ALTCHA for WordPress Releases
3.3.0 Widget Update and UI fixes
2026-08-24- ALTCHA Widget updated to 3.2.2
- Minor admin UI fixes
3.2.0 Security Update
2026-08-05- Fix: nonce issue across admin AJAX endpoints
- Fix: use hash_equals in verification functions for constant-time comparison
- Fix: random_secret default size to 32 bytes
- Fix: rate limiter concurrency, algo changed from rolling window to fixed window
3.1.0
2026-07-28- New: support for secret key with Sentinel verification
- ALTCHA library updated to 2.1.0
- ALTCHA Widget updated to 3.2.1
3.0.4
2026-07-02- ALTCHA library updated to 2.0.3
3.0.3
2026-06-22- ALTCHA Widget updated to 3.1.0
- Fix: deprecation notice [#31]
3.0.2
2026-05-23- Add "Tested up to" with WP 7.0
- ALTCHA Widget updated to 3.0.10
3.0.1
2026-05-11- Fix: WP Login protection with custom action (compatibility with other login protection plugins)
3.0.0
2026-05-03- BREAKING: Requires PHP 8.1 or higher
- Action Required: Review and test all integrations before deploying to production
- New: ALTCHA Widget v3, introducing a new Proof-of-Work (PoW) mechanism
- New: Simplified settings for plugins and integrations
2.6.1
2026-03-23- Fix auto-updated and wp cli warning
- Fix interceptor - handle invalid GET requests with content-type headers
2.6.0
2026-02-27- Added option to bypass verification by User-Agent
- Added Independent Analytics and Optimization Detective default paths
- Fixed PHP warning in IP address detection
- Fixed ModSecurity false positives when saving settings [#24]
2.5.0
2026-01-26- Added option to configure challenge expiration
- Added filter
altcha_get_settings
2.4.2
2026-01-15- Fixed handling of malformatted altcha payload
2.4.1
2026-01-09- Fixed wp_scripts initialization error
2.4.0
2025-12-22- Added TranslatePress and PixelYourSite default actions
2.3.1
2025-12-14- Fixed possible replay attacks via salt splicing. Security Advisory
2.3.0
2025-12-11- Removed enforcement of default actions/paths during other plugins activation to avoid overwriting user configuration
- Fixed the enqueue order of the obfuscation script
- Added missing legacy and less commonly used timezones for geo-detection
2.2.0
2025-12-03- Introduced advanced event filtering for logs.
- Added a new "Bot" event type to differentiate between bot and failed attempts.
- Added request body logging for failed or bot attempts (can be enabled in Analytics settings).
- Added "Trusted Proxies" settings to improve security with IP detection from the HTTP_X_FORWARDED_FOR header.
2.1.2
2025-11-28- Add EventPrime plugin defaults
- Add "Tested up to" with WP 6.9
- Fix minor UI issues
2.1.1
2025-11-25- Add WooCommerce default exclusion path !/wc-api/*
- Fix SAPI CLI bypass
2.1.0
2025-11-22- Multi-site support
- Obfuscation shortcode (Docs)
- Ability to hide ALTCHA menu item from the sidebar
- Add meta tags for Git-Updater
2.0.11
2025-11-12- Fix analytics timezone mismatch issues
- Improve events table pagination
2.0.10
2025-11-08- Add altcha_inject filter
- Fix auto-updater issues
2.0.9
2025-11-05- Fix: Add missing timezones for geo-location
- UI improvements
2.0.8
2025-10-25- Fix MainWP compatibility
- Add bypass cookies
2.0.7
2025-10-20- Fix translation domain notice
2.0.6
2025-10-16- Fix Wordfence login issues
2.0.5
2025-10-15- Add missing timezones for geo-location
- UI improvements and fixes
2.0.4
2025-10-14- Auto-apply recommended actions and paths when plugins are activated
- Login protection is enabled by default
- Fix login protection with paths without wildcard
- UI improvements and fixes
2.0.3
2025-10-13- UI improvements and fixes
2.0.2
2025-10-08- Under Attack Mode is now disabled on excluded actions and paths
- Default excluded paths for "Real Cookie Banner"
- Enable debugging mode using local storage variable
2.0.1
2025-10-07- Fix login issues related to "hide login" plugins
2.0.0
2025-10-07- First public release