Title: GridXFlex Captcha Security Author: Grid X Flex Published: 2026 年 8 月 26 日 Last modified: 2026 年 8 月 26 日 --- 搜尋外掛 ![](https://ps.w.org/gridxflex-captcha-security/assets/banner-772x250.png?rev=3667576) ![](https://ps.w.org/gridxflex-captcha-security/assets/icon-256x256.png?rev=3667576) # GridXFlex Captcha Security 由 [Grid X Flex](https://profiles.wordpress.org/gridxflex/) 開發 [下載](https://downloads.wordpress.org/plugin/gridxflex-captcha-security.1.0.0.zip) * [詳細資料](https://tw.wordpress.org/plugins/gridxflex-captcha-security/#description) * [使用者評論](https://tw.wordpress.org/plugins/gridxflex-captcha-security/#reviews) * [安裝方式](https://tw.wordpress.org/plugins/gridxflex-captcha-security/#installation) * [開發資訊](https://tw.wordpress.org/plugins/gridxflex-captcha-security/#developers) [技術支援](https://wordpress.org/support/plugin/gridxflex-captcha-security/) ## 外掛說明 GridXFlex Captcha Security adds a self-hosted image CAPTCHA, backed by a silent honeypot layer, to your site’s Login, Registration, Lost Password, and Comments forms. Everything is generated on your own server using PHP’s built-in GD library. No requests are ever sent to a third-party service, no API keys are required, and no personal data is stored beyond a short-lived, one-time-use security token. #### Features * Self-hosted image CAPTCHA (GD-generated, delivered inline as a base64 image — no extra HTTP request) * Silent honeypot field on every protected form, on by default * Per-form protection toggles: Login, Registration, Lost Password, Comments * Configurable character type (alphanumeric / letters / numbers), letter case, and length (3–6 characters) * Option to hide the comment captcha for logged-in users * One-time-use challenge tokens — each code can be attempted exactly once, then it’s gone * No PHP sessions, no cookies set by this plugin, no external requests, no tracking #### Why no PHP sessions? Older captcha plugins commonly call `session_start()` on every front-end request, even on pages that never show a captcha. That has a real performance cost, breaks under object-cache or load-balanced PHP-FPM pools without sticky sessions, and is incompatible with full-page caching. GridXFlex Captcha Security stores each challenge as a short-lived WordPress transient, keyed by a random token embedded in the form. The token is just a lookup key — the actual secret (a hash of the code) stays server- side — so it remains safe even on a cached page, and each challenge is deleted the instant it’s checked, pass or fail. ## 螢幕擷圖 [⌊Settings screen under Settings → GridXFlex Captcha.⌉⌊Settings screen under Settings → GridXFlex Captcha.⌉[ Settings screen under Settings GridXFlex Captcha. [⌊The image CAPTCHA as it appears on the login form.⌉⌊The image CAPTCHA as it appears on the login form.⌉[ The image CAPTCHA as it appears on the login form. ## 安裝方式 1. Upload the `gridxflex-captcha-security` folder to `/wp-content/plugins/`. 2. Activate the plugin through the “Plugins” screen in WordPress. 3. Go to **Settings GridXFlex Captcha** to choose which forms are protected and adjust the captcha’s appearance. ## 常見問題集 ### Does this plugin transmit any data externally? No. Code generation, image rendering, and verification all happen on your own server using PHP’s built-in GD library. Nothing is sent to any third-party API or service. ### Why doesn’t this use PHP sessions? For compatibility with page caching and load-balanced hosting. Instead of `$_SESSION`, each challenge is stored as a short-lived WordPress transient keyed by a random token embedded in the form. This works identically behind full-page cache and across load-balanced PHP-FPM pools without sticky sessions, and every challenge is automatically deleted after a single use. ### What is the honeypot layer? A hidden form field that’s invisible to human visitors but often auto-filled by simple bots. If it’s filled in, the submission is rejected the same way a wrong CAPTCHA code would be — no separate “bot detected” message is ever shown, so automated scripts can’t learn which check they failed. ### Does this require an API key? No. This version doesn’t use any third-party CAPTCHA provider. ### Does the plugin work if my host doesn’t have the GD PHP extension? Yes. If GD isn’t available, the image challenge is automatically skipped — protected forms keep working normally, they just fall back to honeypot-only protection instead of erroring out. You’ll see an admin notice explaining this; it clears itself automatically as soon as GD is enabled, no need to reactivate the plugin. ### Does the captcha add any visible branding to my site? An HTML comment — `` — is placed next to the captcha markup wherever it renders (login, registration, lost password, comments). It isn’t visible in the page as displayed, only in page source. ### What happens if someone gets the comment captcha wrong? They’re redirected back to the same post with an inline error message, and their typed name, email, URL, and comment text are restored — nothing is lost and they don’t leave the page. Login, Registration, and Lost Password show their errors the same way, inline on the same page, using WordPress core’s own error-display mechanism for those forms. ## 使用者評論 這個外掛目前沒有任何使用者評論。 ## 參與者及開發者 以下人員參與了開源軟體〈GridXFlex Captcha Security〉的開發相關工作。 參與者 * [ Grid X Flex ](https://profiles.wordpress.org/gridxflex/) [將〈GridXFlex Captcha Security〉外掛本地化為台灣繁體中文版](https://translate.wordpress.org/projects/wp-plugins/gridxflex-captcha-security) ### 對開發相關資訊感興趣？ 任何人均可[瀏覽程式碼](https://plugins.trac.wordpress.org/browser/gridxflex-captcha-security/)、 查看 [SVN 存放庫](https://plugins.svn.wordpress.org/gridxflex-captcha-security/)， 或透過 [RSS](https://plugins.trac.wordpress.org/log/gridxflex-captcha-security/?limit=100&mode=stop_on_copy&format=rss) 訂閱[開發記錄](https://plugins.trac.wordpress.org/log/gridxflex-captcha-security/)。 ## 變更記錄 #### 1.0.0 * Initial release: image CAPTCHA + honeypot for Login, Registration, Lost Password, and Comments forms. * Graceful fallback when the GD extension is unavailable: protected forms keep working via the honeypot layer alone instead of erroring; the admin notice re- checks live and clears itself once GD is enabled, no reactivation needed. ## 中繼資料 * 版本 **1.0.0** * 最後更新 **4 天前** * 啟用安裝數 **少於 10 次** * WordPress 版本需求 ** 5.7 或更新版本 ** * 已測試相容的 WordPress 版本 **7.1** * PHP 版本需求 ** 7.4 或更新版本 ** * 語言 * [English (US)](https://wordpress.org/plugins/gridxflex-captcha-security/) * 標籤: * [captcha](https://tw.wordpress.org/plugins/tags/captcha/)[comments](https://tw.wordpress.org/plugins/tags/comments/) [login](https://tw.wordpress.org/plugins/tags/login/)[security](https://tw.wordpress.org/plugins/tags/security/) [spam](https://tw.wordpress.org/plugins/tags/spam/) * [進階檢視](https://tw.wordpress.org/plugins/gridxflex-captcha-security/advanced/) ## 評分 這個項目尚無任何評論記錄。 [撰寫評分](https://wordpress.org/support/plugin/gridxflex-captcha-security/reviews/#new-post) [查看全部使用者評論](https://wordpress.org/support/plugin/gridxflex-captcha-security/reviews/) ## 參與者 * [ Grid X Flex ](https://profiles.wordpress.org/gridxflex/) ## 技術支援 使用者可在技術支援論壇提出意見反應或使用問題。 [檢視技術支援論壇](https://wordpress.org/support/plugin/gridxflex-captcha-security/)