Captcha Pro: Turnstile & hCaptcha changelog
All notable changes to Captcha Pro: Turnstile & hCaptcha (kv_captcha_pro) are documented here.
The format follows Keep a Changelog and the project uses Semantic Versioning.
[Unreleased]
Section titled “[Unreleased]”[1.0.0] - 2026-10-20
Section titled “[1.0.0] - 2026-10-20”- Spam check for CS-Cart forms through the CS-Cart antibot service: built-in check (honeypot, minimum fill-in time, signed proof-of-work ticket, no third party, no cookies), Cloudflare Turnstile and hCaptcha.
- Per-form protection (spam check + rate limit, rate limit only, off) and attempts per IP address for sign in, registration, password recovery, guest checkout, product reviews, comments, contact forms, newsletter and e-mail marketing sign-up, call requests, vendor sign-up, order tracking, back-in-stock notifications, gift certificates, polls and the admin and vendor panel sign-in.
- Checks for password recovery, product reviews and back-in-stock notifications, which CS-Cart renders but never validated.
- Every check rule ends the request on failure (a failed check on the sign-in form without a redirect URL no longer runs the sign-in).
- Allow-list for signed-in customers and IP addresses or ranges; trusted proxies for CDNs (forwarded headers from other senders are ignored).
- Fallback to the built-in check when the provider cannot be reached or its widget cannot load.
- Statistics per form and day with block reasons; no IP addresses stored.
- Google reCAPTCHA co-existence: takeover while it has no keys, one-click switch when it is set up.
- Full page cache support (4.21), license check, self-healing upgrades.