Filter out reCAPTCHA tokens and form-system fields from lead custom fields (g-recaptcha-response, hCaptcha, Cloudflare Turnstile, Contact Form 7 _wpcf7* internals). The exclusion list is filterable via crozap_excluded_fields.
1.1.1
Fix: add concatenation guard to frontend script so it is safe when a JS optimizer combines scripts (prevents a theme/reCAPTCHA conflict on sites using Combine JS).
1.1.0
Focus on Contact Form 7 and WPForms integrations; the built-in lead form (shortcode + block) is deferred to a future version.
API key safety: values that are not CROzap-shaped keys (UUIDs) are rejected on save and the previous key is kept, so browser password-manager autofill can no longer silently replace a working key.
Saved-key fingerprint on the settings page (first and last characters only) so you can verify which key is stored.
The API key field defeats aggressive browser autofill (readonly until focused).
The connection test runs automatically after saving a new key.
1.0.0
Initial release: built-in lead form (shortcode + block), Contact Form 7 and WPForms integrations, click-id capture (gclid, fbclid, _fbc, _fbp), UTM capture, visitor IP forwarding, retry queue, Test connection.
