{"id":286960,"date":"2026-03-11T10:34:14","date_gmt":"2026-03-11T10:34:14","guid":{"rendered":"https:\/\/wordpress.org\/plugins\/comment-shield\/"},"modified":"2026-03-15T00:09:45","modified_gmt":"2026-03-15T00:09:45","slug":"lukacodes-comment-shield","status":"publish","type":"plugin","link":"https:\/\/test.wordpress.org\/plugins\/lukacodes-comment-shield\/","author":8696714,"comment_status":"closed","ping_status":"closed","template":"","meta":{"_crdt_document":"","version":"1.1.3","stable_tag":"1.1.3","tested":"6.9.4","requires":"6.0","requires_php":"8.0","requires_plugins":null,"header_name":"LukaCodes AntiSpam Shield","header_author":"LukaCodes","header_description":"Disables the website field, strips links from comments, and includes reCAPTCHA v3 spam protection.","assets_banners_color":"3f4964","last_updated":"2026-03-15 00:09:45","external_support_url":"","external_repository_url":"","donate_link":"https:\/\/www.paypal.com\/donate\/?hosted_button_id=942LJ42XE4HVW","header_plugin_uri":"","header_author_uri":"https:\/\/lukacodes.com","rating":0,"author_block_rating":0,"active_installs":10,"downloads":400,"num_ratings":0,"support_threads":0,"support_threads_resolved":0,"author_block_count":0,"sections":["description","installation","faq","changelog"],"tags":{"1.0.0":{"tag":"1.0.0","author":"Luka2013","date":"2026-03-11 10:41:40"},"1.0.1":{"tag":"1.0.1","author":"Luka2013","date":"2026-03-12 02:00:12"},"1.1.0":{"tag":"1.1.0","author":"Luka2013","date":"2026-03-13 23:52:46"},"1.1.1":{"tag":"1.1.1","author":"Luka2013","date":"2026-03-14 16:22:01"},"1.1.2":{"tag":"1.1.2","author":"Luka2013","date":"2026-03-14 19:44:54"},"1.1.3":{"tag":"1.1.3","author":"Luka2013","date":"2026-03-15 00:09:45"}},"upgrade_notice":{"1.1.3":"<p>Fixes key tester false-positive: keys from a different domain no longer show as valid. Recommended update for all users.<\/p>","1.1.2":"<p>Plugin renamed to LukaCodes AntiSpam Shield. Adds CAPTCHA for login and registration forms. Fixes debug message in WPForms integration. Recommended update for all users.<\/p>","1.1.0":"<p>Adds CAPTCHA protection for WPForms Lite \u2014 using your existing reCAPTCHA v3 or Turnstile keys. Recommended update for WPForms Lite users.<\/p>"},"ratings":[],"assets_icons":{"icon-128x128.png":{"filename":"icon-128x128.png","revision":3479965,"resolution":"128x128","location":"assets","locale":""},"icon-256x256.png":{"filename":"icon-256x256.png","revision":3479965,"resolution":"256x256","location":"assets","locale":""}},"assets_banners":{"banner-1544x500.png":{"filename":"banner-1544x500.png","revision":3479965,"resolution":"1544x500","location":"assets","locale":""}},"assets_blueprints":{},"all_blocks":[],"tagged_versions":["1.0.0","1.0.1","1.1.0","1.1.1","1.1.2","1.1.3"],"block_files":[],"assets_screenshots":{"screenshot-1.png":{"filename":"screenshot-1.png","revision":3482319,"resolution":"1","location":"assets","locale":""}},"screenshots":{"1":"The main settings dashboard with Comment Options, reCAPTCHA, Turnstile, Login &amp; Registration, and WPForms sections.","2":"WPForms integration panel \u2014 shows detection status and toggle.","3":"reCAPTCHA key tester \u2014 real-time verification against Google API.","4":"Turnstile key tester \u2014 real-time verification against Cloudflare API.","5":"Plugin status panel \u2014 at-a-glance view of current configuration."},"jetpack_post_was_ever_published":false},"plugin_section":[],"plugin_tags":[2656,595,599,214603,130711],"plugin_category":[38,44,54],"plugin_contributors":[257567],"plugin_business_model":[],"class_list":["post-286960","plugin","type-plugin","status-publish","hentry","plugin_tags-anti-spam","plugin_tags-recaptcha","plugin_tags-spam","plugin_tags-turnstile","plugin_tags-wpforms","plugin_category-authentication","plugin_category-discussion-and-community","plugin_category-security-and-spam-protection","plugin_contributors-luka2013","plugin_committers-luka2013"],"banners":[],"icons":{"svg":false,"icon":"https:\/\/ps.w.org\/lukacodes-comment-shield\/assets\/icon-128x128.png?rev=3479965","icon_2x":"https:\/\/ps.w.org\/lukacodes-comment-shield\/assets\/icon-256x256.png?rev=3479965","generated":false},"screenshots":[{"src":"https:\/\/ps.w.org\/lukacodes-comment-shield\/assets\/screenshot-1.png?rev=3482319","caption":"The main settings dashboard with Comment Options, reCAPTCHA, Turnstile, Login &amp; Registration, and WPForms sections."}],"raw_content":"<!--section=description-->\n<p><strong>LukaCodes AntiSpam Shield<\/strong> is a lightweight, no-bloat plugin that protects your WordPress comment section <strong>and contact forms<\/strong> from spam. Five independent tools, one settings page. <a href=\"https:\/\/lukacodes.com\/comment-shield-docs\/\">Read the full documentation<\/a>.<\/p>\n\n<ul>\n<li><strong>Disable Website Field<\/strong> \u2014 Removes the URL\/website field from the comment form. Works with all themes, including those that hardcode the field (CSS fallback included).<\/li>\n<li><strong>Strip Links from Comments<\/strong> \u2014 Automatically removes all <code>&lt;a href&gt;<\/code> hyperlinks from comment content \u2014 both on display and before saving to the database. Spammers get zero benefit from posting links.<\/li>\n<li><strong>reCAPTCHA v3<\/strong> \u2014 Adds Google's invisible bot-score protection. No checkbox, no puzzle, no friction for real users. Bots are silently blocked server-side.<\/li>\n<li><strong>Cloudflare Turnstile<\/strong> \u2014 A privacy-friendly CAPTCHA alternative. Mutually exclusive with reCAPTCHA v3 \u2014 enabling one automatically disables the other.<\/li>\n<li><strong>Login Shield<\/strong> \u2014 Adds CAPTCHA to the WordPress login form (<code>wp-login.php<\/code>). Stops brute-force bots silently.<\/li>\n<li><strong>Registration Shield<\/strong> \u2014 Adds CAPTCHA to the WordPress registration form. Blocks bot account creation.<\/li>\n<li><strong>WPForms Integration<\/strong> \u2014 Apply the same CAPTCHA protection to WPForms Lite \u2014 using the same keys you already configured, no extra setup.<\/li>\n<\/ul>\n\n<p>All features are <strong>independent<\/strong> \u2014 enable only what you need.<\/p>\n\n<h4>Login &amp; Registration Shield<\/h4>\n\n<p>Version 1.1.2 adds CAPTCHA protection to <code>wp-login.php<\/code>:<\/p>\n\n<ul>\n<li><strong>Login Shield<\/strong> \u2014 Hooks into <code>wp_authenticate_user<\/code> for server-side verification after credentials are checked. Returns a <code>WP_Error<\/code> if CAPTCHA fails \u2014 WordPress displays it as a normal login error.<\/li>\n<li><strong>Registration Shield<\/strong> \u2014 Hooks into <code>registration_errors<\/code> to add CAPTCHA validation during registration. Works alongside all other WordPress registration validations.<\/li>\n<\/ul>\n\n<p>Both are independently togglable in the settings panel. Admins already logged in are never affected.<\/p>\n\n<h4>WPForms Integration<\/h4>\n\n<p>Version 1.1.0 introduces CAPTCHA protection for <strong>WPForms Lite<\/strong>:<\/p>\n\n<ul>\n<li>Hooks into <code>wpforms_display_submit_before<\/code> to inject the CAPTCHA widget before the submit button.<\/li>\n<li>Hooks into <code>wpforms_process<\/code> for server-side token verification.<\/li>\n<li>Works with both reCAPTCHA v3 (invisible) and Cloudflare Turnstile (visible widget).<\/li>\n<\/ul>\n\n<p>Note: WPForms Pro includes its own native CAPTCHA integration \u2014 this feature is intended for <strong>WPForms Lite<\/strong> users only.<\/p>\n\n<h4>Why AntiSpam Shield?<\/h4>\n\n<p>Most anti-spam plugins are heavy, require accounts, or add ugly CAPTCHAs. LukaCodes AntiSpam Shield is different:<\/p>\n\n<ul>\n<li>~30 KB total \u2014 no external libraries, no jQuery dependency<\/li>\n<li>Settings page with <strong>live key testing<\/strong> \u2014 verify your reCAPTCHA or Turnstile keys before enabling<\/li>\n<li><strong>Link stripping preview<\/strong> \u2014 paste any comment text and see exactly what gets removed<\/li>\n<li>Graceful fallback: if Google's or Cloudflare's API is unreachable, comments are held for moderation (never lost)<\/li>\n<li>Trusted users (administrators) bypass CAPTCHA checks automatically<\/li>\n<li><strong>Mutual exclusion<\/strong>: reCAPTCHA v3 and Cloudflare Turnstile cannot be active at the same time<\/li>\n<li>WP Coding Standards compliant \u2014 fully escaped output, nonce-protected AJAX<\/li>\n<\/ul>\n\n<h4>reCAPTCHA v3 \u2014 How it works<\/h4>\n\n<p>When a visitor submits a form, JavaScript silently requests a score token from Google. The token is sent with the submission and verified server-side against your minimum score threshold (configurable from 0.1 to 1.0). No user interaction required.<\/p>\n\n<h4>Cloudflare Turnstile \u2014 How it works<\/h4>\n\n<p>A Turnstile widget is rendered inside the form. When the visitor completes the challenge, a token is submitted and verified server-side against the Cloudflare API.<\/p>\n\n<h3>Third-Party Services<\/h3>\n\n<p>This plugin optionally uses the following third-party services:<\/p>\n\n<h4>Google reCAPTCHA v3<\/h4>\n\n<p>A service provided by Google LLC.<\/p>\n\n<ul>\n<li><strong>What it does:<\/strong> Detects bots and spam on your comment form and contact forms without user interaction.<\/li>\n<li><strong>When data is sent:<\/strong> Only when reCAPTCHA v3 is enabled. A token is sent to <code>https:\/\/www.google.com\/recaptcha\/api\/siteverify<\/code> on each form submission.<\/li>\n<li><strong>What data is sent:<\/strong> The visitor's IP address and a reCAPTCHA token.<\/li>\n<li><strong>Google Privacy Policy:<\/strong> https:\/\/policies.google.com\/privacy<\/li>\n<li><strong>Google Terms of Service:<\/strong> https:\/\/policies.google.com\/terms<\/li>\n<\/ul>\n\n<h4>Cloudflare Turnstile<\/h4>\n\n<p>A service provided by Cloudflare, Inc.<\/p>\n\n<ul>\n<li><strong>What it does:<\/strong> Presents a privacy-friendly CAPTCHA widget on comment and contact forms.<\/li>\n<li><strong>When data is sent:<\/strong> Only when Cloudflare Turnstile is enabled. A token is sent to <code>https:\/\/challenges.cloudflare.com\/turnstile\/v0\/siteverify<\/code> on each form submission.<\/li>\n<li><strong>What data is sent:<\/strong> The visitor's IP address and a Turnstile token.<\/li>\n<li><strong>Cloudflare Privacy Policy:<\/strong> https:\/\/www.cloudflare.com\/privacypolicy\/<\/li>\n<li><strong>Cloudflare Terms of Service:<\/strong> https:\/\/www.cloudflare.com\/website-terms\/<\/li>\n<\/ul>\n\n<p>Both services are entirely optional. If you do not enter API keys or enable either CAPTCHA, no data is sent to any third party.<\/p>\n\n<!--section=installation-->\n<ol>\n<li>Upload the <code>lukacodes-comment-shield<\/code> folder to <code>\/wp-content\/plugins\/<\/code><\/li>\n<li>Activate the plugin through <strong>Plugins \u2192 Installed Plugins<\/strong><\/li>\n<li>Go to <strong>Settings \u2192 AntiSpam Shield<\/strong> to configure your options<\/li>\n<\/ol>\n\n<h4>reCAPTCHA v3 Setup<\/h4>\n\n<ol>\n<li>Visit <a href=\"https:\/\/www.google.com\/recaptcha\/admin\/create\">Google reCAPTCHA Admin Console<\/a><\/li>\n<li>Create a new site \u2014 select <strong>Score based (v3)<\/strong><\/li>\n<li>Add your domain to the allowed domains list<\/li>\n<li>Copy the <strong>Site Key<\/strong> and <strong>Secret Key<\/strong> into the plugin settings<\/li>\n<li>Use the built-in <strong>\ud83d\udd0d Test Keys<\/strong> button to verify connectivity before enabling<\/li>\n<li>Enable reCAPTCHA v3, set your minimum score, and save<\/li>\n<\/ol>\n\n<h4>Cloudflare Turnstile Setup<\/h4>\n\n<ol>\n<li>Visit <a href=\"https:\/\/dash.cloudflare.com\/?to=\/:account\/turnstile\">Cloudflare Turnstile Dashboard<\/a><\/li>\n<li>Create a new site and select your widget type (Managed recommended)<\/li>\n<li>Copy the <strong>Site Key<\/strong> and <strong>Secret Key<\/strong> into the plugin settings<\/li>\n<li>Use the built-in <strong>\ud83d\udd0d Test Turnstile Keys<\/strong> button to verify connectivity before enabling<\/li>\n<li>Enable Cloudflare Turnstile and save \u2014 reCAPTCHA v3 will be disabled automatically<\/li>\n<\/ol>\n\n<h4>Contact Forms Setup<\/h4>\n\n<p>No extra setup needed. Once reCAPTCHA v3 or Cloudflare Turnstile is configured, go to the <strong>Contact Forms<\/strong> section in the settings and toggle on each plugin you want to protect. The admin panel shows which form plugins are currently installed and active on your site.<\/p>\n\n<!--section=faq-->\n<dl>\n<dt id=\"does%20this%20require%20a%20google%20account%3F\"><h3>Does this require a Google account?<\/h3><\/dt>\n<dd><p>Only if you use reCAPTCHA v3. You need a Google account to obtain keys from the <a href=\"https:\/\/www.google.com\/recaptcha\/admin\/create\">reCAPTCHA Admin Console<\/a>. The service is free. Cloudflare Turnstile requires a free Cloudflare account instead.<\/p><\/dd>\n<dt id=\"can%20i%20use%20both%20recaptcha%20and%20turnstile%20at%20the%20same%20time%3F\"><h3>Can I use both reCAPTCHA and Turnstile at the same time?<\/h3><\/dt>\n<dd><p>No \u2014 they are mutually exclusive. Enabling one will automatically disable the other, both in the settings UI and on the server.<\/p><\/dd>\n<dt id=\"does%20this%20protect%20the%20login%20and%20registration%20forms%3F\"><h3>Does this protect the login and registration forms?<\/h3><\/dt>\n<dd><p>Yes. Enable \"Login Shield\" and\/or \"Registration Shield\" in the <strong>Login &amp; Registration<\/strong> section of the settings panel. The same reCAPTCHA v3 or Turnstile keys are reused \u2014 no extra setup needed. Administrators are never blocked.<\/p><\/dd>\n<dt id=\"does%20this%20protect%20wpforms%20lite%20without%20extra%20keys%3F\"><h3>Does this protect WPForms Lite without extra keys?<\/h3><\/dt>\n<dd><p>Yes. The same reCAPTCHA v3 or Turnstile keys you enter for comment protection are reused automatically for WPForms Lite. No additional setup required.<\/p><\/dd>\n<dt id=\"what%20happens%20if%20google%27s%20or%20cloudflare%27s%20api%20is%20unreachable%3F\"><h3>What happens if Google's or Cloudflare's API is unreachable?<\/h3><\/dt>\n<dd><p>The comment or form submission is held for moderation instead of being rejected. You will never lose a genuine submission due to an API outage.<\/p><\/dd>\n<dt id=\"does%20it%20work%20with%20custom%20themes%20that%20hardcode%20the%20url%20field%3F\"><h3>Does it work with custom themes that hardcode the URL field?<\/h3><\/dt>\n<dd><p>Yes. The plugin removes the field from WordPress's form array and also injects CSS as a fallback.<\/p><\/dd>\n<dt id=\"does%20this%20work%20with%20caching%20plugins%3F\"><h3>Does this work with caching plugins?<\/h3><\/dt>\n<dd><p>Yes. All CAPTCHA logic runs client-side (JS) and server-side (PHP on submission). Caching does not interfere.<\/p><\/dd>\n<dt id=\"do%20i%20need%20all%20features%3F\"><h3>Do I need all features?<\/h3><\/dt>\n<dd><p>No. Each feature has its own toggle. Enable only what your site needs.<\/p><\/dd>\n\n<\/dl>\n\n<!--section=changelog-->\n<h4>1.1.3<\/h4>\n\n<ul>\n<li>Added: Option to disable comments on all posts sitewide<\/li>\n<li>Added: Option to disable comments on all pages sitewide<\/li>\n<li>Fixed: WPForms CAPTCHA hook changed to wpforms_process_before \u2014 form submission is now blocked before email is sent when token is missing\/invalid<\/li>\n<li>Fixed: Key tester now validates that reCAPTCHA \/ Turnstile keys are registered for this site's domain<\/li>\n<li>Fixed: Keys from a different domain now show a clear \"Domain mismatch\" error instead of a false \"keys look correct\" result<\/li>\n<li>Improved: Turnstile key tester now passes sitekey to Cloudflare API to enable domain-level validation<\/li>\n<li>Improved: Greek (el) translation updated to 100% \u2014 all strings now translated<\/li>\n<li>Bumped version to 1.1.3<\/li>\n<\/ul>\n\n<h4>1.1.2<\/h4>\n\n<ul>\n<li>Added Login Shield: CAPTCHA protection for wp-login.php login form<\/li>\n<li>Added Registration Shield: CAPTCHA protection for wp-login.php registration form<\/li>\n<li>Login and Registration shields are independently togglable in the settings panel<\/li>\n<li>Both shields reuse existing reCAPTCHA v3 \/ Turnstile keys \u2014 no additional setup required<\/li>\n<li>Added Login Shield and Register Shield rows to Plugin Status panel<\/li>\n<li>Updated POT template with all new i18n strings<\/li>\n<li>Updated Greek (el) translation with all new strings<\/li>\n<li>Bumped version to 1.1.2<\/li>\n<\/ul>\n\n<h4>1.1.0<\/h4>\n\n<ul>\n<li>Added WPForms Lite integration: reCAPTCHA v3 and Cloudflare Turnstile protection for WPForms forms<\/li>\n<li>WPForms protection reuses existing CAPTCHA keys \u2014 no additional setup required<\/li>\n<li>Added WPForms panel in admin: auto-detects if WPForms is installed, toggle to enable\/disable<\/li>\n<li>Added WPForms Shield row to Plugin Status panel<\/li>\n<li>Updated POT template with all new i18n strings<\/li>\n<li>Updated Greek (el) translation with all new strings<\/li>\n<li>Bumped version to 1.1.0<\/li>\n<\/ul>\n\n<h4>1.0.1<\/h4>\n\n<ul>\n<li>Added Cloudflare Turnstile as a second CAPTCHA option (privacy-friendly alternative to reCAPTCHA)<\/li>\n<li>Added mutual exclusion logic: enabling reCAPTCHA disables Turnstile and vice versa<\/li>\n<li>Added server-side Turnstile token verification with moderation fallback<\/li>\n<li>Added live Turnstile key tester in the settings panel<\/li>\n<li>Updated uninstall.php to clean up Turnstile options on deletion<\/li>\n<\/ul>\n\n<h4>0.3<\/h4>\n\n<ul>\n<li>Added server-side reCAPTCHA verification with action and hostname validation<\/li>\n<li>Added fallback: holds comment for moderation if Google API is unreachable<\/li>\n<li>Added <code>COMMSH_VERSION<\/code> constant and activation hook to seed default options<\/li>\n<li>Improved score threshold: configurable from 0.1 to 1.0 with live slider<\/li>\n<\/ul>\n\n<h4>0.2<\/h4>\n\n<ul>\n<li>Integrated Google reCAPTCHA v3 invisible protection on comment form<\/li>\n<li>Added real-time key testing against Google API<\/li>\n<li>Added live link stripping preview with before\/after diff<\/li>\n<li>Fixed double-submission bug on slow connections<\/li>\n<\/ul>\n\n<h4>0.1<\/h4>\n\n<ul>\n<li>Initial release<\/li>\n<li>Remove website field from comment form (filter + CSS fallback)<\/li>\n<li>Strip HTML links from comments on display and before saving to database<\/li>\n<\/ul>","raw_excerpt":"Block comment spam, brute-force logins and bot registrations with reCAPTCHA v3 or Cloudflare Turnstile. Lightweight, no bloat.","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/test.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin\/286960","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/test.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin"}],"about":[{"href":"https:\/\/test.wordpress.org\/plugins\/wp-json\/wp\/v2\/types\/plugin"}],"replies":[{"embeddable":true,"href":"https:\/\/test.wordpress.org\/plugins\/wp-json\/wp\/v2\/comments?post=286960"}],"author":[{"embeddable":true,"href":"https:\/\/test.wordpress.org\/plugins\/wp-json\/wporg\/v1\/users\/luka2013"}],"wp:attachment":[{"href":"https:\/\/test.wordpress.org\/plugins\/wp-json\/wp\/v2\/media?parent=286960"}],"wp:term":[{"taxonomy":"plugin_section","embeddable":true,"href":"https:\/\/test.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_section?post=286960"},{"taxonomy":"plugin_tags","embeddable":true,"href":"https:\/\/test.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_tags?post=286960"},{"taxonomy":"plugin_category","embeddable":true,"href":"https:\/\/test.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_category?post=286960"},{"taxonomy":"plugin_contributors","embeddable":true,"href":"https:\/\/test.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_contributors?post=286960"},{"taxonomy":"plugin_business_model","embeddable":true,"href":"https:\/\/test.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_business_model?post=286960"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}