About this plugin
TrueSift connects WordPress forms to the TrueSift verification service. It starts an automated browser challenge when a protected form is displayed, keeps the form submit action unavailable until an authoritative verification token is issued, and validates and atomically consumes that single-use token on the WordPress server before the protected action continues.
The plugin does not implement a separate CAPTCHA protocol. 0 client contract, and its PHP bridge uses the official TrueSift challenge, verify, and business-proof API contracts.
Included integrations
- WordPress login
- WordPress registration
- WordPress password reset request
- WordPress comments
- WooCommerce customer login
- WooCommerce customer registration
- WooCommerce checkout (classic and Checkout Block)
- WooCommerce product reviews
- Contact Form 7
- WPForms
- Fluent Forms
- Elementor Pro Forms
- Manual shortcode and PHP helper integration
The WooCommerce checkout integration supports both the classic shortcode checkout and the Checkout Block. Checkout Block proofs are carried through Store API extension data and validated before checkout processing.
Security model
The browser sends only an opaque verificationToken as security proof. Client-provided values such as allowed, decision, score, status, failOpen, challengeId, action, path, and origin are never trusted by the protected PHP action.
The plugin sends the token together with a signed WordPress form context to the server. The PHP verifier calls TrueSift’s proof endpoint with server-owned credentials and expected action, path, and origin. A normal success is accepted only when TrueSift confirms allowed: true, decision: allow, and atomic consumption through either consumed: true or a non-empty consumedAt timestamp.
Replayed, expired, invalid, mismatched, reviewed, or blocked proofs are rejected.
0 adapter may send optional Behavioral Signals v2 aggregates for the current verification window: pointer movements and presses, keyboard events, scroll and touch activity, focus, blur, visibility changes, interaction counts, and observation/interaction timing. The SDK samples high-frequency pointer and scroll activity and frees event listeners after verification or unmount. It does not send pointer coordinates, pressed keys, form contents, device fingerprints, or persistent visitor identifiers.
Older clients without v2 telemetry remain compatible; missing or insufficient behavioral telemetry remains neutral.
Visual modes
The admin page shows live, non-networked previews of all official layouts:
- Checkbox
- Banner
- Inline
- Badge
Theme, language, size, and appearance can be configured globally.
Manual integration
Place the shortcode inside a form:
[truesift]
When used outside a form, the same shortcode renders a standalone visual verification status. Standalone mode does not protect a business action until it is associated with a form and server-side verification.
For a form located elsewhere in the DOM:
[truesift form_selector="#contact-form" button_selector="button[type=submit]"]
A custom PHP handler must also validate the proof before performing its protected action:
$proof = truesift_verify_request();
Continue only when the returned value is not a WP_Error and its allowed value is true.
External services
This plugin connects to the external TrueSift service operated by WebDigiTech.
The following requests are made only when TrueSift is configured and a protected form or connection test is used:
- Browser challenge through the local WordPress route, forwarded server-to-server to https://api.truesift.de/api/v1/botguard/challenge
- Browser verification through the local WordPress route, forwarded server-to-server to https://api.truesift.de/api/v1/botguard/verify
- Authoritative single-use proof verification directly from the protected WordPress server action to https://api.truesift.de/api/v1/botguard/proof/verify
Data sent can include the site key, requested action, page path, website origin, browser language, languages, time zone, screen and viewport dimensions, platform information, cookie availability, referrer, current page URL, challenge identifiers, short-lived challenge tokens, verification timing, aggregate pointer, keyboard, scroll, touch, focus, blur, visibility and interaction counters for the active verification window, and the single-use verification token.
The behavioral counters contain counts only and do not contain pointer coordinates, actual pressed keys, form contents, fingerprints, or persistent visitor identifiers. The secret key is sent only server-to-server and is never exposed to the browser.
de/
de/#zugang
de/datenschutz
de/agb
Privacy
The plugin adds suggested text to WordPress’ Privacy Policy Guide. It does not store visitor verification tokens, browser metadata, or visitor profiles in the WordPress database. php constants.