Nikolay Nikolov

A simple captcha for the WordPress login form. To be able to login, the user is required to enter a random 3-digit number in a text field.
The correct number is displayed above the field by a small JavaScript code. Compatible with the WooCommerce login form. Compatible with multisite.
<h4>Demo</h4>
<a href="https://nikolaydev.com/wp-login.php" rel="nofollow ugc">https://nikolaydev.com/wp-login.php</a>
<h4>Simple</h4>
<ul>
<li>No complicated features</li>
<li>No settings</li>
<li>No image generation</li>
<li>No API</li>
<li>No sessions</li>
<li>No cookies</li>
<li>No IP address detection</li>
<li>No personal data collection</li>
<li>No vulnerabilities in the programming code</li>
</ul>
<h4>Recommendation</h4>
Bots can also try to login with the XML-RPC feature of WordPress! Very rarely plugins also need this (like the Jetpack plugin). But if you don’t use it, I recommend that you disable it. You can use the super simple one-line plugin <a href="https://wordpress.org/plugins/disable-xml-rpc/" rel="ugc">Disable XML-RPC</a>.
<h4>Notice</h4>
This is a simple plugin designed to protect against random bots that try to login on your site. But if a person actually looks at the code of this plugin and specifically designs a new bot that targets this plugin, this bot would be able to bypass the protection.

Simple Login Captcha

Adds a simple 3-digit number captcha on the login form.

fullworks

Alan Fuller

A clean and simple AJAX contact form with Google reCAPTCHA, Twitter Bootstrap markup, spam filtering, and REST API support for headless WordPress implementations.
<ul>
<li>
Clean: all user inputs are stripped in order to avoid cross-site scripting (XSS) vulnerabilities.
</li>
<li>
Simple: AJAX enabled validation and submission for immediate response and guidance for your users (can be switched off).
</li>
<li>
Stylish: Use the included stylesheet or switch it off and use your own for seamless integration with your website. 
Uses Twitter Bootstrap classes.
</li>
<li>
REST API Support: Enable headless WordPress implementations to submit forms via authenticated REST API endpoints.
</li>
</ul>
This is a straightforward contact form for your WordPress site. There is very minimal set-up 
required. Simply install, activate, and then place the short code [cscf-contact-form] on your web page.
A standard set of input boxes are provided, these include Email Address, Name, Message and a nice big ‘Send Message’ button.
When your user has completed the form an email will be sent to you containing your user’s message. 
To reply simply click the ‘reply’ button on your email client. 
The email address used is the one you have set up in WordPress under ‘Settings’ -> ‘General’, so do check this is correct.
To help prevent spam all data is scanned can be scanned with Fullworks Anti Spam Pro. 
For this to work you must have the <a href="https://fullworksplugins.com/products/anti-spam/" title="Fullworks Anti Spam Pro" rel="nofollow ugc">Fullworks Anti Spam Pro Plugin</a> installed and activated.
Fullworks Anti Spam Pro will also log all your messages, categorized as spam or not, automatically.
For added piece of mind this plugin also allows you to add a ‘reCAPTCHA’. 
This adds a picture of a couple of words to the bottom of the contact form. 
Your user must correctly type the words before the form can be submitted, and in so doing, prove that they are human.
<h4>Why Choose This Plugin?</h4>
Granted there are many plugins of this type in existence already. Why use this one in-particular?
Here’s why:
<ul>
<li>
Minimal setup. Simply activate the plugin and place the shortcode [cscf-contact-form] on any post or page.
</li>
<li>
Safe. All input entered by your user is stripped back to minimise as far as possible the likelihood of any 
malicious user attempting to inject a script into your website. 
If the Fullworks Anti Spam Pro plugin is activated all form data will be scanned for spam. 
You can turn on reCAPTCHA to avoid your form being abused by bots, however Fullworks Anti Spam Pro will do this without reCAPTCHA.
</li>
<li>
Ajax enabled. You have the option to turn on AJAX (client-side) validation and submission which gives your users an immediate response when completing the form without having to wait for the page to refresh.
</li>
<li>
The form can integrate seamlessly into your website. Turn off the plugin’s default css style sheet so that your theme’s style sheet can be used instead.
</li>
<li>
If your theme is based on twitter bootstrap then this plugin will fit right in because it already has all the right div’s and CSS classes for bootstrap.
</li>
<li>
This plugin will only link in its jQuery file where it’s needed, it will not impose itself on every page of your whole site!
</li>
<li>
Works with the latest version of WordPress.
</li>
<li>
Original plugin written by an experienced PHP programmer, Megan Nicholas, the code is rock solid, safe, and rigorously tested as standard practice.
</li>
<li>
Headless WordPress ready. REST API support allows you to submit forms from decoupled frontends, mobile apps, or any external application with proper authentication.
</li>
</ul>
Hopefully this plugin will fulfil all your needs.
<h3>PHP 8 Ready</h3>
Tested on PHP 8.3
<h3>How to Use</h3>
Unless you want to change messages or add reCAPTCHA to your contact form then this plugin will work out of the box without any additional setup.
Important: Check that you have an email address set-up in your WordPress ‘Settings’->’General’ page. This is the address that the plugin will use to send the contents of the contact form.
To add the contact form to your WordPress website simply place the shortcode [cscf-contact-form] on the post or page that you wish the form to appear on.
If you have Jetpack plugin installed disable the contact form otherwise the wrong form might display.
<h3>Additional Settings</h3>
This plugin will work out of the box without any additional setup. You have the option to change the default messages that are displayed to your user and to add reCAPTCHA capabilities.
Go to the settings screen for the contact form plugin.
You will find a link to the setting screen against the entry of this plugin on the ‘Installed Plugins’ page.
Here is a list of things that you can change
<ul>
<li>
Message: The message displayed to the user at the top of the contact form.
</li>
<li>
Message Sent Heading: The message heading or title displayed to the user after the message has been sent.
</li>
<li>
Message Sent Content: The message content or body displayed to the user after the message has been sent.
</li>
<li>
Use this plugin’s default stylesheet: The plugin comes with a default style sheet to make the form look nice for your user. Untick this if you want to use your theme’s stylesheet instead. The default stylesheet will simply not be linked in.
</li>
<li>
Use client side validation (Ajax): When ticked the contact form will be validated and submitted on the client giving your user instant feedback if they have filled the form in incorrectly. If you wish the form to be validated and submitted only to the server then untick this option.
</li>
<li>
Use reCAPTCHA: Tick this option if you wish your form to have a reCAPTCHA box. ReCAPTCHA helps to avoid spam bots using your form by checking that the form filler is actually a real person. To use reCAPTCHA you will need to get a some special keys from google https://www.google.com/recaptcha/admin/create. Once you have your keys enter them into the Public key and Private key boxes
</li>
<li>
reCAPTCHA Public Key: Enter the public key that you obtained from here.
</li>
<li>
reCAPTCHA Private Key: Enter the private key that you obtained from here.
</li>
<li>
reCAPTCHA Theme: Here you can change the reCAPTCHA box theme so that it fits with the style of your website.
</li>
<li>
Recipient Emails: The email address where you would like all messages to be sent. 
This will default to the email address you have specified under ‘E-Mail Address’ in your WordPress General Settings. 
If you want your mail sent to a different address then enter it here. 
You may enter multiple email addresses by clicking the ‘+’ button.
</li>
<li>
Confirm Email Address: Email confirmation is now optional. To force your user to re-type their email address tick ‘Confirm Email Address’. 
It is recommended that you leave this option on. If you turn this option off your user will only have to enter their email address once, 
but if they enter it incorrectly you will have no way of getting back to them!
</li>
<li>
Email Subject: This is the email subject that will appear on all messages. If you would like to set it to something different then enter it here.
</li>
<li>
Override ‘From’ Address: If you tick this and then fill in the ‘From Address:’ box then all email will be sent from the given address NOT from the email address given by the form filler.
</li>
<li>
**Option to allow enquiry to email themselves a copy of the message.
</li>
<li>
Contact consent: This option allows you to be GDPR compliant by adding a ‘Consent to contact’ check box at the bottom of the form.
</li>
<li>
Enable REST API: Turn on REST API support to allow headless WordPress implementations to submit forms.
</li>
<li>
Required User Capability: Set the minimum WordPress user capability required to use the REST API (default: edit_posts).
</li>
</ul>
<h3>REST API for Headless WordPress</h3>
This plugin includes REST API support, making it perfect for headless WordPress implementations, mobile applications, and decoupled frontend frameworks like React, Vue.js, or Angular.
<h4>Enabling REST API</h4>
<ol>
<li>Go to the plugin settings page</li>
<li>Find the “REST API Settings” section</li>
<li>Check “Enable REST API”</li>
<li>Set the required user capability (default: edit_posts)</li>
<li>Save your settings</li>
</ol>
<h4>API Endpoint</h4>
POST <code>/wp-json/cscf/v1/submit</code>
<h4>Authentication</h4>
The REST API requires WordPress user authentication. Users must be logged in and have the capability specified in settings (default: edit_posts).
For headless implementations, you can use: 
– Application Passwords (WordPress 5.6+) 
– JWT Authentication plugins 
– OAuth plugins 
– Basic Authentication (development only)
<h4>Request Format</h4>
Send a POST request with JSON body:
<pre><code>`json
</code></pre>
{ 
 “name”: “John Doe”, 
 “email”: “john@example.com”, 
 “confirm_email”: “john@example.com”, 
 “message”: “Your message here”, 
 “phone_number”: “+1234567890”, 
 “contact_consent”: true, 
 “email_sender”: false, 
 “post_id”: 123 
} 
 `
Required fields: 
– <code>name</code>: Sender’s name 
– <code>email</code>: Sender’s email address 
– <code>message</code>: The message content
Optional fields: 
– <code>confirm_email</code>: Required if email confirmation is enabled in settings 
– <code>phone_number</code>: Required if phone number is set as mandatory in settings 
– <code>contact_consent</code>: Required if contact consent is enabled in settings 
– <code>email_sender</code>: Set to true to send a copy to the sender 
– <code>post_id</code>: The ID of the page/post where the form would normally be displayed
<h4>Response Format</h4>
Success Response (200): 
 <code>json 
{ 
 "success": true, 
 "message": "Message Sent" 
}</code>
Validation Error Response (400): 
 <code>json 
{ 
 "code": "validation_failed", 
 "message": "Validation failed.", 
 "data": { 
 "status": 400, 
 "errors": { 
 "email": "Please enter a valid email address.", 
 "message": "Please enter a message." 
 } 
 } 
}</code>
Authentication Error Response (401): 
 <code>json 
{ 
 "code": "rest_forbidden", 
 "message": "Authentication required.", 
 "data": { 
 "status": 401 
 } 
}</code>
<h4>Example Implementation</h4>
JavaScript (fetch API): 
 `javascript 
const formData = { 
 name: “John Doe”, 
 email: “john@example.com”, 
 confirm_email: “john@example.com”, 
 message: “This is a test message from the REST API” 
};
fetch(‘https://yoursite.com/wp-json/cscf/v1/submit’, { 
 method: ‘POST’, 
 headers: { 
 ‘Content-Type’: ‘application/json’, 
 ‘Authorization’: ‘Bearer YOUR_AUTH_TOKEN’ 
 }, 
 body: JSON.stringify(formData) 
}) 
.then(response => response.json()) 
.then(data => { 
 if (data.success) { 
 console.log(‘Message sent successfully!’); 
 } else { 
 console.error(‘Validation errors:’, data.data.errors); 
 } 
}); 
 `
<h4>Important Notes</h4>
<ul>
<li>REST API is disabled by default for security</li>
<li>reCAPTCHA is bypassed for REST API submissions (authentication provides security)</li>
<li>All other form validations and spam filtering still apply</li>
<li>Form submissions via REST API are processed identically to regular submissions</li>
<li>Email notifications work the same way as standard form submissions</li>
</ul>
<h3>Demo</h3>
Demo site coming soon.

Contact Form Clean and Simple

I was running this now on several websites and never had any problems. Each question I had was quickly answered by the developer.

Really great plugin, easy to use

A clean and simple contact form with Bootstrap markup.

Simple Login Captcha vs Contact Form Clean and Simple