2.2.1

• The directory listing now shows the Connect button 2.2.0 added, as the first screenshot. The setup screen is what a reader decides on, and until now the pictures all showed a plugin that was already configured.
• "This domain is not in the project's allowed domains" now says which domain to add. The allow-list is an exact match, so a project holding example.com does nothing for a site running on www.example.com - and the old message left you to work that out. Test connection, the admin notice and the message under a rejected form all name it now.
• Nine languages caught up with the last three releases. The connect flow, the Activity panel and the badge choices were still showing in English everywhere outside en_US.

2.2.0

Setting the plugin up no longer means copying keys between two browser tabs. With both key fields empty you get a Connect to captchaapi.eu button: one screen asks for an email and a password, and your account, a project locked to this site, and both keys are in place when you land back here. The keys never pass through your browser - your server fetches them directly over a server-to-server call.

This is first-time setup only. If one key is already filled in, the button is replaced by a sign-in link: an existing account copies its keys from the dashboard, as before.

2.1.1

• The plugin directory listing now has screenshots. An invisible captcha is hard to show a picture of, so they show the things you can see: the Activity panel, which forms are covered, the line under a protected login form, and the notice that appears when the account stops issuing challenges.
• No changes to the plugin itself. If you are already on 2.1.0, this update only refreshes what the directory shows.

2.1.0

• New: an Activity panel on the settings screen. It answers the question an invisible captcha cannot answer on its own - is this thing working? Two figures come from your own site (submissions verified, submissions turned away) and one from captchaapi.eu (how much of your account's monthly allowance is gone). They are kept apart on purpose: a challenge that is issued and never submitted counts for the service and not for your site, so adding them together would produce a number that means nothing.
• When the service says it cannot issue challenges, the panel leads with that rather than with the figures. Account totals lag live traffic by up to fifteen minutes, and "4,800 of 5,000" reads as headroom to a site whose forms are already being turned away.
• Every protected form now carries a single line reporting whether the protection is running - WordPress core, WooCommerce including the checkout, and all seven supported form plugins. There is no puzzle and no checkbox to see, so until now neither you nor your visitors had any sign the plugin was working. It draws no box and no background, and each form gets its own: a WooCommerce account page shows one under the login form and one under the registration form.
• Optional: the same line can carry our logo and a link to captchaapi.eu. That is a credit on your public pages, so it is off unless you choose it under Settings -> captchaapi.eu.
• Both can be turned off entirely.
• The captchaapi.eu widget script is no longer stamped with the plugin's version number. It is the service's file on the service's release schedule, and tying it to ours meant a browser kept the build that shipped with your plugin version until the next plugin update.

2.0.3

• Fixed: logging in and resetting a password are never blocked by the state of your captchaapi.eu account. Previously a used-up free tier, a suspended account, or an unreachable service could reject the wp-login.php form and shut you out of your own site.
• Rejections now say why. Administrators see the reason next to the error, and a notice in the dashboard explains what to do when protected forms are being turned away.
• Failsafe mode is now clearly scoped to outages on our side. When the account cannot issue challenges at all - free tier used up, account suspended, project inactive - protected forms are rejected regardless of the setting, so protection never drops silently.
• Verification and connection checks time out after 3 seconds instead of 5, so a slow service does not hold up a submission.

2.0.2

Cleans up the translation list: product names (WPForms, Gravity Forms, and the rest) and the captchaapi.eu brand are no longer marked as translatable, so only real interface text remains to translate.

2.0.1

Clearer WordPress.org listing: the protected forms are grouped by WordPress core, WooCommerce, and form plugins, Gravity Forms and Elementor Forms are now listed (they were already supported), the tags are refreshed, and a short Privacy by design summary is added. No code changes.

2.0.0

2.0.0 moves verification to a server-to-server call. The plugin now confirms each response with the captchaapi.eu /verify endpoint, sending your secret key as a Bearer token, instead of checking a signed token locally. The form field is now captchaapi_response.

Single use is enforced by the service, so the local replay table and its hourly purge cron are gone, and an upgrade removes them automatically. Failsafe keys off the verify request: an unreachable service lets the form through, a definite rejection always blocks. Your keys and settings carry over.

1.1.2

Refreshed the plugin icon and directory banner with the new captchaapi.eu branding.

1.1.1

• Clearer directory listing: updated title, tags, and description to highlight the cookieless, EU-hosted protection and the supported form plugins.
• Documented failsafe mode in the FAQ: forms can stay usable during a captchaapi.eu outage, then strict protection resumes automatically.