GoogleReCaptcha

4 hooks fired by GoogleReCaptcha: 4 filters and 0 actions across 4 call sites. 4 of the 4 call sites are described by a docblock, at the call or on the constant that names the hook; the rest are listed with their signature and call sites only. Paths are relative to the plugin directory.

xpac_forms_enable_verification

Filter · 3 arguments · 1 call site

Filters whether this add-on runs its token verification for the current submission.

Reached only when the form's own reCAPTCHA toggle is already on, and only after every other validation rule has passed: the callback firing this is registered on "xpac_forms_submission_validation" at priority PHP_INT_MAX - 10 and returns the validation array untouched while it is already failing. Returning false skips the check entirely — no request is made to Google's siteverify endpoint, the submission proceeds as though no protection were configured, and the "reCAPTCHA" key is unset from the logged entry data, where it still holds the submitted token rather than a score.

Each provider passes its own slug as the third argument, so a callback can disable one without touching the others. The slugs in use are "google-recaptcha" (this call site), "akismet" and "cloudflare-captcha". Forms' built-in Honeypot check never fires this filter and so cannot be disabled through it. The Forms Auto Submit plugin is the working example: it returns false for "google-recaptcha" and "cloudflare-captcha", because a form auto-submitted from URL parameters has no browser to mint a token in, while deliberately leaving "akismet" running.

apply_filters( 'xpac_forms_enable_verification', true, $submission, 'google-recaptcha' )

• $enable (bool) — Whether to run the provider's check. Default true.
• $submission (Submission) — The submission being validated.
• $provider (string) — Slug of the provider asking. Always "google-recaptcha" at this call site.

Fired from:

• packages/GoogleReCaptcha/Addon.php:1036

xpac_google_recaptcha_allowed_hostnames

Filter · 1 argument · 1 call site

Filters the hostnames a successful siteverify verdict may name.

Google reports the host the token was actually minted on, and the default set is this site's own two URLs, so a verdict minted anywhere else is refused. A site reachable at more than one host — an apex and a www, or a CDN or reverse proxy whose hostname differs from home_url() — has to name the others here. Without that every submission from the second host is refused as "verification_mismatch", and the only signal is a line in the error log.

Entries may be bare hostnames or full URLs; both are reduced to a lowercased host with any trailing dot stripped. An empty list refuses everything, which is the safe direction: this check fails closed, never open.

apply_filters( 'xpac_google_recaptcha_allowed_hostnames', [home_url('/'), site_url('/')] )

• $hosts (string[]) — Hostnames or URLs whose tokens are accepted.

Fired from:

• packages/GoogleReCaptcha/Addon.php:1213

xpac_google_recaptcha_request_timeout

Filter · 1 argument · 1 call site

Filters how long, in seconds, to wait for Google to score a token.

This runs inside the visitor's submission, so the value is a latency budget rather than a tolerance: the visitor waits for it before the form can answer.

Clamped to 1-10 seconds. A request that times out leaves the submission unverified and refused, so lowering this trades spam protection for speed on a slow connection.

apply_filters( 'xpac_google_recaptcha_request_timeout', self::REQUEST_TIMEOUT )

• $timeout (int) — Seconds to wait. Default 5.

Fired from:

• packages/GoogleReCaptcha/Addon.php:1061

xpac_google_recaptcha_score_threshold

Filter · 1 argument · 1 call site

Filters the score threshold before it is clamped to the usable range.

The settings page is the normal source; this is for a threshold that comes from somewhere else, such as an environment variable or a network option shared by every site in a multisite. The result is still clamped afterwards, so a callback can neither switch the form off with a threshold nothing beats nor disable the check with a negative one.

apply_filters( 'xpac_google_recaptcha_score_threshold', $stored )

• $threshold (mixed) — Stored threshold, usually a numeric string.

Fired from:

• packages/GoogleReCaptcha/Addon.php:1427