Category: Development

Posted on

Introducing OpenPorte: a free, open-source CAPTCHA for WordPress

If you’ve ever used ALTCHA Spam Protection on your WordPress site, I have some news: that plugin now lives on as OpenPorte.

What is OpenPorte?

OpenPorte is a free/libre, open-source anti-spam plugin for WordPress. It protects your comment forms, contact forms, login pages, and more from bots, without cookies, without tracking, and without sending your visitors’ data anywhere. Everything runs on your own site.

It’s built on the same friction-less, tick-a-box proof-of-work approach that made the original ALTCHA Spam Protection plugin popular: no distorted-letter puzzles, no picking out traffic lights, just a quick, invisible check that’s easy for humans and expensive for bots.

Schematic animation of the ALTCHA widget in action. It shows a cursor clicking the checkbox and being verified.

That’s the entire interaction1: one tick, a moment’s work in the background, done.

Why a fork?

ALTCHA Spam Protection (v1) was open-source software, free for anyone to use, inspect, and improve. Its original authors have since moved on to build a newer version, which is no longer fully open-source and puts some previously-free features behind a paywall, and they’ve retired the original v1 line.

I’d been a happy user of that original plugin for a while, so rather than lose it, I picked up the open-source project and kept it going under a new name, OpenPorte: a continuation of the v1 line, staying free/libre, open-source, and self-hosted, for anyone who wants to keep it that way.

If you are – or were – using ALTCHA v1, switching over is meant to be painless: install OpenPorte, and your existing settings come along automatically. Nothing you’ve already set up gets lost, and you can roll back if you ever want to. The only constraint is that you can’t run both plugins at the same time: it’s one or the other.

What’s new in the first releases (1.27.0 → 1.28.0)

The last open-source version of the ALTCHA plugin was 1.26.3. I picked up from there, and a few months in, here’s what’s landed:

  • ⛓️‍💥 Fully free, no paid tier at all. The old paid add-on for spam classification has been removed. Every feature in OpenPorte is free and self-hosted.
  • A friendlier settings page. Clearer wording, helpful hints next to every option, and a show/hide toggle for the shared secret key field.
  • ⚡️ Snappier verification. The small pause visitors used to see while the check ran has been cut from 1.5 seconds down to 0.5. That pause only ever changed how the check felt, it never made the plugin any better at stopping bots. What does help is the difficulty of the challenge itself, so there’s now a choice of algorithm, and the complexity levels have been retuned for modern hardware.
  • Several small but annoying bugs fixed, including a WooCommerce login/registration hiccup, a contact form that could show its widget twice, and a click that could get lost while a challenge was still verifying.
  • 💬 New languages. OpenPorte now speaks 14 languages, including isiXhosa 🇿🇦, German 🇩🇪🇦🇹🇨🇭…, Ukrainian 🇺🇦, Czech 🇨🇿, Polish 🇵🇱, Romanian 🇷🇴, Turkish 🇹🇷 and Chinese 🇨🇳.
  • Extra security hardening, tightened under the hood. I believe in frictionless security, so there’s nothing you need to do. I also believe in transparency, so you can read the code, audit it, or report anything you find on the project’s GitHub.
  • A refreshed look, with a new logo and banner art.

One more thing, transparency

OpenPorte is a one-person project, and I’m opinionated about how it gets built: AI tools (Claude, Mistral, locally-run LLMs and others) help with drafting code, tests, translations, and documentation. The architecture, security decisions, and final review are mine. Without that help, keeping this fork alive wouldn’t be realistic for one person — so it felt right to just say so.

This post is a case in point: I keep notes from every working session, then asked the AI to pick out the parts that fitted what I wanted this post to be, and to help me draft it.

What’s next

This post is meant to be a friendly hello world. There’s a livelier, more technical follow-up coming later, with some of the more interesting (and occasionally eyebrow-raising) stories from behind the scenes of taking over an abandoned plugin. Stay tuned.

If you want to try OpenPorte, or peek at the code, it’s all on GitHub.

Made with 💘 in the Ruhr area, Germany.

  1. The SVG animated image was created with AI and Inkscape. ↩︎
Posted on

How WordPress.org decides that a plugin is a “Community plugin”

While working on my WordPress plugin, I noticed that some plugins on wordpress.org display an additional “Community plugin” section in their developer sidebar, including a link to their source repository.

I initially assumed this was controlled by readme.txt, the plugin header, or some SVN convention. It turns out it is none of those.

Assisted by an AI Agent1, a little source-code archaeology revealed that WordPress.org uses an internal taxonomy plugin_business_model with terms including:

community
commercial
canonical

The taxonomy is registered by the Plugin Directory code and rendered by checking the assigned term.

The important detail for me turned out that this is not an author-controlled setting.

The taxonomy is available in the WordPress.org internal admin UI, but assigning it requires a special capability (plugin_set_category) that is only available to Plugin Team reviewers and administrators.

Once assigned, additional metadata becomes available (for example, a repository URL for Community plugins), but those fields only describe the classification; they do not create it.

So the answer is:

Plugin authors cannot enable the “Community plugin” badge themselves. It is an editorial classification assigned manually by the WordPress.org Plugin Team.

Use of AI

An AI writing assistant was used to create this article. It mainly supported me summarising the long investigation that was conducted.

  1. For this task I used Codex + ChatGPT Terra 5.6 and the all might grep. ↩︎
Posted on

The Best Companion to my Raspberry Pi

I got recently a companion for my Raspberry Pi.

A photo of a Arduino Uno R3
An Arduino Uno R3 – The 1 € coin is given for size comparison.

My goal is to use it to prototype something I want to make: a small network of temperature and humidity sensors running for months on batteries.

Why? First because I can (I need to learn a lot first regarding electronic or microcontrollers, but I’m sure I can). Second because we have add a few problems with humidity in our basement and I want to be able to have a better idea when this is happening to find a proper solution. My idea would be to correlate the measurements to others done externally and which would include more environmental data (e.g. pressure and amount of rain) and if possible with some events (e.g. gutters are overflowing water).

I already started the prototyping based on a tutorial from Adafruit – a Wifi Weather Station. The results works well as one could expect. So I validated my first part: yes I can do some basic electronic and microcontroller programming, the Raspberry Pi is doing the web server side.

My Prototype Environmental Sensor (WiFi based) v0.1
My Prototype Environmental Sensor (WiFi based) v0.1

A Simple Monitoring Web App (from Adafruit tutorial)
A Simple Monitoring Web App (from Adafruit tutorial)

The next step is reprogramming the microcontroller to push data periodically using plain UDP and either a Graphite, Statsd or Fluentd syntax. This would be pushed to a multicast address which my Raspberry Pi would listen to, it would run the Graphite/Statsd/Fluentd stack (I’m going to start with Graphite alone and see how good it is). I want to keep historical data of at least one month, perhaps even a bit more and to be able to visualise the data in real time.

Once this is done, then I want to get rid of the WiFi module and use a transceiver in the 433 or 868 MHz band (I’m in Europe). The Raspberry Pi will be the gateway between this radio-protocol and the more standard computer network stack. So I would need to adapt whatever I had chosen for stack on my Raspberry Pi to be able to cope with the new type of input. Either I contribute to a project if it is well architectured, or I build a bridge interface.

Final step of the prototyping will be to go low power. I’ve already approximately calculated how long I could run on 2 AA rechargeable batteries with the latest Arduino prototype and my “guestimates” is that it won’t last more than a week (probably less). So far from ideal. The solution is to build your own “Arduino”, meaning taking the microcontroller only (plus a few required components for it to run) and the needed components for the sensor. It seems that the power draw from the battery in this case would be sub mA. So I should be able to run many months on a 2 AA batteries :-)

Posted on

Too long without programming

I love programming! And because I do it less and less at work, I felt the need to do something about it.

I was looking for a project to help when I read the news about the new Raspberry Pi. And it took me only a couple of days to realise that was it, so I ordered it online and just received it. Raspberry Pi 2 Model BA beautiful little device with enough connectivity and power to have some fun!

I did not have much time yet to play with it, I was able to install Raspbian on it and that’s it. But I’m quite happy about my decision and I’m looking forward for the projects I plan with it (I’m hesitating between creating a weather station together with a small Arduino board as the “sensor”, or perhaps starting with something less ambitious maybe related to home automation).

Click more to see the system information (OS name, memory and CPU information) of that little wonder.

Continue reading “Too long without programming”

Privacy Policy Proudly powered by WordPress