GDimitrov

<p>FormShield is a powerful form protection plugin that uses advanced pattern matching, behavioral analysis, and IP tracking to protect your WordPress forms from spam and bots without requiring users to solve annoying captchas.</p>
<p><strong>Key Features:</strong></p>
<ul>
<li><strong>No License Restrictions</strong> – Protect unlimited forms for free</li>
<li><strong>No Captcha Required</strong> – Seamless user experience</li>
<li><strong>Advanced Bot Detection</strong> – Uses pattern matching, behavioral analysis, and IP tracking to identify bots</li>
<li><strong>14 Form Integrations</strong> – Works with all major form plugins</li>
<li><strong>Real-time Protection</strong> – Blocks spam in real-time</li>
<li><strong>Easy Setup</strong> – Works out of the box</li>
<li><strong>Form Location Tracking</strong> – See exactly where your forms are located (pages, posts, etc.)</li>
</ul>
<p><strong>Supported Form Plugins:</strong></p>
<ul>
<li>Contact Form 7</li>
<li>Gravity Forms</li>
<li>WPForms</li>
<li>Elementor Forms</li>
<li>Ninja Forms</li>
<li>Formidable Forms</li>
<li>Happy Forms</li>
<li>Fluent Forms</li>
<li>WeForms</li>
<li>WSForm</li>
<li>QuForm</li>
<li>Divi Contact Forms</li>
<li>WordPress Comments</li>
<li>And more coming soon!</li>
</ul>
<p><strong>How It Works:</strong></p>
<p>FormShield analyzes user behavior patterns, content patterns, IP history, email validation, and submission frequency to determine if a submission is from a real human or a bot. This multi-layered approach is more effective than traditional captchas and provides a better user experience.</p>
<p><strong>Privacy & Security:</strong></p>
<ul>
<li>Core spam protection runs entirely on your server — no data is sent offsite</li>
<li>Optional AbuseIPDB integration: if you enter an API key, the submitter’s IP address is sent to api.abuseipdb.com to check its abuse reputation. This is disabled by default and requires a user-configured API key</li>
<li>All other features are fully self-contained</li>
<li>GDPR compliant</li>
<li>No user data collection beyond standard WordPress logging</li>
</ul>
<h3>Privacy</h3>
<p>FormShield’s core spam protection runs entirely on your server. No data is transmitted offsite by default.</p>
<p><strong>Optional AbuseIPDB integration:</strong> If you configure an AbuseIPDB API key in Settings, the IP address of each form submitter will be sent to <code>api.abuseipdb.com</code> to check for known abuse. This feature is opt-in and disabled unless you provide a key. See https://www.abuseipdb.com/privacy-policy for their privacy policy.</p>
<p>All other processing — honeypot checks, content analysis, behavioral scoring, rate limiting — happens entirely on your WordPress installation.</p>


FormShield

FormShield protects your forms from bot spam using advanced pattern matching and behavioral analysis. No annoying captchas, unlimited forms.

Softwaregarten

<p>Bots do not need to break into your site to cost you time. They can hammer login pages, flood comment forms, and push junk through public forms until your inbox, moderation queue, or customer workflow becomes noisy.</p>
<p>ProofShield adds a practical protection layer at the places where automated abuse usually enters a WordPress site: login, comments, and forms. It uses self-hosted browser proof-of-work, hidden bot traps, replay protection, and clear admin visibility so you can reduce automated submissions without adding an external CAPTCHA service for core protection.</p>
<h4>Why ProofShield?</h4>
<ul>
<li>Protect the entry points bots actually hit: WordPress login, comments, and selected forms.</li>
<li>Keep core protection local: no external API key is required for the proof-of-work challenge.</li>
<li>Stay usable for real visitors: the browser creates the proof quietly in the background.</li>
<li>See what happened: the statistics view shows allowed and blocked events by context.</li>
<li>Tune the level: choose relaxed, balanced, or strict behavior for your site.</li>
<li>Keep privacy decisions visible: optional location statistics can be disabled.</li>
</ul>
<h4>What the free plugin protects</h4>
<ul>
<li>WordPress login forms.</li>
<li>WordPress comment forms.</li>
<li>Generic HTML forms selected by CSS selector.</li>
<li>Frontend forms that can carry normal hidden fields.</li>
<li>Basic security statistics and recent event context.</li>
<li>Optional anonymized location statistics for blocked activity.</li>
</ul>
<h4>How it works</h4>
<p>When a protected form is used, ProofShield asks the browser to create a small local proof before the request is accepted. Bots that skip JavaScript, reuse old tokens, submit too quickly, or miss the hidden ProofShield fields are blocked before the protected action is processed.</p>
<p>For real visitors, the status card is short and clear. For site owners, the admin area shows which protection areas are active and what ProofShield has seen recently.</p>
<h4>Privacy-first by default</h4>
<ul>
<li>Core protection works locally and does not require an external API key.</li>
<li>The WordPress.org free plugin does not require account registration to run core features.</li>
<li>Location statistics are optional and can be disabled.</li>
<li>For location statistics, only anonymized IP ranges are stored.</li>
<li>Security/statistics events are retained for up to 30 days and deleted automatically.</li>
<li>WordPress personal data tools are supported for relevant ProofShield settings workflows.</li>
<li>Optional world map view can be disabled and is rendered locally in wp-admin.</li>
</ul>
<h4>Need more later?</h4>
<p>ProofShield is built so you can start with local core protection and upgrade only if your site needs deeper integrations. An optional separate Pro plugin, sold outside WordPress.org, adds advanced form integrations, WooCommerce login protection, dynamic form support, configured AJAX/REST endpoint protection, and Secure+ risk scoring.</p>
<p>The free WordPress.org plugin remains useful on its own: login, comments, generic forms, local proof-of-work, and basic statistics are included.</p>
<h3>External services</h3>
<p>ProofShield can use external Geo-IP services for optional location statistics in the admin statistics view.</p>
<p>When location statistics are enabled and the plugin needs approximate country/latitude/longitude data for a blocked IP address, it sends the visitor IP address to one of these services:</p>
<ul>
<li><code>ipapi.co</code> by Kloudend, used to look up approximate country and coordinates for blocked-IP statistics.<br />
Privacy policy: https://ipapi.co/privacy/<br />
Terms: https://ipapi.co/terms/</li>
<li><code>ipwho.is</code> (service provided by ipwhois.io), used as a fallback to look up approximate country and coordinates for blocked-IP statistics.<br />
Privacy policy: https://ipwhois.io/privacy<br />
Terms: https://ipwhois.io/terms</li>
</ul>
<p>No separate account is required to use this optional feature.</p>
<p>Core ProofShield protection (login, comments, and form protection) works locally and does not require these external services.</p>
<h3>Third-party assets</h3>
<p>ProofShield bundles a local world map dataset for the optional statistics map in wp-admin.</p>
<ul>
<li><code>world-atlas</code> by Mike Bostock, used as a bundled TopoJSON redistribution for the local world map rendering.<br />
Package: https://www.npmjs.com/package/world-atlas<br />
License: ISC<br />
Bundled files used by ProofShield: <code>assets/data/countries-110m.json</code>, <code>assets/data/land-110m.json</code></li>
<li>The bundled map geometry in <code>assets/data/countries-110m.json</code> and <code>assets/data/land-110m.json</code> is based on Natural Earth public domain map data.<br />
Source: https://www.naturalearthdata.com/<br />
Terms of use: https://www.naturalearthdata.com/about/terms-of-use/</li>
<li><code>world-countries-centroids</code> by Gavin Rehkemper, used as a bundled centroid dataset so country markers can be placed near the center of each country on the local map.<br />
Source: https://github.com/gavinr/world-countries-centroids<br />
License: MIT<br />
Bundled file used by ProofShield: <code>assets/data/country-centroids.csv</code></li>
</ul>
<p>The bundled world map is rendered locally in the browser and does not contact any external map service.</p>


ProofShield

Block automated abuse on WordPress login, comments, and forms with privacy-friendly, self-hosted Proof-of-Work protection.

FormShield vs ProofShield