Fixing Really Simple CAPTCHA's Bloated Temporary File Problem

The Problem: A Slow Website and a Flood of Temporary Files

If you've found your server's disk space mysteriously disappearing or your WordPress site slowing to a crawl, the 'Really Simple CAPTCHA' plugin might be the culprit. A common issue reported by many users is the plugin's tmp directory becoming filled with thousands, or even hundreds of thousands, of old image (.png) and answer (.php, .txt) files that are not automatically deleted.

Why Does This Happen?

The 'Really Simple CAPTCHA' plugin is a framework; it doesn't work alone. It's used by other plugins, like Contact Form 7 or Tribulant Newsletter, to generate CAPTCHA challenges. The plugin is designed to clean up these temporary files after one hour. However, this automatic cleanup process can fail for several key reasons:

• Incorrect File Permissions (Especially on Windows Servers): This is the most frequent cause. By default, the plugin creates files as read-only. On some server configurations, particularly Windows/IIS, the web server process does not have the necessary permissions to delete these read-only files, causing the cleanup process to fail silently.
• Third-Party Plugin Implementation: The plugin or theme generating the CAPTCHA must properly call the cleanup() method. If the integrating code does not handle this correctly, files will never be removed.
• High Website Traffic: Even with a functioning cleanup system, a very high-traffic site will naturally generate a large number of temporary files between cleanup cycles.
• An Outdated Prefix Filter: In older versions, if a CAPTCHA was generated using a non-integer prefix (like one created with bin2hex()), the plugin's internal cleanup routine would incorrectly skip those files, leaving them behind permanently.

How to Fix It and Clean Up Your Tmp Folder

Based on community solutions from the WordPress support forums, here are the most effective ways to resolve this issue.

Solution 1: Modify File Permissions (The Most Common Fix)

This solution addresses the read-only file permission problem head-on. It involves editing the plugin's core file.

1. Backup Your Site: Always backup your website before editing any plugin files.
2. Access the Plugin File: Using FTP, SFTP, or your hosting provider's file manager, navigate to /wp-content/plugins/really-simple-captcha/.
3. Edit the PHP File: Open really-simple-captcha.php in a code or text editor.
4. Find and Change the Code: Locate the following lines (around lines 70-73):

   /* Mode of temporary image files */
   $this->file_mode = 0444;
   /* Mode of temporary answer text files */
   $this->answer_file_mode = 0440;

   Change them to:

   /* Mode of temporary image files */
   $this->file_mode = 0644;
   /* Mode of temporary answer text files */
   $this->answer_file_mode = 0640;

   This changes the file mode from read-only to read-write for the owner, allowing the web server to delete them.
5. Save the File and Upload: Save your changes and upload the file back to the server, overwriting the old one.
6. Manually Clean the Tmp Folder: For this fix to work on existing files, you must manually delete all old files from the /really-simple-captcha/tmp/ directory.

Note: Some users on Windows servers have reported needing to use even more permissive modes like 0666 and 0666 for this to work. Try 0644 first, as it is more secure.

Solution 2: Check the Integrating Plugin

If changing file permissions does not work, the issue may lie with the plugin that is using 'Really Simple CAPTCHA' (e.g., Contact Form 7, a newsletter plugin, or a custom form).

• Ensure that the other plugin is updated to the latest version. Its developers may have fixed a bug in how they handle CAPTCHA cleanup.
• Check the support forums for that specific plugin. For example, if you are using Tribulant Newsletter, search for "Tribulant Newsletter captcha cleanup" to see if other users have found a solution or if there is an official fix.

Solution 3: Implement a Manual Cleanup Cron Job

For a more hands-off approach, you can use a WordPress cron job to periodically clear out the temporary folder. You can add this code to your theme's functions.php file or a custom functionality plugin:

// Schedule a daily cleanup of the Really Simple CAPTCHA tmp directory
if ( ! wp_next_scheduled( 'rs_captcha_daily_cleanup' ) ) {
    wp_schedule_event( time(), 'daily', 'rs_captcha_daily_cleanup' );
}
add_action( 'rs_captcha_daily_cleanup', 'rs_captcha_delete_old_files' );

function rs_captcha_delete_old_files() {
    $upload_dir = wp_upload_dir();
    // Path to the tmp directory. Change this if your integrating plugin uses a different path.
    $captcha_dir_path = path_join( WP_PLUGIN_DIR, 'really-simple-captcha/tmp' );
    
    if ( is_dir( $captcha_dir_path ) ) {
        $files = glob( $captcha_dir_path . '/*' ); // get all file names
        foreach( $files as $file ){ // iterate files
          if( is_file( $file ) ) {
            @unlink( $file ); // delete file
          }
        }
    }
}

This code will delete every file in the tmp directory once per day. Use with caution, as it will delete files that are less than an hour old.

Solution 4: For Developers: Correctly Call the cleanup() Method

If you are developing a custom form and using the CAPTCHA class directly, you are responsible for cleaning up old files. The 'Really Simple CAPTCHA' team provides a cleanup() method for this purpose. You should implement a system, perhaps using a scheduled task, to call this method periodically.

$captcha_instance = new ReallySimpleCaptcha();
$captcha_instance->cleanup();

Conclusion

The accumulation of temporary files from 'Really Simple CAPTCHA' is a well-known issue, primarily stemming from file permission conflicts on Windows servers. The most reliable solution is to modify the file_mode and answer_file_mode values in the plugin's core file to allow the automatic cleanup process to function correctly. Always remember to manually clear the existing files after applying this change. If the problem persists, investigate the plugin that is implementing the CAPTCHA for any known issues.