Release notes

Every SOS Captcha release, newest first. New versions are offered from the Plugins screen of your WordPress admin.

1.0.85 — 2026-10-12

• Fix (Premium): the Statistics page now actually records validations. Its database table was never created and the counters were only loaded in the admin, so the page stayed on “No data yet”.
• New (Premium): slider figures in Statistics — average number of checkpoints and solving time per form, and a breakdown of blocked attempts by reason showing how far the slider went (a bot that never touches it collects no checkpoint). Statistics are kept one year and still contain no personal data.
• New: the soscaptcha_validation_success and soscaptcha_validation_failed actions receive the slider figures (checkpoints, collected, solving time) as an extra argument.

1.0.84 — 2026-10-12

• Security (login forms, Premium): the slider check on the WordPress login page and the WooCommerce My Account login has been strengthened. It now runs before the username and password are verified, and every sign-in attempt that does not pass the slider receives the same answer. Signing in with the slider solved works as before.

1.0.83 — 2026-10-12

• Fix (Contact Form 7): a message rejected by the slider is now stopped at Contact Form 7’s own anti-spam stage, before other add-ons process the submission. Until now the rejection only cancelled the e-mail, so add-ons that save submissions to the database (such as Contact Form CFDB7) could still keep rejected messages. Visitors see the same error message as before.
• New (Contact Form 7): soscaptcha_cf7_result action and SOSCAPTCHA_CF7::get_instance()->get_last_result(), to log or store how each submission was verified (status, checkpoints, error).

1.0.82 — 2026-10-06

• Fix: after a successful automatic update, WordPress could retry the very same version a little later and report “could not be updated (from X to X), previous version restored”. The updater compared the server’s version with the one still loaded in memory instead of the one on disk, leaving a stale “update available” entry behind. It now compares with the version WordPress reads from the plugin file. Download links issued by sos-captcha.com are also valid for 3 days instead of 1 hour, so a scheduled update can no longer hit an expired link.

1.0.81 — 2026-10-06

• Fix (Premium, Ninja Forms): the server-side verification of the slider on Ninja Forms submissions has been reworked and is now enforced reliably. The slider’s values travel in Ninja Forms’ own submission payload, and a submission that fails the check is rejected with an error shown above the form: nothing is saved or sent.
• Improved: a challenge is now bound to the form it was issued for, and the form type is checked whenever the challenge is looked up.
• Dev: the test suite was rebuilt — server-side suite repaired (it had been broken since the 1.0.54 rename), strict negative assertions, a server-side submission test per integration with email capture, and a non-interactive bin/test-all.sh. See CLAUDE.md “Test rules”.

1.0.80 — 2026-10-06

• Fix (Premium, WPForms): the server-side verification of the slider on WPForms submissions has been reworked and is now enforced reliably. A submission that fails the check is rejected with an explicit “Anti-spam check failed” message.
• New (Premium, WPForms): {soscaptcha_status} and {soscaptcha_checkpoints} smart tags for notification emails, the WPForms counterpart of the Contact Form 7 tags added in 1.0.78. Add them in the form builder under Settings → Notifications → Email Message, after {all_fields} (which never includes them on its own). Computed server-side; a visitor cannot alter them.

1.0.79 — 2026-10-06

• Fix: in some situations, the “Skip after first success” check could accept a submission it should not have. The verification process has been strengthened: the “already verified” state is now checked more strictly on the server and expires after a configurable duration. States recorded by previous versions are reset, so returning visitors solve the slider once more.
• New: “Skip duration” setting (Settings → Challenge reduction) — how long a solved challenge stays valid before the slider is shown again, from 1 minute to 24 hours (default: 60 minutes). Previously it lasted for the whole browser session.
• Dev: new soscaptcha_solved_cookie_ttl and soscaptcha_solved_cookie_context filters (the latter lets you bind the verified state to the visitor’s IP, for instance).

1.0.78 — 2026-10-06

• New: two special mail tags for Contact Form 7 notification emails, [_soscaptcha_status] and [_soscaptcha_checkpoints]. They tell you, for each message received, whether the slider was actually verified (and with how many checkpoints), skipped for a logged-in user or an already-verified session, or not run at all. Computed server-side, so a visitor cannot forge them. Add them to the mail body in Contact Form 7 → your form → Mail.

1.0.77 — 2026-10-05

• Fix: on multilingual sites, the slider texts were frozen in the administrator’s language for every visitor. Default texts now follow each visitor’s language; texts you customized are kept, and become translatable with WPML or Polylang.
• New: when the challenge was already solved in the current browser session, protected forms show “✓ Already verified in this session” instead of no slider at all.
• Fix: the slider’s confirmation text was always in French; it is now translated.
• Fix: corrected the translation of “Slide” (wrongly translated as a presentation slide) in most languages, and of “Slide to check” in German, Arabic, Italian and Chinese.

1.0.76 — 2026-10-02

• Fix: new strings stayed in English on translated sites. The plugin now always loads its bundled translations (always the most recent catalog), instead of an outdated WordPress.org language pack or the legacy premium catalog.
• Fix: wrong path for the slider’s JavaScript translations.

1.0.75 — 2026-10-02

• New: “Updates” settings tab with an automatic-updates toggle (same setting as the “Enable auto-updates” link on the Plugins screen).
• New: when automatic updates are off, an admin notice announces each new version with “Update now”, “Enable auto-updates” and “Ignore this version” actions.
• Fix: the “Protected by SOS Captcha” badge is now displayed under the slider on every protected form (Contact Form 7, WPForms, login…), not only on comment forms.
• Fix: the slider’s colored fill now follows the handle instantly instead of lagging behind it.

1.0.74 — 2026-06-19

• New: built-in automatic updates. The plugin now checks for and installs its own updates directly from sos-captcha.com, so you stay current without the WordPress.org directory.
• Internal: consolidated the plugin into a single codebase (premium features load from an internal module gated by license, rather than a separate add-on). No change to features — the free tier is unchanged, and licensed installs get the same premium functionality.
• Fresh installs now use the friendlier tuned defaults out of the box (4–6 checkpoints, 0.5s minimum per checkpoint, 30s rate limit, skip for logged-in users). Existing sites keep their saved settings.

1.0.73 — 2026-06-15

• Fully functional free plugin — no locked settings. Every control shown in the free plugin now works; there are no disabled, capped, or upgrade-gated options, and no license check of any kind. Features that belong to the separate SOS Captcha Pro add-on (extra integrations, advanced bot detection, custom colors, statistics, badge removal) appear only as plain informational notices, never as disabled controls.
• Checkpoint range is now the same for everyone (2–12), with no upgrade prompt.
• Custom slider colors moved entirely to the Pro add-on: the free plugin ships fixed default colors. Existing free sites are unaffected (the free build never persisted custom colors).

1.0.72 — 2026-05-26

• Friendlier defaults: minimum time per checkpoint lowered from 1s to 0.5s, rate-limit window from 60s to 30s, number of checkpoints now randomised between 4 and 6 (was a fixed 6), default challenge expiration aligned to 10 minutes (was 1 min, while the user-facing “expired after 10 minutes” notification copy already assumed 10). Existing sites keep their saved values; only new installs see the new defaults.

1.0.71 — 2026-05-06

• New helper SOSCAPTCHA_Generator::pro_extra_fields() / pro_extra_fields_html() — single source of truth for the Pro honeypot + browser-fingerprint hidden inputs that integrations need to render. Each of the 9 integration adapters (CF7, Comments, WPForms, Gravity Forms, Ninja Forms, WooCommerce reviews/checkout/registration, WP login/register/lost-password) now emits these fields when their toggles are on
• Slider JS now computes a base64-encoded JSON fingerprint ({ ua, lang, tz, screen }) on slider init and writes it into the hidden input — paired with Pro 1.0.10’s rewritten validator that checks the claimed UA matches $_SERVER['HTTP_USER_AGENT'] to detect automation toolkits

1.0.70 — 2026-05-06

• **Critical: slider validation failed on the last checkpoint.** The “next checkpoint highlight” code in assets/challenge-slider.js ran checkpointDots[lastCheckpoint + 1].style.borderColor = … after the AJAX block had already advanced lastCheckpoint to the final index — so it dereferenced undefined once the last dot was reached. The TypeError aborted the rest of updatePosition, including the setTimeout that writes collected tokens to the form’s hidden soscaptcha_tokens input. End result: form submitted with empty tokens → server rejected with “invalid_tokens”. Added a guard so the highlight only runs when there’s actually a next checkpoint.

1.0.69 — 2026-05-06

• **Critical fix: slider challenge wouldn’t load** (admin-ajax 400 with action: soscaptcha_get_challenge_config). The three front-end AJAX endpoints (get_challenge_config, collect_token, refresh_challenge) were registered PHP-side under the legacy wp_ajax_sos_* prefix, but the slider JS sends action=soscaptcha_* (matching the WP.org 4+ char prefix rule applied in 1.0.54). Mismatch meant **every** challenge fetch returned 400 — the slider couldn’t render and form submissions on protected pages couldn’t validate. PHP side now uses wp_ajax_soscaptcha_* to match. – Affected pages: every form protected by the plugin (login, comments, CF7, demo page, etc.) – Same root-cause family as the license-activation 400 (1.0.2) and the settings auto-save 400 (1.0.65) — finally hunted down the third instance.

1.0.68 — 2026-05-06

• Plugin Check fixes (regressions caught after 1.0.67 publish): proper escaping on the disabled-input attribute (now uses WordPress’s disabled() helper instead of echoing a raw string), /* translators: */ comment moved adjacent to its __() call, and load_plugin_textdomain() removed (WP auto-loads translations for WP.org-hosted plugins since 4.6 — the call is flagged as discouraged)

1.0.67 — 2026-05-06

• **Fix Pro integration toggles failing silently** — the integrations save handler’s allow-list was seeded with only the 2 free integrations (comments, cf7). Pro’s filter (since 1.0.64) only flips lock flags on the canonical registry instead of adding entries, so any Pro toggle (wpforms, gravityforms, etc.) was silently stripped during save. The handler now seeds from SOSCAPTCHA_Integrations::filtered() so all 9 keys are accepted, with a server-side guard that still blocks Pro toggles when the license isn’t active

1.0.66 — 2026-05-06

• Translations refreshed for all 9 non-English locales (no source-string changes; pairs with Pro 1.0.8 which ships the matching superset .mo)

1.0.65 — 2026-05-06

• **Fix admin Settings/Integrations not saving** — AJAX action names registered as wp_ajax_sos_save_* but the JS auto-save POSTed action=soscaptcha_save_*. Mismatch meant every change failed silently. Both sides now use soscaptcha_save_*
• **Fix critical error on the “Get Pro” page** — DeepL strips %s placeholders when translating short format strings, so printf( 'or %s/year (save 20%%)', $price ) blew up on PHP 8+ with ArgumentCountError. Refactored to two simpler translatable strings + runtime guard that falls back to English if the translation is missing the placeholder
• Translations regenerated; the previously broken yearly-savings line now renders cleanly in all 9 non-English locales

1.0.64 — 2026-05-06

• Integrations grid now shows the Pro form integrations (WPForms, Gravity Forms, Ninja Forms, WooCommerce, WP login/register/lost-password) as locked previews even when the Pro plugin isn’t installed at all — users see what’s available without needing to install Pro first
• New shared data file includes/data/integrations.php (single source of truth, mirrors the tier matrix pattern) accessed via the new SOSCAPTCHA_Integrations helper
• Re-added the 3 gradient color presets (Classic / Purple / Ocean) to the Appearance tab; locked when no Pro license is active
• Translations: refreshed for the new locked-preview, preset, and statistics strings

1.0.63 — 2026-05-05

• Settings page rebuilt to surface Pro features as locked previews — visitors and admins can see what each tier unlocks without installing Pro first – Validation tab: new “Advanced bot detection” section (behavior analysis, honeypot, browser fingerprint) shown disabled with a Pro badge until licensed – Challenge reduction tab: new “Auto-reload on timeout” toggle, locked until licensed – New “Appearance” tab with gradient color pickers and a “Show / hide badge” toggle, both locked until licensed
• New “Statistics” submenu entry in the admin sidebar (with a lock icon) when Pro isn’t active — click it to see the Pro upsell page
• New SOSCAPTCHA_Tiers::is_pro_active() helper backed by the soscaptcha_pro_active filter; Pro flips it on when its license is valid

1.0.61 — 2026-05-05

• New: single source of truth for plan tiers and feature matrix at includes/data/tier-matrix.php (readable through the SOSCAPTCHA_Tiers helper class). Both the free “Get Pro” page and the Pro plugin’s “License” page render from it, kept in sync with sos-captcha.com pricing
• “Get Pro” page rebuilt: 4-tier comparison (Free / Starter / Pro / Agency) with monthly + yearly prices, “MOST POPULAR” badge on Pro, per-tier CTAs to sos-captcha.com
• Translations: regenerated all .pot/.po/.mo for the latest source strings (previous .mo files dated back to 1.0.50, missing dozens of strings added by the prefix renames)

1.0.60 — 2026-05-05

• Translations: explicitly call load_plugin_textdomain() so admin strings translate on manually-uploaded installs (not just WordPress.org-distributed ones)
• Integrations grid: render Pro integrations with a “Pro” lock badge + Upgrade CTA when no Pro license is active (relies on the new premium_locked flag exposed by the Pro plugin’s soscaptcha_integrations filter)
• Add soscaptcha_show_get_pro_menu filter; the Pro plugin (1.0.2+) hooks it to hide the “Get Pro” upsell submenu once a license is active

1.0.59 — 2026-05-05

• Fix admin JS 404: rename admin/js/sos-admin.{js,min.js} → admin/js/soscaptcha-admin.{js,min.js} so the file matches the prefixed enqueue path introduced in 1.0.54

1.0.57 — 2026-05-05

• Fix fatal error on activation: rename class files from class-sos-*.php to class-soscaptcha-*.php so they match the require_once paths introduced in 1.0.54 (the rename touched the require paths but not the files on disk)
• WordPress.org Plugin Check: prefix view-scope variables in admin/views/{settings,integrations,get-pro}.php with soscaptcha_ to clear WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFound warnings

1.0.56 — 2026-05-05

• Prefix the three form-traveling input names (challenge_session, challenge_nonce, collected_tokens → soscaptcha_session, soscaptcha_nonce, soscaptcha_tokens) to avoid collisions with other plugins on host forms
• Updated all integrations (Contact Form 7, Comments + premium adapters) and the slider JS selectors accordingly

1.0.55 — 2026-05-04

• Extend the soscaptcha- prefix to CSS classes and script handles (4+ char prefix everywhere) for WordPress.org compliance

1.0.54 — 2026-05-04

• Rename PHP class prefix from SOS_ to SOSCAPTCHA_ and function prefix from sos_ to soscaptcha_ (4+ char prefix per WordPress.org guidelines)

1.0.53 — 2026-05-03

• Architecture: split the plugin into a free build (this plugin) and an optional sos-captcha-pro companion plugin loaded through WordPress filters/actions
• Free plugin no longer contains any premium code paths — addresses WordPress.org trialware concern
• Companion plugin declares Requires Plugins: sos-captcha (WP 6.5+)

1.0.52 — 2026-05-03

• Source assets shipped in the ZIP are now stripped of dev comments (CSS and JS), keeping the code human-readable for reviewers without leaking internal notes
• Plugin loaders unchanged: .min.js and .min.css load in production, source files load with SCRIPT_DEBUG=true
• Removed GitHub repo link from readme (source ships inside the plugin)

1.0.51 — 2026-05-03

• WordPress.org compliance round 2 (response to reviewer feedback)
• Trialware: build-time post-processor strips all $is_licensed conditionals from the free ZIP (new bin/strip-license-checks.php)
• Source code visibility: ship non-minified .js / .css alongside their .min counterparts; document GitHub repo in readme
• Security: AJAX endpoints now require a session-tied HMAC nonce (cache-friendly). Form submissions verify the nonce in the validator. All 8 integrations render the nonce field.

1.0.50 — 2026-04-29

• Rebrand: plugin renamed from “SOS Anti-Spam” to “SOS Captcha” — slug, text-domain and language files updated to “sos-captcha”
• Main file renamed: slide-out-spam.php → sos-captcha.php
• No functional change for existing installs; cleaner branding aligned with sos-captcha.com

1.0.49 — 2026-04-27

• WordPress.org compliance pass
• Prefix all AJAX actions with sos_ to avoid collisions
• Remove load_plugin_textdomain (not needed for plugins hosted on WordPress.org)
• Replace the License page in the free build with a Compare-plans page (no license input, no external API call)
• Premium upgrade is now a manual download from sos-captcha.com (Plugins → Add New → Upload)
• Initial public release
• Contact Form 7 and WordPress comments protection
• WP login, registration, and lost-password protection (Premium)
• Up to 8 checkpoints (Free) / 15 (Premium)
• 10-language support