Author: Predrag

Summary

Customers hosted on WordPress.com may experience a broken MemberPress Math Captcha on login, registration, and forgot-password forms. The captcha label displays only an asterisk (*) instead of the expected math question (e.g., “7 + 3 equals?”). Submitting the form redirects the user back to the login page in an infinite loop.

This issue is caused by WordPress.com’s infrastructure stripping inline <script> tags from page HTML. A similar symptom can also occur on non-WordPress.com sites when a third-party plugin causes a JavaScript error that prevents the captcha script from executing. This document provides steps to confirm the issue and a PHP code snippet workaround that resolves it.

Troubleshooting

Affected Environments

• Primary: WordPress.com hosting (Business and Commerce plans / Atomic infrastructure);
• Secondary: Any environment where inline <script> tags are stripped, or where third-party JavaScript errors crash subsequent scripts (e.g., Pretty Links has been observed to cause this).

Symptoms

• The Math Captcha field on the login, registration, or forgot-password form shows only * instead of the math question;
• The form may appear visually broken below the captcha field;
• Submitting the form redirects the user back to the login page (login loop);
• No PHP errors are generated. The issue is entirely front-end.

The login loop occurs because the Math Captcha answer is always empty when the question label fails to render. MemberPress validation rejects the submission and redirects back to the form.

Root Cause

The MemberPress Math Captcha renders its question label using an inline <script> tag. This script is embedded directly inside the form HTML (app/views/shared/math_captcha.php). It decodes a base64-encoded string and injects the math question into a <span> element.

On WordPress.com’s Atomic hosting platform, certain inline <script> tags are stripped during server-side processing. When this happens, the math question label is never rendered. The <span> remains empty, showing only the * that follows it, and the form structure may break.

On non-WordPress.com sites, the same symptom can occur if another plugin injects a JavaScript error earlier in the page. The captcha’s inline script runs in sequence with other scripts in the document body. A SyntaxError or similar exception from a preceding script prevents the captcha script from executing.

How to Confirm the Issue

1. Visit the affected login page in an incognito/private browser window.
2. Right-click the page and select View Page Source.
3. Search for mepr_math_captcha in the source.
4. Check whether the <script> block inside the .mepr_math_captcha div is present or missing.

Script Tag Is Missing

WordPress.com (or similar infrastructure) is stripping the inline script. Proceed to the workaround code snippet below.

Script Tag Is Present

Open the browser console (F12 > Console tab). Look for JavaScript errors from other plugins that may be crashing script execution before the captcha script runs. Deactivating the conflicting plugin resolves the issue in this case.

If the page is cached, the captcha may be served from a stale cached version even after settings are changed. Check the response headers for caching indicators (X-Ac: HIT, Server-Timing: cache;desc=HIT) before proceeding with troubleshooting.

Workaround: Code Snippet Fix

The following PHP snippet replaces the default Math Captcha renderer with one that does not use inline scripts. Instead, it stores the math question in an HTML data-* attribute and decodes it via a separate script enqueued in the page footer. This footer script is not affected by WordPress.com’s script stripping or by JavaScript errors from other plugins.

Prerequisites

• The WPCode plugin (free version) must be installed and activated on the site;
• The MemberPress Math Captcha must be enabled under Dashboard > MemberPress > Settings > General.

Steps to Apply the Snippet

1. Navigate to Dashboard > Code Snippets > + Add Snippet.
2. Click Add Your Custom Code.
3. Set the code type to PHP Snippet.
4. Paste the code below into the code editor.
5. Name the snippet (e.g., “MemberPress Math Captcha Fix”).
6. Set the snippet to Auto Insert and run it Everywhere.
7. Click Activate and Save.
8. Clear all caches (hosting-level, CDN, and browser) before testing.
9. Test the login page in an incognito window to confirm the math question displays correctly.

/**
 * MemberPress Math Captcha Fix
 * Replaces the default inline-script Math Captcha renderer
 * with a data-attribute approach that works on WordPress.com
 * and other environments that strip inline <script> tags.
 */

if (!defined('ABSPATH')) {
  exit;
}

add_action('after_setup_theme', function () {
  $options = class_exists('MeprOptions') ? MeprOptions::fetch() : null;

  if (!$options || empty($options->enable_math_captcha)) {
    return;
  }

  $render_hooks = [
    'mepr-checkout-before-coupon-field',
    'mepr_checkout_before_coupon_field',
    'mepr-forgot-password-form',
    'mepr_forgot_password_form',
    'mepr-login-form-before-submit',
    'mepr_login_form_before_submit',
  ];

  global $wp_filter;

  foreach ($render_hooks as $hook) {
    if (empty($wp_filter[$hook])) {
      continue;
    }

    foreach ($wp_filter[$hook]->callbacks as $priority => $callbacks) {
      foreach ($callbacks as $key => $callback) {
        if (
          is_array($callback['function']) &&
          is_object($callback['function'][0]) &&
          $callback['function'][0] instanceof MeprMathCaptchaCtrl &&
          $callback['function'][1] === 'render_field'
        ) {
          remove_action($hook, $callback['function'], $priority);
        }
      }
    }
  }

  add_action(
    'mepr-checkout-before-coupon-field',
    'mepr_snippet_render_math_captcha',
    12
  );
  add_action(
    'mepr-forgot-password-form',
    'mepr_snippet_render_math_captcha'
  );
  add_action(
    'mepr-login-form-before-submit',
    'mepr_snippet_render_math_captcha'
  );
}, 999);

if (!function_exists('mepr_snippet_render_math_captcha')) {
  function mepr_snippet_render_math_captcha() {
    if (!class_exists('MeprUtils') || MeprUtils::is_user_logged_in()) {
      return;
    }

    $key = get_option('mepr_math_captcha_key', false);

    if (!$key || 64 !== strlen($key)) {
      $key = bin2hex(random_bytes(32));
      update_option('mepr_math_captcha_key', $key);
    }

    $num1 = random_int(6, 15);
    $num2 = random_int(1, 5);
    $hmac = hash_hmac(
      'sha256',
      (string) ($num1 + $num2),
      $key,
      true
    );
    $data = base64_encode($hmac);

    $label_encoded = base64_encode(
      sprintf(
        __('%s equals?', 'memberpress'),
        "{$num1} + {$num2}"
      )
    );

    ?>
    <div class="mp-form-row mepr_math_captcha">
      <div class="mp-form-label">
        <label for="mepr_math_quiz">
          <span
            data-mepr-captcha-label="<?php
              echo esc_attr($label_encoded);
            ?>"
          ></span>*
        </label>
      </div>

      <input
        type="text"
        name="mepr_math_quiz"
        id="mepr_math_quiz"
        value=""
        class="mepr-form-input"
      />
      <input
        type="hidden"
        name="mepr_math_data"
        value="<?php echo esc_attr($data); ?>"
      />
    </div>
    <?php

    mepr_snippet_enqueue_captcha_decoder();
  }
}

if (!function_exists('mepr_snippet_enqueue_captcha_decoder')) {
  function mepr_snippet_enqueue_captcha_decoder() {
    static $enqueued = false;

    if ($enqueued) {
      return;
    }

    $enqueued = true;

    add_action('wp_footer', function () {
      ?>
      <script id="mepr-math-captcha-decoder">
      (function() {
        function meprMathCaptchaDecode(encodedData) {
          try {
            return decodeURIComponent(
              atob(encodedData)
                .split('')
                .map(function(c) {
                  return '%' + (
                    '00' + c.charCodeAt(0).toString(16)
                  ).slice(-2);
                })
                .join('')
            );
          } catch (e) {
            return encodedData;
          }
        }

        function initMeprMathCaptcha() {
          var labels = document.querySelectorAll(
            '[data-mepr-captcha-label]'
          );
          for (var i = 0; i < labels.length; i++) {
            var encoded = labels[i].getAttribute(
              'data-mepr-captcha-label'
            );
            if (encoded) {
              labels[i].textContent =
                meprMathCaptchaDecode(encoded);
            }
          }
        }

        if (document.readyState === 'loading') {
          document.addEventListener(
            'DOMContentLoaded',
            initMeprMathCaptcha
          );
        } else {
          initMeprMathCaptcha();
        }
      })();
      </script>
      <?php
    }, 99);
  }
}

How the Snippet Works

1. The snippet hooks into after_setup_theme at priority 999 to run after MemberPress has registered its default Math Captcha hooks.
2. It removes the default MeprMathCaptchaCtrl::render_field callback from all relevant form hooks.
3. It registers a replacement renderer (mepr_snippet_render_math_captcha) on the same hooks.
4. The replacement renderer outputs the captcha HTML with the math question stored in a data-mepr-captcha-label attribute (base64-encoded) instead of an inline <script> tag.
5. A separate JavaScript block is enqueued in the page footer via wp_footer. This script decodes the data-* attribute and injects the math question text into the label.
6. The HMAC validation logic is identical to the built-in Math Captcha. Answer verification works the same way.

This snippet is a temporary workaround. If a core fix is released in a future MemberPress version, the snippet should be removed to avoid conflicts.

Verification

1. Clear all caches (hosting-level, CDN, and browser).
2. Open the login page in an incognito/private browser window.
3. Confirm the Math Captcha field displays a math question (e.g., “12 + 3 equals?”).
4. Enter the correct answer and submit the form.
5. Confirm the login completes successfully without redirecting back to the login page.
6. Repeat the test on the registration and forgot-password forms if applicable.

Known Limitations

• The snippet must be removed if MemberPress releases a core fix for this issue in a future version;
• If using WPCode on WordPress.com and encountering a “Cannot redeclare” error, delete the old snippet entirely and add it as a new one. The function_exists() guards in the snippet prevent this in most cases;
• The snippet does not modify the captcha validation logic. It only changes how the question label is rendered on the front end.

Alternative Recommendation: Cloudflare Turnstile

For stronger bot protection that is not susceptible to this issue, recommend that the customer switch to Cloudflare Turnstile instead of the Math Captcha. Turnstile has a built-in MemberPress integration. It uses behavioral analysis rather than a solvable puzzle, and is significantly harder for bots to bypass.

MemberPress recommends Turnstile in the official documentation on preventing card testing and fraudulent sign-ups.

Caching Considerations on WordPress.com

WordPress.com uses aggressive CDN caching. When troubleshooting this issue, be aware of the following.

• The login page may be served from cache even after settings or snippets are changed;
• Check the X-Ac and Server-Timing response headers for HIT indicators to confirm caching;
• Always clear the WordPress.com cache via the hosting panel at wordpress.com/sites/[[DOMAIN]]/settings/caching and test in an incognito window after making changes;
• WordPress.com support may report caches are cleared when the CDN edge cache has not yet been purged for the specific URL.

Always instruct the customer to clear their WordPress.com hosting cache and test in an incognito window after applying the snippet or making any Math Captcha setting changes.

Public Facing Documentation / Additional References

Public Facing Documentation

• MemberPress Math Captcha documentation
• How to prevent card testing and fraudulent sign-ups with MemberPress
• MemberPress Login Page documentation
• MemberPress plugin and theme incompatibilities

Developer Documentation

• Action hooks in MemberPress (covers mepr-login-form-before-submit, mepr-checkout-before-coupon-field, and mepr-forgot-password-form hooks)
• WPCode plugin (WordPress.org)
• Simple Cloudflare Turnstile plugin (WordPress.org)