huygens-25

<p>OpenPorte is a community-maintained fork of the ALTCHA Spam Protection<br />
plugin for WordPress (version 1), which provides a free, open source,<br />
self-hostable, privacy-friendly CAPTCHA alternative based on a proof-<br />
of-work mechanism — no cookies, no tracking, GDPR-friendly by design.</p>
<p>For the list of contributors, refer to our GitHub project: <a href="https://github.com/jcberthon/openporte/graphs/contributors?from=1.6.2024" rel="nofollow ugc">Contributors</a>.</p>
<h4>Background</h4>
<p>The original ALTCHA WordPress plugin (v1) was open source (GPLv2). Its<br />
authors have since released a version 2/3 which is no longer open source,<br />
and some features that were free in v1 are now paid. They no longer<br />
maintain v1 and recommend that users migrate to v2/v3. See the official<br />
project at https://altcha.org for their offering.</p>
<p>OpenPorte continues the v1 line as free software (GPLv2 or later) for users<br />
who want to stay on a fully open-source, self-hosted solution. It is a<br />
faithful fork: existing v1 installations can switch to OpenPorte and keep<br />
their settings (see Upgrading).</p>
<h4>Compatibility</h4>
<p>OpenPorte is backward-compatible with ALTCHA v1:</p>
<ul>
<li>Your existing settings are migrated automatically on activation.</li>
<li>The <code>[altcha]</code> shortcode keeps working (alongside the new <code>[openporte]</code>).</li>
<li>The <code>altcha_*</code> filters and actions keep firing as deprecated aliases.</li>
</ul>
<p>See the Deprecations section for the full list of compatibility aliases and<br />
what they map to.</p>
<h3>Upgrading</h3>
<h4>From the original ALTCHA v1 plugin</h4>
<p>Deactivate the old ALTCHA plugin, then install and activate OpenPorte. Your<br />
existing configuration is detected and copied into the OpenPorte settings on<br />
first activation; the original ALTCHA settings are left untouched, so you can<br />
roll back to ALTCHA v1 without losing anything. Do not run both plugins at the<br />
same time.</p>
<h3>Deprecations</h3>
<p>The following ALTCHA-era identifiers are kept as aliases for backward<br />
compatibility and are scheduled for removal in a future release:</p>
<ul>
<li>The <code>[altcha]</code> shortcode — use <code>[openporte]</code>.</li>
<li>The <code>altcha/v1</code> REST namespace — use <code>openporte/v1</code>.</li>
<li>The <code>altcha_*</code> filters and actions — now firing through WordPress’ deprecated<br />
hook mechanism; use the <code>openporte_*</code> equivalents.</li>
<li>The <code>AltchaPlugin</code> class and the <code>ALTCHA_VERSION</code> / <code>ALTCHA_WIDGET_VERSION</code><br />
constants — use <code>OpenPortePlugin</code> and the <code>OPENPORTE_*</code> constants.</li>
<li>Integrations targeting paid-only third-party plugins; affected users should<br />
migrate to the official ALTCHA v2/v3 plugin.</li>
</ul>
<h3>Privacy</h3>
<h4>No cookies, no tracking</h4>
<p>OpenPorte prioritizes user privacy by avoiding the use of cookies and fingerprinting techniques.</p>
<h4>No external service</h4>
<p>This plugin remains fully contained within your WordPress installation, eliminating any reliance on external services.</p>
<h3>Modes of Operation</h3>
<p>OpenPorte verifies submissions in one of two modes, selected in the settings<br />
(API Mode):</p>
<ul>
<li>Self-hosted (default) — a proof-of-work challenge is issued and verified by<br />
your own WordPress site through the REST API. Fully self-contained, with no<br />
external service and no additional setup beyond enabling the integrations you<br />
need.</li>
<li>Custom — point the Challenge URL at your own ALTCHA-compatible backend (for<br />
example a self-hosted ALTCHA Sentinel). Submissions are verified with your<br />
site’s signing secret.</li>
</ul>
<p>The paid altcha.org regional SaaS classifier offered by earlier versions has<br />
been removed; both remaining modes are free and self-hostable.</p>
<h3>REST API</h3>
<p>This plugin requires the WordPress REST API. If you are using any “Disable REST API” plugins, ensure that the endpoint <code>/altcha/v1/challenge</code> (marked for deprecation) and <code>/openporte/v1/challenge</code> are allowed.</p>
<h3>Supported Integrations</h3>
<ul>
<li>CoBlocks</li>
<li>Contact Form 7</li>
<li>Elementor Pro Forms (deprecated — paid plugin, see Deprecations)</li>
<li>Formidable Forms</li>
<li>Forminator</li>
<li>GravityForms</li>
<li>HTML Forms</li>
<li>WPDiscuz</li>
<li>WPForms</li>
<li>WP-Members</li>
<li>WordPress Login, Register, Password reset</li>
<li>WordPress Comments</li>
<li>WooCommerce</li>
<li>Custom HTML (via the <code>[openporte]</code> shortcode, or the deprecated <code>[altcha]</code> alias)</li>
</ul>
<h3>Source Code</h3>
<p>All source code for the plugin, and the ALTCHA widget is available on GitHub. In the repository, you’ll also find versions of non-minified JavaScript and CSS assets:</p>
<ul>
<li>Plugin: https://github.com/jcberthon/openporte</li>
<li>ALTCHA Widget: https://github.com/altcha-org/altcha</li>
</ul>


OpenPorte Spam Protection

OpenPorte offers a free, open-source Captcha alternative, ensuring robust spam protection while respecting user privacy and GDPR compliance.

Ion Burdianov

mazhurin

eQualitie

<p>Baskerville is a comprehensive WordPress security plugin that protects your site from malicious bots, AI crawlers, and unwanted traffic using multiple detection methods.</p>
<p><strong>Key Features:</strong></p>
<ul>
<li><strong>AI Bot Detection</strong> – Intelligent classification of bots vs. humans with configurable score thresholds</li>
<li><strong>GeoIP Access Control</strong> – Block or allow traffic by country (whitelist/blacklist modes)</li>
<li><strong>Cloudflare Turnstile</strong> – CAPTCHA challenge for borderline bot scores with precision analytics</li>
<li><strong>Browser Fingerprinting</strong> – Advanced client-side fingerprinting (Canvas, WebGL, Audio)</li>
<li><strong>Honeypot Detection</strong> – Hidden links to catch AI crawlers</li>
<li><strong>Real-Time Analytics</strong> – Live feed, traffic statistics, and Turnstile precision metrics</li>
<li><strong>Under Attack Mode</strong> – Emergency mode to challenge all visitors during attacks</li>
<li><strong>IP Whitelist</strong> – Bypass firewall for trusted IPs</li>
<li><strong>Form Protection</strong> – Protect login, registration, and comment forms with Turnstile</li>
</ul>
<p><strong>Bot Score System:</strong></p>
<ul>
<li>0-39: Likely human (allowed)</li>
<li>40-70: Borderline (optional Turnstile challenge)</li>
<li>71-100: Likely bot (blocked)</li>
</ul>
<p><strong>Performance:</strong></p>
<ul>
<li>Minimal overhead (~1ms with page cache, ~30-50ms without)</li>
<li>APCu + file-based caching for GeoIP lookups</li>
<li>Compatible with all major caching plugins</li>
</ul>
<h3>External Services</h3>
<p>This plugin connects to the following third-party services:</p>
<h4>Cloudflare Turnstile</h4>
<p>When Turnstile is enabled, the plugin loads JavaScript from Cloudflare’s servers to display CAPTCHA challenges:</p>
<ul>
<li>Service URL: https://challenges.cloudflare.com/turnstile/v0/api.js</li>
<li>Verification API: https://challenges.cloudflare.com/turnstile/v0/siteverify</li>
<li>Data sent: Turnstile token, visitor IP address</li>
<li>Purpose: Human verification to prevent bot access</li>
<li>Privacy Policy: https://www.cloudflare.com/privacypolicy/</li>
<li>Terms of Service: https://www.cloudflare.com/website-terms/</li>
</ul>
<p>Turnstile is only loaded when you enable it in plugin settings and provide your Cloudflare API keys.</p>
<h4>MaxMind GeoIP Database</h4>
<p>When you use the one-click GeoIP database installer, the plugin downloads the GeoLite2-Country database from MaxMind:</p>
<ul>
<li>Database download URL: https://download.maxmind.com/</li>
<li>Data sent: Your MaxMind license key (required for database download)</li>
<li>Purpose: Determine visitor country for geo-blocking features</li>
<li>Privacy Policy: https://www.maxmind.com/en/privacy-policy</li>
<li>Terms of Service: https://www.maxmind.com/en/geolite2/eula</li>
</ul>
<p>The installer also downloads the MaxMind PHP libraries from GitHub:</p>
<ul>
<li>GeoIP2 PHP API: https://github.com/maxmind/GeoIP2-php/archive/refs/tags/v2.13.0.zip</li>
<li>MaxMind DB Reader: https://github.com/maxmind/MaxMind-DB-Reader-php/archive/refs/tags/v1.11.1.zip</li>
<li>These are open-source libraries used to read the local GeoIP database. No visitor data is sent to GitHub.</li>
<li>GitHub Terms of Service: https://docs.github.com/en/site-policy/github-terms/github-terms-of-service</li>
<li>GitHub Privacy Statement: https://docs.github.com/en/site-policy/privacy-policies/github-general-privacy-statement</li>
</ul>
<p>The database is stored locally on your server. No visitor data is sent to MaxMind during lookups.</p>
<h3>Privacy</h3>
<h4>Data Collected</h4>
<p>This plugin collects and stores the following visitor data locally in your WordPress database:</p>
<ul>
<li>IP addresses</li>
<li>Browser fingerprints (Canvas, WebGL, Audio hashes)</li>
<li>User agent strings</li>
<li>Country codes (derived from IP)</li>
<li>Bot scores and classifications</li>
<li>Timestamps of visits</li>
</ul>
<h4>Data Retention</h4>
<p>Statistics are automatically deleted after the retention period you configure (default: 14 days). You can adjust this in Settings > Baskerville > Settings.</p>
<h4>GDPR Compliance</h4>
<ul>
<li>All data is stored locally on your server</li>
<li>No visitor data is shared with third parties (except Cloudflare when Turnstile verification occurs)</li>
<li>Data retention is configurable</li>
<li>Consider adding disclosure to your site’s privacy policy</li>
</ul>


Baskerville AI Security

Advanced WordPress security plugin with AI bot detection, GeoIP access control, and Cloudflare Turnstile integration.

OpenPorte Spam Protection vs Baskerville AI Security