Block automated abuse on WordPress login, comments, and forms with privacy-friendly, self-hosted Proof-of-Work protection.

3zero

Javascript Comment Form Protection

Simple script to stop automated bots filling out comments now with password protection and encryption to make it better. Complete rewrite version 0.6

Silkalns

WP Chill

Cristian Raiber

Uber reCaptcha

This plugin adds the reCaptcha form to the WordPress login form, recover password form, register form and comment form.

Nurul Islam

Turnstile Pro – Cloudflare CAPTCHA Protection

Lightweight, easy-to-configure Cloudflare Turnstile CAPTCHA protection for WordPress login, registration, comments, and password reset forms.

Reuben Gunday

Combat Comments Bot

This plugin avoids bots posting comments directly on your site.

Softwaregarten

<p>Bots do not need to break into your site to cost you time. They can hammer login pages, flood comment forms, and push junk through public forms until your inbox, moderation queue, or customer workflow becomes noisy.</p>
<p>ProofShield adds a practical protection layer at the places where automated abuse usually enters a WordPress site: login, comments, and forms. It uses self-hosted browser proof-of-work, hidden bot traps, replay protection, and clear admin visibility so you can reduce automated submissions without adding an external CAPTCHA service for core protection.</p>
<h4>Why ProofShield?</h4>
<ul>
<li>Protect the entry points bots actually hit: WordPress login, comments, and selected forms.</li>
<li>Keep core protection local: no external API key is required for the proof-of-work challenge.</li>
<li>Stay usable for real visitors: the browser creates the proof quietly in the background.</li>
<li>See what happened: the statistics view shows allowed and blocked events by context.</li>
<li>Tune the level: choose relaxed, balanced, or strict behavior for your site.</li>
<li>Keep privacy decisions visible: optional location statistics can be disabled.</li>
</ul>
<h4>What the free plugin protects</h4>
<ul>
<li>WordPress login forms.</li>
<li>WordPress comment forms.</li>
<li>Generic HTML forms selected by CSS selector.</li>
<li>Frontend forms that can carry normal hidden fields.</li>
<li>Basic security statistics and recent event context.</li>
<li>Optional anonymized location statistics for blocked activity.</li>
</ul>
<h4>How it works</h4>
<p>When a protected form is used, ProofShield asks the browser to create a small local proof before the request is accepted. Bots that skip JavaScript, reuse old tokens, submit too quickly, or miss the hidden ProofShield fields are blocked before the protected action is processed.</p>
<p>For real visitors, the status card is short and clear. For site owners, the admin area shows which protection areas are active and what ProofShield has seen recently.</p>
<h4>Privacy-first by default</h4>
<ul>
<li>Core protection works locally and does not require an external API key.</li>
<li>The WordPress.org free plugin does not require account registration to run core features.</li>
<li>Location statistics are optional and can be disabled.</li>
<li>For location statistics, only anonymized IP ranges are stored.</li>
<li>Security/statistics events are retained for up to 30 days and deleted automatically.</li>
<li>WordPress personal data tools are supported for relevant ProofShield settings workflows.</li>
<li>Optional world map view can be disabled and is rendered locally in wp-admin.</li>
</ul>
<h4>Need more later?</h4>
<p>ProofShield is built so you can start with local core protection and upgrade only if your site needs deeper integrations. An optional separate Pro plugin, sold outside WordPress.org, adds advanced form integrations, WooCommerce login protection, dynamic form support, configured AJAX/REST endpoint protection, and Secure+ risk scoring.</p>
<p>The free WordPress.org plugin remains useful on its own: login, comments, generic forms, local proof-of-work, and basic statistics are included.</p>
<h3>External services</h3>
<p>ProofShield can use external Geo-IP services for optional location statistics in the admin statistics view.</p>
<p>When location statistics are enabled and the plugin needs approximate country/latitude/longitude data for a blocked IP address, it sends the visitor IP address to one of these services:</p>
<ul>
<li><code>ipapi.co</code> by Kloudend, used to look up approximate country and coordinates for blocked-IP statistics.<br />
Privacy policy: https://ipapi.co/privacy/<br />
Terms: https://ipapi.co/terms/</li>
<li><code>ipwho.is</code> (service provided by ipwhois.io), used as a fallback to look up approximate country and coordinates for blocked-IP statistics.<br />
Privacy policy: https://ipwhois.io/privacy<br />
Terms: https://ipwhois.io/terms</li>
</ul>
<p>No separate account is required to use this optional feature.</p>
<p>Core ProofShield protection (login, comments, and form protection) works locally and does not require these external services.</p>
<h3>Third-party assets</h3>
<p>ProofShield bundles a local world map dataset for the optional statistics map in wp-admin.</p>
<ul>
<li><code>world-atlas</code> by Mike Bostock, used as a bundled TopoJSON redistribution for the local world map rendering.<br />
Package: https://www.npmjs.com/package/world-atlas<br />
License: ISC<br />
Bundled files used by ProofShield: <code>assets/data/countries-110m.json</code>, <code>assets/data/land-110m.json</code></li>
<li>The bundled map geometry in <code>assets/data/countries-110m.json</code> and <code>assets/data/land-110m.json</code> is based on Natural Earth public domain map data.<br />
Source: https://www.naturalearthdata.com/<br />
Terms of use: https://www.naturalearthdata.com/about/terms-of-use/</li>
<li><code>world-countries-centroids</code> by Gavin Rehkemper, used as a bundled centroid dataset so country markers can be placed near the center of each country on the local map.<br />
Source: https://github.com/gavinr/world-countries-centroids<br />
License: MIT<br />
Bundled file used by ProofShield: <code>assets/data/country-centroids.csv</code></li>
</ul>
<p>The bundled world map is rendered locally in the browser and does not contact any external map service.</p>


Alternatives to ProofShield

Top alternatives