{"id":324018,"date":"2026-06-15T13:32:48","date_gmt":"2026-06-15T13:32:48","guid":{"rendered":"https:\/\/wordpress.org\/plugins\/openporte-spam-protection\/"},"modified":"2026-06-15T13:32:23","modified_gmt":"2026-06-15T13:32:23","slug":"openporte","status":"publish","type":"plugin","link":"https:\/\/wordpress.org\/plugins\/openporte\/","author":8177095,"comment_status":"closed","ping_status":"closed","template":"","meta":{"version":"1.27.1","stable_tag":"1.27.1","tested":"7.0","requires":"5.6","requires_php":"8.0","requires_plugins":null,"header_name":"OpenPorte Spam Protection","header_author":"OpenPorte","header_description":"OpenPorte is a free, open-source CAPTCHA alternative that offers robust spam and bot protection without using cookies, ensuring full GDPR compliance by design. A community-maintained fork of the ALTCHA Spam Protection plugin (v1).","assets_banners_color":"","last_updated":"2026-06-15 13:32:23","external_support_url":"","external_repository_url":"","donate_link":"","header_plugin_uri":"","header_author_uri":"https:\/\/github.com\/jcberthon\/openporte","rating":0,"author_block_rating":0,"active_installs":0,"downloads":26,"num_ratings":0,"support_threads":0,"support_threads_resolved":0,"author_block_count":0,"sections":["description","installation","changelog"],"tags":{"1.27.1":{"tag":"1.27.1","author":"huygens-25","date":"2026-06-15 13:32:23"}},"upgrade_notice":{"1.27.1":"<p>Changes requested by the wordpress.org plugin review: renamed an internal\nElementor integration class, removed the directory asset files from the plugin\npackage, and dropped the no-longer-needed load_plugin_textdomain() call. No\nfunctional change.<\/p>","1.27.0":"<p>First release of the OpenPorte community fork of ALTCHA Spam Protection v1. The\npaid altcha.org SaaS classifier is removed; self-hosted and custom backends are\nunchanged. ALTCHA v1 settings migrate automatically on activation. Deactivate\nthe old ALTCHA plugin first; don&#039;t run both at once.<\/p>"},"ratings":[],"assets_icons":{"icon-128x128.png":{"filename":"icon-128x128.png","revision":3573221,"resolution":"128x128","location":"assets","locale":"","width":128,"height":128},"icon-256x256.png":{"filename":"icon-256x256.png","revision":3573221,"resolution":"256x256","location":"assets","locale":"","width":256,"height":256},"icon.svg":{"filename":"icon.svg","revision":3573221,"resolution":false,"location":"assets","locale":false}},"assets_banners":[],"assets_blueprints":{},"all_blocks":[],"tagged_versions":["1.27.1"],"block_files":[],"assets_screenshots":[],"screenshots":{"1":"Friction-less Captcha without puzzles","2":"Configuration","3":"Protection on the login page","4":"Protection with WPForms","5":"Floating UI Captcha"}},"plugin_section":[],"plugin_tags":[11324,2656,362,131785,599],"plugin_category":[44,54],"plugin_contributors":[267252],"plugin_business_model":[],"class_list":["post-324018","plugin","type-plugin","status-publish","hentry","plugin_tags-anti-bot","plugin_tags-anti-spam","plugin_tags-captcha","plugin_tags-gdpr","plugin_tags-spam","plugin_category-discussion-and-community","plugin_category-security-and-spam-protection","plugin_contributors-huygens-25","plugin_committers-huygens-25"],"banners":[],"icons":{"svg":"https:\/\/ps.w.org\/openporte\/assets\/icon.svg?rev=3573221","icon":"https:\/\/ps.w.org\/openporte\/assets\/icon.svg?rev=3573221","icon_2x":false,"generated":false},"screenshots":[],"raw_content":"<!--section=description-->\n<p>OpenPorte is a community-maintained fork of the ALTCHA Spam Protection\nplugin for WordPress (version 1), which provides a free, open source,\nself-hostable, privacy-friendly CAPTCHA alternative based on a proof-\nof-work mechanism \u2014 no cookies, no tracking, GDPR-friendly by design.<\/p>\n\n<p>For the list of contributors, refer to our GitHub project: <a href=\"https:\/\/github.com\/jcberthon\/openporte\/graphs\/contributors?from=1.6.2024\">Contributors<\/a>.<\/p>\n\n<h4>Background<\/h4>\n\n<p>The original ALTCHA WordPress plugin (v1) was open source (GPLv2). Its\nauthors have since released a version 2\/3 which is no longer open source,\nand some features that were free in v1 are now paid. They no longer\nmaintain v1 and recommend that users migrate to v2\/v3. See the official\nproject at https:\/\/altcha.org for their offering.<\/p>\n\n<p>OpenPorte continues the v1 line as free software (GPLv2 or later) for users\nwho want to stay on a fully open-source, self-hosted solution. It is a\nfaithful fork: existing v1 installations can switch to OpenPorte and keep\ntheir settings (see Upgrading).<\/p>\n\n<h4>Compatibility<\/h4>\n\n<p>OpenPorte is backward-compatible with ALTCHA v1:<\/p>\n\n<ul>\n<li>Your existing settings are migrated automatically on activation.<\/li>\n<li>The <code>[altcha]<\/code> shortcode keeps working (alongside the new <code>[openporte]<\/code>).<\/li>\n<li>The <code>altcha_*<\/code> filters and actions keep firing as deprecated aliases.<\/li>\n<\/ul>\n\n<p>See the Deprecations section for the full list of compatibility aliases and\nwhat they map to.<\/p>\n\n<h3>Upgrading<\/h3>\n\n<h4>From the original ALTCHA v1 plugin<\/h4>\n\n<p>Deactivate the old ALTCHA plugin, then install and activate OpenPorte. Your\nexisting configuration is detected and copied into the OpenPorte settings on\nfirst activation; the original ALTCHA settings are left untouched, so you can\nroll back to ALTCHA v1 without losing anything. Do not run both plugins at the\nsame time.<\/p>\n\n<h3>Deprecations<\/h3>\n\n<p>The following ALTCHA-era identifiers are kept as aliases for backward\ncompatibility and are scheduled for removal in a future release:<\/p>\n\n<ul>\n<li>The <code>[altcha]<\/code> shortcode \u2014 use <code>[openporte]<\/code>.<\/li>\n<li>The <code>altcha\/v1<\/code> REST namespace \u2014 use <code>openporte\/v1<\/code>.<\/li>\n<li>The <code>altcha_*<\/code> filters and actions \u2014 now firing through WordPress' deprecated\nhook mechanism; use the <code>openporte_*<\/code> equivalents.<\/li>\n<li>The <code>AltchaPlugin<\/code> class and the <code>ALTCHA_VERSION<\/code> \/ <code>ALTCHA_WIDGET_VERSION<\/code>\nconstants \u2014 use <code>OpenPortePlugin<\/code> and the <code>OPENPORTE_*<\/code> constants.<\/li>\n<li>Integrations targeting paid-only third-party plugins; affected users should\nmigrate to the official ALTCHA v2\/v3 plugin.<\/li>\n<\/ul>\n\n<h3>Privacy<\/h3>\n\n<h4>No cookies, no tracking<\/h4>\n\n<p>OpenPorte prioritizes user privacy by avoiding the use of cookies and fingerprinting techniques.<\/p>\n\n<h4>No external service<\/h4>\n\n<p>This plugin remains fully contained within your WordPress installation, eliminating any reliance on external services.<\/p>\n\n<h3>Modes of Operation<\/h3>\n\n<p>OpenPorte verifies submissions in one of two modes, selected in the settings\n(API Mode):<\/p>\n\n<ul>\n<li>Self-hosted (default) \u2014 a proof-of-work challenge is issued and verified by\nyour own WordPress site through the REST API. Fully self-contained, with no\nexternal service and no additional setup beyond enabling the integrations you\nneed.<\/li>\n<li>Custom \u2014 point the Challenge URL at your own ALTCHA-compatible backend (for\nexample a self-hosted ALTCHA Sentinel). Submissions are verified with your\nsite's signing secret.<\/li>\n<\/ul>\n\n<p>The paid altcha.org regional SaaS classifier offered by earlier versions has\nbeen removed; both remaining modes are free and self-hostable.<\/p>\n\n<h3>REST API<\/h3>\n\n<p>This plugin requires the WordPress REST API. If you are using any \"Disable REST API\" plugins, ensure that the endpoint <code>\/altcha\/v1\/challenge<\/code> (marked for deprecation) and <code>\/openporte\/v1\/challenge<\/code> are allowed.<\/p>\n\n<h3>Supported Integrations<\/h3>\n\n<ul>\n<li>CoBlocks<\/li>\n<li>Contact Form 7<\/li>\n<li>Elementor Pro Forms (deprecated \u2014 paid plugin, see Deprecations)<\/li>\n<li>Formidable Forms<\/li>\n<li>Forminator<\/li>\n<li>GravityForms<\/li>\n<li>HTML Forms<\/li>\n<li>WPDiscuz<\/li>\n<li>WPForms<\/li>\n<li>WP-Members<\/li>\n<li>WordPress Login, Register, Password reset<\/li>\n<li>WordPress Comments<\/li>\n<li>WooCommerce<\/li>\n<li>Custom HTML (via the <code>[openporte]<\/code> shortcode, or the deprecated <code>[altcha]<\/code> alias)<\/li>\n<\/ul>\n\n<h3>Source Code<\/h3>\n\n<p>All source code for the plugin, and the ALTCHA widget is available on GitHub. In the repository, you'll also find versions of non-minified JavaScript and CSS assets:<\/p>\n\n<ul>\n<li>Plugin: https:\/\/github.com\/jcberthon\/openporte<\/li>\n<li>ALTCHA Widget: https:\/\/github.com\/altcha-org\/altcha<\/li>\n<\/ul>\n\n<!--section=installation-->\n<p>Download, install and activate <code>OpenPorte Spam Protection<\/code>.<\/p>\n\n<p>Alternatively, install the plugin manually:<\/p>\n\n<ol>\n<li>Download the <code>.zip<\/code> from the <a href=\"https:\/\/github.com\/jcberthon\/openporte\/releases\">Releases<\/a>.<\/li>\n<li>Upload <code>openporte<\/code> folder to the <code>\/wp-content\/plugins\/<\/code> directory  <\/li>\n<li>Activate the plugin through the 'Plugins' menu in WordPress  <\/li>\n<li>Review the settings and enable your integrations<\/li>\n<\/ol>\n\n<!--section=changelog-->\n<h4>1.27.1<\/h4>\n\n<ul>\n<li>Renamed the Elementor form-field integration class to use the <code>OpenPorte_<\/code> prefix, as requested by the wordpress.org plugin review (avoids the reserved <code>Elementor<\/code> prefix). No behaviour change.<\/li>\n<li>Removed the wordpress.org directory icon files from the plugin package; they are deployed separately as directory assets.<\/li>\n<li>Removed the <code>load_plugin_textdomain()<\/code> call: since WordPress 4.6 (we require 5.6+) translations are loaded automatically by core. No behaviour change.<\/li>\n<\/ul>\n\n<h4>1.27.0<\/h4>\n\n<ul>\n<li>Forked ALTCHA Spam Protection v1 as OpenPorte, a community-maintained, fully open-source (GPLv2 or later) continuation.<\/li>\n<li>Rebranded the plugin to OpenPorte: new <code>[openporte]<\/code> shortcode and <code>openporte\/v1<\/code> REST namespace, with the <code>[altcha]<\/code> shortcode, <code>altcha\/v1<\/code> endpoint, <code>altcha_*<\/code> hooks and the <code>ALTCHA_*<\/code> \/ <code>AltchaPlugin<\/code> symbols kept as deprecated aliases (see Deprecations).<\/li>\n<li>Existing ALTCHA v1 settings are copied into the OpenPorte namespace on activation; the original <code>altcha_*<\/code> options are left in place so you can roll back.<\/li>\n<li>Removed the paid altcha.org regional SaaS classifier; self-hosted proof-of-work and custom self-hostable backends are unchanged.<\/li>\n<li>Security: HMAC signatures are now compared with <code>hash_equals()<\/code> (timing-safe).<\/li>\n<li>Wrapped the \"This form requires JavaScript!\" message so it can be translated.<\/li>\n<li>Corrected the documented minimum requirements to match the plugin's existing PHP 8.0 \/ WordPress 5.6 floor.\nContributors (GitHub) for this release: jcberthon, ded-furby.\nCo-contributors: Mistral (AI), Claude (AI), GPT-OSS (AI).<\/li>\n<\/ul>\n\n<h4>1.26.3<\/h4>\n\n<ul>\n<li>Fixed possible replay attacks via salt splicing.<\/li>\n<\/ul>\n\n<h4>1.26.2<\/h4>\n\n<ul>\n<li>Updated readme for the new version 2.<\/li>\n<\/ul>\n\n<h4>1.26.1<\/h4>\n\n<ul>\n<li>Fix Elementor Pro Forms widget rendering<\/li>\n<\/ul>\n\n<h4>1.26.0<\/h4>\n\n<ul>\n<li>Added Formidable Forms integration<\/li>\n<li>Fixed PHP warning in the verify function<\/li>\n<li>ALTCHA Widget 2.2.2<\/li>\n<\/ul>\n\n<h4>1.25.0<\/h4>\n\n<ul>\n<li>Added hooks for improved customization and integration flexibility. [#45]<\/li>\n<\/ul>\n\n<h4>1.24.0<\/h4>\n\n<ul>\n<li>Fix issue with duplicate widget rendering in Elementor popups and WPDiscuz replies<\/li>\n<\/ul>\n\n<h4>1.23.0<\/h4>\n\n<ul>\n<li>Support for CoBlocks<\/li>\n<\/ul>\n\n<h4>1.22.1<\/h4>\n\n<ul>\n<li>Fix Gravity Forms validation with custom server <\/li>\n<\/ul>\n\n<h4>1.22.0<\/h4>\n\n<ul>\n<li>Fix Forminator multi-page forms<\/li>\n<li>Fix Gravity Forms with Sentinel and fields classification<\/li>\n<\/ul>\n\n<h4>1.21.0<\/h4>\n\n<ul>\n<li>ALTCHA Widget 2.0.2<\/li>\n<li>Widget scripts are now injected only on pages, which include the widget<\/li>\n<li>Support for custom Challenge URL and ALTCHA Sentinel<\/li>\n<\/ul>\n\n<h4>1.20.0<\/h4>\n\n<ul>\n<li>Enfold Theme (contact and newsletter forms) integration<\/li>\n<\/ul>\n\n<h4>1.19.0<\/h4>\n\n<ul>\n<li>Fix submit issues with Contact Form 7 + Conditional fields<\/li>\n<\/ul>\n\n<h4>1.18.0<\/h4>\n\n<ul>\n<li>Fix language with Contact Form 7<\/li>\n<\/ul>\n\n<h4>1.17.0<\/h4>\n\n<ul>\n<li>Update widget to 1.2.0<\/li>\n<li>Widget removes support for Expires header fixing potential auto-revalidation issues<\/li>\n<li>Widget script provided as a UMD module allowing for JS minification<\/li>\n<\/ul>\n\n<h4>1.16.0<\/h4>\n\n<ul>\n<li>Fix reply to comments from the admin page [#36]<\/li>\n<\/ul>\n\n<h4>1.15.0<\/h4>\n\n<ul>\n<li>Translations with gettext and automatic language detection [#33]<\/li>\n<\/ul>\n\n<h4>1.14.1<\/h4>\n\n<ul>\n<li>Fix the \"Settings\" link [#32]<\/li>\n<\/ul>\n\n<h4>1.14.0<\/h4>\n\n<ul>\n<li>Automatic language detection [#31]<\/li>\n<li>Change placement of the \"Settings\" link in the plugin list [#32]<\/li>\n<\/ul>\n\n<h4>1.13.1<\/h4>\n\n<ul>\n<li>Ignore WooCommerce form submissions in WordPress integration [#30]<\/li>\n<\/ul>\n\n<h4>1.13.0<\/h4>\n\n<ul>\n<li>WooCommerce integration [#26]<\/li>\n<li>Improved validation message [#27]<\/li>\n<li>Password lost error message [#28]<\/li>\n<\/ul>\n\n<h4>1.12.0<\/h4>\n\n<ul>\n<li>HTML Forms - skip verification if the shortcode is not in the form markup [#23]<\/li>\n<\/ul>\n\n<h4>1.11.1<\/h4>\n\n<ul>\n<li>Fix Forminator compatibility issue<\/li>\n<\/ul>\n\n<h4>1.11.0<\/h4>\n\n<ul>\n<li>Added support for WP-Members<\/li>\n<\/ul>\n\n<h4>1.10.0<\/h4>\n\n<ul>\n<li>Added support for WPDiscuz<\/li>\n<\/ul>\n\n<h4>1.9.3<\/h4>\n\n<ul>\n<li>Fix REST API Cache-Control header<\/li>\n<\/ul>\n\n<h4>1.9.2<\/h4>\n\n<ul>\n<li>Enable Custom HTML (shortcode) integration by default when activated<\/li>\n<\/ul>\n\n<h4>1.9.1<\/h4>\n\n<ul>\n<li>PHP 7 support (replace str_contains by strpos) [#19]<\/li>\n<\/ul>\n\n<h4>1.9.0<\/h4>\n\n<ul>\n<li>Widget updated to version 1.0.0<\/li>\n<li>CF7 - fix widget placement<\/li>\n<li>Fix page caching<\/li>\n<\/ul>\n\n<h4>1.8.0<\/h4>\n\n<ul>\n<li>Shortcode (custom integration) - fix mode (SpamFilter) <\/li>\n<\/ul>\n\n<h4>1.7.0<\/h4>\n\n<ul>\n<li>HTML Forms - add Shortcode option<\/li>\n<\/ul>\n\n<h4>1.6.1<\/h4>\n\n<ul>\n<li>Fix WordPress login integration<\/li>\n<\/ul>\n\n<h4>1.6.0<\/h4>\n\n<ul>\n<li>Fix Elementor Pro Forms widget rendering<\/li>\n<li>Fix Contact Form 7 widget position and shortcode support<\/li>\n<\/ul>\n\n<h4>1.5.0<\/h4>\n\n<ul>\n<li>Fix REST base URL (+ REST prefix removed from settings) [#13]<\/li>\n<\/ul>\n\n<h4>1.4.0<\/h4>\n\n<ul>\n<li>Support for Elementor Pro Forms<\/li>\n<li>Widget updated to 0.6.7<\/li>\n<\/ul>\n\n<h4>1.3.1<\/h4>\n\n<ul>\n<li>Fix site_url parsing issue [#11]<\/li>\n<\/ul>\n\n<h4>1.3.0<\/h4>\n\n<ul>\n<li>Added support for custom REST API prefixes<\/li>\n<\/ul>\n\n<h4>1.2.0<\/h4>\n\n<ul>\n<li>Forminator - fix widget rendering with file input<\/li>\n<li>Widget updated to 0.6.4<\/li>\n<\/ul>\n\n<h4>1.1.0<\/h4>\n\n<ul>\n<li>Shortcode - support for <code>language<\/code> attribute<\/li>\n<\/ul>\n\n<h4>1.0.0<\/h4>\n\n<ul>\n<li>Widget updated to 0.6.3<\/li>\n<\/ul>\n\n<h4>0.3.0<\/h4>\n\n<ul>\n<li>Added nonce sanitization<\/li>\n<li>Removed server-side spam filter (required for Plugin Directory)<\/li>\n<\/ul>\n\n<h4>0.2.1<\/h4>\n\n<ul>\n<li>Fixes requested by Plugin Directory review<\/li>\n<li>Fixed various Spam Filter issues<\/li>\n<\/ul>\n\n<h4>0.2.0<\/h4>\n\n<ul>\n<li>Widget updated to 0.6.0<\/li>\n<li>Added support for Floating UI<\/li>\n<\/ul>\n\n<h4>0.1.7<\/h4>\n\n<ul>\n<li>Fix Forminator multi-step forms<\/li>\n<\/ul>\n\n<h4>0.1.6<\/h4>\n\n<ul>\n<li>Widget updated to 0.5.1<\/li>\n<\/ul>\n\n<h4>0.1.5<\/h4>\n\n<ul>\n<li>Fixes requested by Plugin Directory review<\/li>\n<\/ul>\n\n<h4>0.1.4<\/h4>\n\n<ul>\n<li>GravityForms - added label and description options<\/li>\n<li>Altcha widget updated to 0.4.3<\/li>\n<\/ul>\n\n<h4>0.1.3<\/h4>\n\n<ul>\n<li>Fixed \"lost password\" verification bug<\/li>\n<li>Altcha widget updated to 0.4.1<\/li>\n<\/ul>\n\n<h4>0.1.2<\/h4>\n\n<ul>\n<li>Fixed widgets footer link and log warnings<\/li>\n<\/ul>\n\n<h4>0.1.1<\/h4>\n\n<ul>\n<li>Widget v0.4.0<\/li>\n<li>Challenge expiration<\/li>\n<\/ul>\n\n<h4>0.1.0<\/h4>\n\n<ul>\n<li>First version<\/li>\n<\/ul>","raw_excerpt":"OpenPorte offers a free, open-source Captcha alternative, ensuring robust spam protection while respecting user privacy and GDPR compliance.","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin\/324018","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin"}],"about":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/types\/plugin"}],"replies":[{"embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/comments?post=324018"}],"author":[{"embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wporg\/v1\/users\/huygens-25"}],"wp:attachment":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/media?parent=324018"}],"wp:term":[{"taxonomy":"plugin_section","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_section?post=324018"},{"taxonomy":"plugin_tags","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_tags?post=324018"},{"taxonomy":"plugin_category","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_category?post=324018"},{"taxonomy":"plugin_contributors","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_contributors?post=324018"},{"taxonomy":"plugin_business_model","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_business_model?post=324018"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}