Description
Reycob Form Firewall adds a lightweight protection layer for public forms without using an external CAPTCHA service.
Main features:
- Local math CAPTCHA loaded only when the visitor interacts with the checkbox.
- Browser proof token, honeypot field, and origin validation for protected forms.
- Rate limits per visitor and per endpoint.
- Specific protection for WooCommerce product reviews against links, duplicated spam, and repeated abusive submissions.
- Automatic exclusions for WooCommerce cart, checkout, payments, coupons, shipping, Store API, REST API, webhooks, cron, and server-to-server requests.
- Admin settings for limits, CAPTCHA, browser proof mode, IP source, and excluded paths.
- Developer opt-out with
data-rffw-skip="1"and opt-in for custom admin-post or admin-ajax actions through therffw_protected_actionsfilter.
The plugin is designed for visible public forms. It does not modify global fetch or XMLHttpRequest, does not call third-party APIs, and does not log IP addresses or submitted form contents.
The JavaScript and CSS files distributed with the plugin are the human-readable source files. No minification, bundling, compilation, npm, webpack, or other build step is required.
Privacy
The plugin does not collect analytics, does not send data to external services, and does not store submitted form contents.
Temporary tokens and hashed rate-limit keys may be stored in WordPress transients to validate CAPTCHA challenges, browser proof checks, and request frequency. These temporary values expire automatically.
Installation
- Upload the plugin folder to
/wp-content/plugins/reycob-form-firewall/, or install it through the WordPress Plugins screen. - Activate Reycob Form Firewall.
- Go to Settings > Form Firewall.
- Review the default limits and clear any page cache/CDN cache after activation.
- Test your public contact forms, login, registration, comments, product reviews, cart, checkout, and payment flow.
FAQ
-
Does it use Google reCAPTCHA or another external service?
-
No. The CAPTCHA is generated and verified locally by WordPress.
-
Does it protect WooCommerce checkout?
-
No. Checkout, cart, coupons, payment callbacks, shipping calculations, Store API, and product add-to-cart actions are intentionally excluded so normal store operations keep working.
-
Does it protect WooCommerce reviews?
-
Yes. Product reviews use the general form protections plus an additional review-specific spam check.
-
Can I exclude a form?
-
Yes. Add
data-rffw-skip="1"to the form element. Administrators can also exclude paths from the settings screen. -
Can developers protect custom AJAX or admin-post actions?
-
Yes. Use the
rffw_protected_actionsfilter to return an array of action names that should require the firewall checks.
Reviews
There are no reviews for this plugin.
Contributors & Developers
“Reycob Form Firewall” is open source software. The following people have contributed to this plugin.
Contributors
Translate “Reycob Form Firewall” into your language.
Interested in development?
Browse the code, check out the SVN repository, or subscribe to the development log by RSS.
Changelog
1.3.3
- Use WordPress-generated endpoint paths for admin AJAX, admin post, comments, login, REST, XML-RPC, and admin area detection.
- Move CAPTCHA styles into a human-readable CSS source file and enqueue it normally.
1.3.2
- Prepared WordPress.org readme, centralized sanitized request reads, and adjusted automated review compatibility.
1.3.1
- Limited protection scope to public forms, login, registration, comments, and WooCommerce product reviews.
- Excluded WooCommerce cart, checkout, payments, Store API, webhooks, and license/API requests.
- Removed global request interception and added on-demand CAPTCHA loading.