LaughterOnWater

Raptcha is an innovative CAPTCHA alternative that challenges users to count animals in a dynamic image, promoting accessibility and user engagement. Unlike text-based CAPTCHAs, it uses engaging visuals (cats, dogs, birds) with randomized placements and scales for enhanced security.
Key features:
<ul>
<li>Animal Counting Challenges: Randomized images with 1-10 animals, ensuring varied difficulty.</li>
<li>Bot Detection Heuristics: Advanced checks (drag time, mouse distance, focus duration) to prevent automated submissions.</li>
<li>Form Integrations: Native support for WordPress comments, login forms, and popular plugins (Contact Form 7, Kadence Forms, Ninja Forms).</li>
<li>Shortcode Integration: Easily embed with <code>[raptcha]</code> for custom forms.</li>
<li>Fully Secured: Nonce verification, transients for challenge storage, and sanitization throughout.</li>
</ul>
This plugin prioritizes privacy, security and usability, making it a in-house, private, modern alternative to traditional CAPTCHAs.

Raptcha


It works as advertised. That said I would love 2 extra features to be added:



1. For at least the Comments form, or any form to that matter the Raptcha should not appear for logged in users.



2. We need support for the Log in/out core block when the block is configured to be displayed as a form and not as just a link. It would be great for the themes that use the Log in/out block in their footers. At this point, the Raptcha does not appear and even if you have entered the correct credentials it loads the actual WP login page and you have to go through the login process again.



Great job and thank you for this plugin.


Absolutely a Five Star Plugin !

A secure, animal-based CAPTCHA for WordPress forms featuring intelligent bot detection and multi-form integrations.

ldesuque

Server-side, non-blocking request logging with a local queue, batched delivery, 
exponential-backoff retries, a circuit breaker, query-parameter redaction, and 
path filtering. Admin actions use the WordPress REST API.
<h3>Configuration</h3>
Settings -> nBlick Signal Agent. Set the API key (or define NBLICK_SIGNAL_API_KEY 
in wp-config.php), enable logging, and use the Status tab to send a test event.
<h3>External services</h3>
This plugin connects to the nBlick Signal API, a third-party service, to provide 
bot detection and traffic analysis. This connection is essential to the plugin’s 
purpose: request data collected on your site is transmitted to nBlick for 
analysis, and the plugin does nothing useful without it.
What is sent, and when:
<ul>
<li>The plugin sends batches of request metadata to the nBlick Signal ingest 
endpoint (default: https://api.trynblick.com/signals/wordpress) on a recurring 
background schedule (via WP-Cron) whenever logging is enabled and queued data 
exists, and once when you click “Send Test Event”.</li>
<li>Each request record may contain: the visitor’s IP address, the request method, 
host, path, HTTP status code, user agent, referer, response size, request 
duration, a timestamp, query-string parameters (with sensitive keys such as 
passwords and tokens redacted), a per-site identifier (UUID), and a schema 
version number.</li>
<li>Only public front-end traffic is sent. WordPress admin, login, REST API, AJAX, 
cron, WP-CLI, and any paths you exclude are never collected or transmitted.</li>
<li>Authentication uses an API key you provide, sent in the X-NBlick-Signal-Key 
request header.</li>
</ul>
The IP address is transmitted in full because it is required for the service’s 
bot-detection and reverse-DNS analysis.
This service is provided by nBlick. By using the plugin you are sending the data 
described above to nBlick. Please review their terms and privacy policy:
<ul>
<li>Terms of service: https://trynblick.com/terms-of-service</li>
<li>Privacy policy: https://trynblick.com/privacy-policy</li>
</ul>
<h3>Privacy</h3>
<ul>
<li>The plugin is server-side only. It sets no cookies and performs no client-side 
or browser tracking.</li>
<li>Sensitive query parameters (configurable; by default password, pass, token, 
auth, authorization, apikey, api_key, secret, card, cc, ssn and similar) are 
redacted to “[REDACTED]” before storage and transmission.</li>
<li>Captured data is queued in a local database table and removed after it is sent 
successfully, or purged after the configured retention period (default 7 days).</li>
<li>When the Sodium PHP extension is available, the API key is encrypted at rest 
using your site’s authentication salts; defining NBLICK_SIGNAL_API_KEY in 
wp-config.php avoids database storage entirely.</li>
<li>Because the plugin transmits visitor IP addresses to a third party, you may 
need to disclose this in your own site’s privacy policy depending on your 
jurisdiction (e.g. GDPR/CCPA).</li>
</ul>

nBlick Signal Agent

Captures public request metadata and ships it in batches to the nBlick Signal API for bot detection and traffic analysis.

Raptcha vs nBlick Signal Agent