards a tools action: requires manage_options and a valid nonce.
creationell_captcha_handle_export_settings() : void: Streams the current settings as a JSON download.
creationell_captcha_handle_import_settings() : void: Handles the settings-import upload.
creationell_captcha_collect_settings_error_messages() : array<int, string>: Collects the plugin's queued settings-error messages, de-duplicated.
creationell_captcha_handle_reset_settings() : void: Handles the full factory reset.
creationell_captcha_handle_load_defaults() : void: Handles "load defaults" (keeps the lists).
creationell_captcha_handle_cloudflare_refresh() : void: Triggers a manual Cloudflare-range refresh from the Werkzeuge page.
creationell_captcha_handle_cloudflare_clear() : void: Empties the cached Cloudflare-range option from the Werkzeuge page.
creationell_captcha_register_tools_page() : void: Registers the "Werkzeuge" submenu page under the CreaCaptcha menu.
creationell_captcha_render_tools_notice() : void: Renders the one-shot admin notice left behind by a tools action.
creationell_captcha_render_tools_page() : void: Renders the "Werkzeuge" page.
creationell_captcha_render_cloudflare_status() : void: Renders the Cloudflare-cache status block inside the Werkzeuge tool card.
creationell_captcha_run_under_attack() : void: Runs the under-attack interstitial gate for front-end page views. Hooked on `template_redirect` — fires only for front-end requests, so wp-admin, wp-login.php, REST and cron are inherently exempt.
creationell_captcha_maybe_upgrade() : void: Runs schema migrations when the stored version differs from the running one.
creationell_captcha_migrate_widget_mode() : void: Migrates the legacy `widget_mode` setting (Modul 11a) to the new `widget_display` + `widget_auto_trigger` pair (Modul 14). Idempotent — if `widget_display` is already present in the stored option, the migration is skipped.
creationell_captcha_store_migrated_settings() : void: Writes a migrated settings array back — through the sanitiser, with the write context pinned.
creationell_captcha_register_assets() : void: Registers the widget script and — for Argon2id — its worker registration.
creationell_captcha_safe_inline_css() : string: Macht eine gespeicherte CSS-Zeichenkette sicher für die Ausgabe in einem `<style>`-Element.
creationell_captcha_build_widget_markup() : string: Builds the ALTCHA widget markup as a plain string. Enqueues the widget script as a side effect.
creationell_captcha_render_widget() : void: Renders the ALTCHA widget markup and enqueues its assets.
creationell_captcha_verify_payload() : bool: Verifies a raw base64 ALTCHA payload string.
creationell_captcha_verify_request() : bool: Reads and verifies the ALTCHA payload from the current POST request.
creationell_captcha_widget() : void: Public template tag — renders the ALTCHA widget.
creationell_captcha_get_widget_markup() : string: Returns the ALTCHA widget markup as a string.
creationell_captcha_widget_shortcode() : string: Shortcode handler for [creationell_captcha].
creationell_captcha_uninstall_site() : void: Removes every trace of the plugin from the site that is currently switched to: options, replay markers, transients, cron slots and the event-log table.
creationell_captcha_uninstall_user_meta() : void: Removes the plugin's per-user data.

CREATIONELL_CAPTCHA_EXPORT_MAX_ROWS

The default upper bound on rows in a single CSV export.


    public
        mixed
    CREATIONELL_CAPTCHA_EXPORT_MAX_ROWS
    = 50000

CREATIONELL_CAPTCHA_EXPORT_SCHEMA

Schema version of the settings-export format.


    public
        mixed
    CREATIONELL_CAPTCHA_EXPORT_SCHEMA
    = 1

CREATIONELL_CAPTCHA_HARDENING_DISMISS_ARG

Query-Parameter des Ausblenden-Links.


    public
        mixed
    CREATIONELL_CAPTCHA_HARDENING_DISMISS_ARG
    = 'creationell_captcha_hardening_dismiss'

CREATIONELL_CAPTCHA_HARDENING_DISMISS_META

User-Meta-Schlüssel, unter dem ein Benutzer den Hinweis wegklickt.


    public
        mixed
    CREATIONELL_CAPTCHA_HARDENING_DISMISS_META
    = 'creationell_captcha_hardening_dismissed'

CREATIONELL_CAPTCHA_LOCALE_MAP

Maps WordPress locales to the matching ALTCHA i18n locale bundle.


    public
        mixed
    CREATIONELL_CAPTCHA_LOCALE_MAP
    = [
    // Deutsch
    'de_DE' => 'de',
    'de_DE_formal' => 'de',
    'de_AT' => 'de',
    'de_CH' => 'de',
    'de_CH_informal' => 'de',
    // Englisch
    'en_US' => 'en',
    'en_GB' => 'en',
    'en_AU' => 'en',
    'en_CA' => 'en',
    'en_NZ' => 'en',
    'en_ZA' => 'en',
    // Französisch
    'fr_FR' => 'fr-fr',
    'fr_BE' => 'fr-fr',
    'fr_LU' => 'fr-fr',
    'fr_CH' => 'fr-fr',
    'fr_CA' => 'fr-ca',
    // Spanisch (Europa)
    'es_ES' => 'es-es',
    // Spanisch (LatAm — alle nach es-419)
    'es_AR' => 'es-419',
    'es_CL' => 'es-419',
    'es_CO' => 'es-419',
    'es_CR' => 'es-419',
    'es_DO' => 'es-419',
    'es_EC' => 'es-419',
    'es_GT' => 'es-419',
    'es_HN' => 'es-419',
    'es_MX' => 'es-419',
    'es_PA' => 'es-419',
    'es_PE' => 'es-419',
    'es_PR' => 'es-419',
    'es_UY' => 'es-419',
    'es_VE' => 'es-419',
    // Portugiesisch
    'pt_PT' => 'pt-pt',
    'pt_AO' => 'pt-pt',
    'pt_BR' => 'pt-br',
    // Italienisch / Niederländisch / Polnisch
    'it_IT' => 'it',
    'nl_NL' => 'nl',
    'nl_BE' => 'nl',
    'pl_PL' => 'pl',
    // Tschechisch / Slowakisch
    'cs_CZ' => 'cs',
    'sk_SK' => 'sk',
    // Nordisch
    'da_DK' => 'da',
    'sv_SE' => 'sv',
    'fi' => 'fi',
    'nb_NO' => 'nb',
    'nn_NO' => 'nb',
    // Sonstige EU
    'hu_HU' => 'hu',
    'ro_RO' => 'ro',
    'el' => 'el',
]

Keys are values returned by get_locale() — including the formal / informal variants WP exposes (de_DE_formal, de_CH_informal). Values are the exact locale codes used by the vendored ALTCHA bundles under assets/js/altcha-i18n/<code>.js. Locales not in the map fall through to the widget's own auto-detection (which itself falls back to English since only the bundles enqueued by this plugin are registered).

Extend via the creationell_captcha_widget_locale_map filter rather than patching this constant.

CREATIONELL_CAPTCHA_PURPOSE_UA_CTX

Purpose label of the under-attack code-challenge suppression token (`ctx`).


    public
        mixed
    CREATIONELL_CAPTCHA_PURPOSE_UA_CTX
    = 'underattack-ctx'

CREATIONELL_CAPTCHA_PURPOSE_UA_PASS

Purpose label of the under-attack pass-cookie key.


    public
        mixed
    CREATIONELL_CAPTCHA_PURPOSE_UA_PASS
    = 'underattack-pass'

CREATIONELL_CAPTCHA_SANITIZE_FORM

Sanitiser context: the settings form (`options.php`).


    public
        mixed
    CREATIONELL_CAPTCHA_SANITIZE_FORM
    = 'form'

Ein disabled-Input sendet beim Absenden keinen Wert — deshalb (und NUR deshalb) schreibt der Sanitizer in diesem Kontext gegatete Felder aus dem gespeicherten Zustand zurück.

CREATIONELL_CAPTCHA_SANITIZE_PROGRAMMATIC

Sanitiser context: programmatischer Schreibvorgang (Import, Werksreset, „Standardwerte laden", WP-CLI).


    public
        mixed
    CREATIONELL_CAPTCHA_SANITIZE_PROGRAMMATIC
    = 'programmatic'

Hier ist der übergebene Wert eine vollständige, bewusste Angabe; eine Rückschreibung aus dem Altzustand würde sie still überstimmen (AF-1/AF-3).

CREATIONELL_CAPTCHA_SANITIZE_RESET

Sanitiser context: Werksreset (`creationell_captcha_reset_settings()`).


    public
        mixed
    CREATIONELL_CAPTCHA_SANITIZE_RESET
    = 'reset'

Wie PROGRAMMATIC — plus die eine Zusage, die den Werksreset von jedem anderen Schreibvorgang unterscheidet: KEIN gespeicherter Schlüssel wird übernommen, auch keiner ausserhalb der aktuellen Feldspezifikation.

Warum das ein eigener Wert sein muss (Nachlese N6, Befund 5): Die Übernahme-Schleife am Ende von creationell_captcha_sanitize_settings() hält gespeicherte Schlüssel fest, die creationell_captcha_settings_fields() gerade nicht liefert — die Schalter der Formular-Plugins hängen an class_exists(), sind bei deaktiviertem Plugin also nicht in der Spezifikation. Für jeden regulären Schreibvorgang ist das richtig (sonst löschte ein Speichern der Einstellungsseite den Schalter eines gerade deaktivierten Plugins). Für den dokumentierten „vollen Werksreset" ist es falsch: wp creacaptcha settings reset --yes meldete „Auf Werkseinstellungen zurückgesetzt", während ein protect_wpforms => false aus der Zeit vor der Deaktivierung — oder ein beliebiger Fremdschlüssel aus wp option patch/DB-Restore — die Option unverändert überlebte.

Der Wert ersetzt PROGRAMMATIC ausschliesslich beim Reset. Import, „Standardwerte laden", WP-CLI-Schreibvorgänge und die Listen-Befehle bleiben auf PROGRAMMATIC: sie übergeben zwar ebenfalls einen vollständigen Wertesatz, sind aber kein Werksreset und dürfen den Schalter eines gerade inaktiven Formular-Plugins nicht wegräumen.

CREATIONELL_CAPTCHA_UA_CTX_TTL

Lifetime (seconds) of a `ctx` suppression token. The interstitial widget fetches the challenge on load, i.e. within seconds of the 503 being rendered; two minutes is generous for that and replaces the ~10 minutes the old 5-minute-bucket pair accepted (BK-4).


    public
        mixed
    CREATIONELL_CAPTCHA_UA_CTX_TTL
    = 120

creationell_captcha_register_admin_menu()

Registers the top-level "CreaCaptcha" admin menu entry.


    
                    creationell_captcha_register_admin_menu() : void

creationell_captcha_render_settings_page()

Renders the tabbed settings page.


    
                    creationell_captcha_render_settings_page() : void

All tabs share one

CreaCaptcha

Captcha

Table of Contents

Packages

Classes

Constants

Functions

Constants

CREATIONELL_CAPTCHA_EXPORT_MAX_ROWS

CREATIONELL_CAPTCHA_EXPORT_SCHEMA

CREATIONELL_CAPTCHA_HARDENING_DISMISS_ARG

CREATIONELL_CAPTCHA_HARDENING_DISMISS_META

CREATIONELL_CAPTCHA_LOCALE_MAP

CREATIONELL_CAPTCHA_PURPOSE_UA_CTX

CREATIONELL_CAPTCHA_PURPOSE_UA_PASS

CREATIONELL_CAPTCHA_SANITIZE_FORM

CREATIONELL_CAPTCHA_SANITIZE_PROGRAMMATIC

CREATIONELL_CAPTCHA_SANITIZE_RESET

Tags

CREATIONELL_CAPTCHA_UA_CTX_TTL

Functions

creationell_captcha_register_admin_menu()

creationell_captcha_render_settings_page()