FAIR

Federated and Independent Repositories

Human Verification Brain Puzzle For Login Security Guard

Plugin Banner

Human Verification Brain Puzzle For Login Security Guard

by Kamrul Islam

Download
Description

Human Verification Brain Puzzle For Login Security Guard replaces the traditional CAPTCHA with a lightweight, accessible 3×3 puzzle on the WordPress login page. Users must correctly complete the puzzle before the Log In button becomes active. The answer is also verified server-side, so it cannot be bypassed by disabling JavaScript.

How it works

  1. A random 3×3 puzzle is displayed on the login page.
  2. Each row and each column must contain the digits 1, 2, and 3 exactly once.
  3. Click (or tap) an empty cell to select it, then pick a number from the picker — or press 1, 2, or 3 on your keyboard.
  4. Once the puzzle is solved correctly, the Log In button becomes clickable.
  5. The answer is validated server-side on submission for extra security.

Features

  • 6 built-in puzzle variations chosen at random each visit.
  • Client-side validation with instant feedback (wrong cells highlighted in red).
  • Server-side answer verification — cannot be bypassed without JavaScript.
  • WP nonce protection against CSRF attacks.
  • Accessible: full keyboard navigation, ARIA roles and labels, aria-live status region.
  • No external requests — no JavaScript frameworks or CDN dependencies.
  • Tiny footprint: one CSS file, one JS file, one PHP class.
  • Fully translatable via standard WordPress i18n functions.
  • Matches native WordPress login page styling.
  • Works on the standard wp-login.php screen, the WooCommerce “My Account” login form, and the MemberPress login form.

Privacy

This plugin is stateless — it does not use PHP sessions, cookies, or any database storage. The puzzle shown to a visitor is bound to a signed WordPress nonce embedded in the form itself. No personal data is stored or transmitted to third parties.

Automatic installation

  1. Log in to your WordPress admin panel.
  2. Go to Plugins Add New.
  3. Search for Human Verification Brain Puzzle For Login Security Guard.
  4. Click Install Now, then Activate.

Manual installation

  1. Download the plugin .zip file.
  2. Upload and extract the human-verification-brain-puzzle-for-login-security-guard folder to /wp-content/plugins/.
  3. Go to Plugins Installed Plugins in your WordPress admin and activate the plugin.
  1. The login page with the 3×3 puzzle.

    The login page with the 3×3 puzzle.

Will this stop all bots?

Human Verification Brain Puzzle For Login Security Guard significantly raises the bar for automated login attacks compared to a simple username/password form. It is not intended to replace a full security suite — it works best alongside strong passwords and two-factor authentication.

Is it accessible?

Yes. Every interactive element has ARIA roles and labels, keyboard navigation is fully supported, and status messages are announced via an aria-live region.

Does it work with custom login pages?

The plugin hooks into the standard login_form action and authenticate filter for wp-login.php, plus woocommerce_login_form (WooCommerce “My Account” login) and mepr-login-form-before-submit (MemberPress login) so the puzzle appears and is enforced on those forms too. Custom login page plugins that call do_action('login_form') inside their form will also work.

Can I add my own puzzles?

Not through the admin UI in this release. Developers can filter the puzzles array by modifying the class — a settings screen and puzzle filter hook are planned for v2.

Does it conflict with other security plugins?

The plugin uses standard WordPress hooks at conventional priority levels and does not modify the database schema. It has been tested alongside Wordfence and iThemes Security without conflicts.

1.2.0

  • Adding Some Modern Style and security

1.1.0

  • Security: the puzzle solution is no longer sent to the browser — client-side feedback now relies on local row/column conflict detection instead of exposing the answer in page source.
  • Security: removed PHP session usage entirely in favor of a stateless, nonce-based puzzle token, avoiding the cache/session conflicts native PHP sessions can cause on WordPress hosting.
  • A new random puzzle is now shown on every page load/reload, not just after a failed attempt.
  • Added compatibility with the WooCommerce “My Account” login form.
  • Added compatibility with the MemberPress login form.
  • Fixed an incorrect ARIA label on empty puzzle cells.

1.0.0

  • Initial release.
Back to top