WordPress quickstart

1. Create a site

In the dashboard, create a site and add the hostnames it will run on. Copy the site key (rgpk_..., public) and the secret key (rgsk_..., shown once, server only). Choose the mode: invisible, checkbox or score (modes and thresholds).

2. Install the plugin

Not published yet

The plugin is not on WordPress.org yet. Install it from source.

composer install
composer build            # writes dist/revokegpt (PHP 8.2 or later for the build tools)

Copy dist/revokegpt into wp-content/plugins/, activate it, then open Settings, RevokeGPT: enter the site key, the secret key and the endpoint of your RevokeGPT service, press “Test connection” and choose the forms to protect (login, registration, lost password, comments; WooCommerce checkout can also be scored). The plugin runs on PHP 8.1 or later.

wp-config-snippet.php

<?php
// In wp-config.php, above the line "That's all, stop editing!".

// Keep the secret key out of the database and out of the admin screen.
define( 'REVOKEGPT_SECRET_KEY', 'rgsk_...' );

// The way back in if you lock yourself out: uncomment, log in, fix the settings, remove it.
// define( 'REVOKEGPT_DISABLE', true );

3. Verify on the server

The plugin verifies every response token on your server with the RevokeGPT PHP SDK, bundled under its own namespace prefix so it cannot clash with another plugin’s copy. You write no verification code. To keep the secret key out of the database, set it in wp-config.php:

4. Read the score and the reasons

siteverify returns success, a score from 0.0 (bot) to 1.0 (human) in steps of 0.1, the action and hostname (or app) the token was issued for, and reasons, a list such as AUTOMATION or DATACENTER_IP. Always check success, the action and the hostname, then compare the score with a threshold you choose. 0.5 is a sensible start. See scores and reason codes and modes and thresholds.

5. Go live

• The secret key is in your server’s secret store, not in source control, a page or an app.
• The server checks success, the expected action, the expected hostname (or app) and a minScore.
• A refused or failed verification blocks the action. Treat every failure as “do not accept”.
• The token is sent over HTTPS and used once; a retry needs a new token.
• Your site’s allowed domains (or apps) in the dashboard list the real production hostnames.
• Your Content Security Policy allows the widget origin if you have one (see session tokens and cookies).