Cloudflare Turnstileを利用するためのプラグインです。今後、Wp shed関連のプラグインで共通して利用します。
対応: WordPress 6.0 / PHP 8.1以上
使い方
更新履歴
v1.1.2
- Security: Client IP detection no longer trusts the `X-Forwarded-For` header unconditionally. The header is now only used when the request demonstrably passes through a proxy (`REMOTE_ADDR` is a private/reserved address), and the right-most value is taken instead of the left-most one. On directly exposed servers the header is ignored entirely, which prevents visitors from spoofing their IP address.
- Added: Sites behind an external CDN (Cloudflare and similar) are detected on the settings screen, with instructions for defining `SHEDTURN_TRUSTED_PROXY_HEADER` in `wp-config.php`.
- Tweak: `remoteip` is no longer sent to the Cloudflare siteverify endpoint when the client IP cannot be determined.
- Tweak: Declared compatibility with WordPress 7.1.
v1.1.1
- Added: CSV download button for debug log.
- Added: One-click connection test on the settings page.
v1.1.0
- Added: Debug log feature — record Turnstile verification results in the admin dashboard (Settings > Shed Turnstile > Debug Log tab).
v1.0.7
- Confirmed compatibility with WordPress 7.0
v1.0.6
- Fixed: Apply wp_unslash() to nonce field in admin settings save handler
- Added: languages/shed-turnstile.pot for translation support
v1.0.5
- Fixed: Sanitize externally-supplied $ip parameter in shedturn_verify_token()
- Fixed: Remove HTTP_CLIENT_IP trust in shedturn_get_client_ip() (spoofable header)
- Fixed: Add is_array() guard on json_decode result
- Added: Screenshots section to readme.txt
v1.0.4
- Added: GPL-2.0 LICENSE file
- Added: Domain Path header
- Fixed: i18n — all user-facing strings wrapped with __()
- Fixed: uninstall.php now removes legacy wsf_turnstile_* options
v1.0.3
- Changed: All function, class, constant, hook, and option prefixes renamed from wst_/WST_ to shedturn_/SHEDTURN_/Shedturn_.
v1.0.2
- Changed: Plugin slug