Ouch, #enshittification.
To anyone still on #WordPress and in need of a CAPTCHA plugin, I would always recommend using the open-source plugin called ALTCHA Spam Protection from altcha.org. If you don't know, #ALTCHA is a self-hosted alternative to your typical CAPTCHA, and it uses the proof-of-work mechanism hidden behind a single and simple checkbox instead of making your visitors pick busses or pedestrian crosses from multiple reloading photos, or align puzzle fragments with their designated places in the background images. It's alsio GDPR compliant because you aren't sharing any cookies or visitor info with third parties like Google.
So anyway, v1 of that WordPress plugin feels just perfect for a relatively small site: it's FLOSS, fully-functional, and handles not only Wordpress' stock forms, but also integrates with forms provided by some popular plugins too.
But then last autumn, came version 2 of the plugin, which, unlike v1, is a commercial product, built from a new repo, where LICENSE.txt has no traces of the original GPL license, but instead contains a EULA, which only grants end user two freedoms regarding the code:
- Access and use the Software solely for internal development, testing, debugging, and evaluation;
- Create Modifications of the Software solely for internal testing, debugging, and evaluation purposes.
Almost immediately, the FLOSS version 1 was marked as obsolete and all development on it ceased. The only "feature" that came out with version 1.26.2 was the nagbar, recommending all users to upgrade, and conveniently skipping the fact that the new version was a different plugin entirely. Only one bugfix version (1.26.3) came after.
When I noticed the nagbar, I raised a question in the GitHub repo of the original plugin, asking about its support status. IIRC, the response was something among the lines of "this plugin can be used indefinitely, but if you want any changes, you'll have to provide PR's", which seems reasonable. Actually, there's a similar topic on WordPress' support forum for this plugin, where the author said that as well, and even recommended continued use of version 1 for those who need its functionality.
Fast forward to this May, and – cue the drumroll – version 3.0.0 of the plugin was pushed to WordPress SVN repo. Guess what: all original functionality was deleted, and the plugin was renamed from "ALTCHA Spam Protection" to "ALTCHA: Spam Protection (Installer)". Anyone who updated the plugin automatically (or clicked the update plugins button without much investigation) suddenly lost their CAPTCHA functionality and got an unwanted "installer" for the commercial plugin instead. Two days later WordPress disabled the plugin and its downloads, citing "Guideline Violation", but the damage had been done already.
Nice, yeah? But that's not all. At some point this year (likely a bit later), the original plugin's repository has vanished from GitHub as well. Luckily, someone had forked a copy before that. Well, now I have my own fork as well!
It's just really disappointing to see a good product become hostage to its author's commercial ambitions to such an extent that they will actively harm its reputation along with their own. Did the dude really think people would want be more willing pay for his commercial services if he screwed them over first?