—System status
Documentation

TrueSift for WordPress

TrueSift is the official WordPress integration for the TrueSift automated human-verification service.

The plugin provides:

  • a WordPress-native administration page;
  • live previews for the official checkbox, banner, inline, and badge layouts;
  • secure local challenge and browser-verification REST bridges;
  • authoritative, single-use proof verification before protected WordPress actions;
  • integrations for standard WordPress forms, WooCommerce classic and block checkout forms, Contact Form 7, WPForms, Fluent Forms, Elementor Pro Forms, and custom forms;
  • a shortcode and PHP helper for manual integrations.

Security boundary

The browser submits only the opaque verificationToken as proof. Client-reported decisions are not trusted. The PHP verifier sends the token with a server-signed form context and server-only TrueSift credentials to the official proof endpoint. A normal request continues only after TrueSift confirms an allow decision and atomic token consumption.

See docs/SECURITY.md and docs/INTEGRATION.md.

Installation

Upload truesift-1.0.18.zip through Plugins → Add New → Upload Plugin, activate it, then open Settings → TrueSift.

Compatibility

See docs/COMPATIBILITY.md. This release tracks the public @truesift/next 0.3.0 client and API contract.

WooCommerce Checkout Block

When the WooCommerce checkout integration is enabled, TrueSift supports both checkout architectures:

  • classic shortcode checkout through WooCommerce form hooks;
  • Checkout Block through Checkout Store extension data and Store API authentication validation.

The block bridge keeps the Place order flow unavailable until a token exists, publishes only the token and signed WordPress context under the truesift Store API extension namespace, and requests a fresh token after checkout failure. Store API draft updates that WordPress transports as POST requests with a REST method override remain updates and do not consume the one-time proof; the effective final POST checkout request remains fail-closed.

Debug mode

Enable Settings → TrueSift → Tools → Maintenance → TrueSift debug mode only while troubleshooting. The Tools tab records safe server-side diagnostics for challenge, verify, proof consumption, signed context validation, HTTP status, timing, response field names, and integration decisions. Reports can be downloaded as JSON or cleared from the same page.

Credentials and complete challenge, context, and verification tokens are never stored. Disable debug mode after the issue is reproduced.

Development

The release contains readable PHP, JavaScript, and CSS source. React is supplied by WordPress through the wp-element script handle. No Node.js build is required to install or run the plugin.

The generated browser adapter is stored in:

text
public/assets/truesift-sdk-0.3.0.js

The browser exposes release metadata through window.TrueSiftWordPressBuild, including the plugin version, SDK version, contract version, bundle filename, and combined cache revision.

It contains the client-side portions of the official TrueSift SDK contract adapted to WordPress' React runtime. Licensing details are in THIRD-PARTY-NOTICES.md.

License

The WordPress plugin is licensed under GPL-2.0-or-later. Bundled portions of @truesift/next retain their MIT notice.