LaughterOnWater

GhostTrap provides sophisticated invisible spam protection using a comprehensive 5-layer detection system. Legitimate users comment normally while automated spam is silently blocked through advanced timing analysis, cryptographic validation, and behavioral detection.
<h4>5-Layer Protection System</h4>
<ul>
<li>Timing Analysis – Detects submissions too fast for human interaction</li>
<li>Cryptographic Signatures – Prevents replay attacks and form manipulation</li>
<li>Year Validation – JavaScript-enhanced field verification</li>
<li>JavaScript Detection – Ensures legitimate browser interaction</li>
<li>Honeypot Fields – Multiple hidden traps catch automated bots</li>
</ul>
<h4>Professional Features</h4>
<ul>
<li>Enhanced Admin Interface – Professional statistics dashboard with custom branding</li>
<li>Real-time Statistics – Track protection effectiveness with detailed blocking metrics</li>
<li>Configurable Timing – Adjust detection sensitivity from 5-300 seconds</li>
<li>WordPress 6.4+ Compatible – Full support for block themes and FSE</li>
<li>Admin Bar Integration – Quick spam statistics for administrators</li>
<li>Screen Options Control – User-configurable interface elements</li>
</ul>
<h4>Zero User Friction</h4>
All protection operates invisibly – no captcha, no puzzles, no delays. Users with JavaScript enabled see normal comment forms, while those with disabled JavaScript get simple year validation. Protection effectiveness remains high in both scenarios.
<h4>Performance Optimized</h4>
<ul>
<li>Lightweight JavaScript – Only 2KB, loads exclusively on comment pages</li>
<li>Smart Script Loading – Conditional loading based on comment form presence</li>
<li>Minimal Database Impact – Efficient storage with optional spam archiving</li>
<li>Browser Compatibility – Works across all modern browsers with graceful degradation</li>
</ul>
<h4>GDPR Compliant</h4>
No external services, no tracking, no personal data collection beyond standard WordPress comment processing. All spam detection happens locally on your server.
<h4>Attribution</h4>
Built upon the original Anti-spam plugin foundation by webvitaly, with comprehensive modernization, enhanced detection layers, and professional admin interface for current WordPress compatibility.
<h3>Privacy Policy</h3>
GhostTrap operates with privacy-first design principles:
<ul>
<li>No External Services – All spam detection processing occurs on your server</li>
<li>No Personal Data Collection – Uses only standard WordPress comment data for protection</li>
<li>No Tracking or Analytics – Zero data sharing with third parties or external systems</li>
<li>GDPR Fully Compliant – Minimal data processing with transparent, local-only operation</li>
<li>Optional Spam Storage – Blocked comments stored locally only if explicitly enabled</li>
</ul>
<h3>Advanced Configuration</h3>
<h4>Timing Threshold Recommendations</h4>
<ul>
<li>High Security Sites: 10-15 seconds (stricter protection)</li>
<li>General Purpose Sites: 15-20 seconds (balanced protection)</li>
<li>Accessibility-Focused Sites: 25-30 seconds (accommodates slower interaction)</li>
<li>Reading-Heavy Sites: 30+ seconds (allows time for content review)</li>
</ul>
<h4>Admin Interface Customization</h4>
<ul>
<li>Admin Bar Statistics – Toggle spam counter visibility in admin bar</li>
<li>Screen Options – Control information panel display on comments page</li>
<li>Dashboard Integration – Spam statistics in “At a Glance” widget</li>
<li>Contextual Help – Comprehensive protection information in WordPress help system</li>
</ul>
<h4>Technical Requirements</h4>
Server Environment: 
* WordPress 5.0 or higher 
* PHP 7.4 or higher 
* Standard WordPress hosting with wp_options table access
Browser Support: 
* All modern browsers (Chrome, Firefox, Safari, Edge) 
* Internet Explorer 11+ with graceful degradation 
* Mobile browsers with full functionality 
* JavaScript-disabled browsers with fallback protection
Performance Specifications: 
* JavaScript payload: ~2KB minified and compressed 
* Database impact: Single option row with minimal queries 
* Server processing: Sub-millisecond detection analysis 
* Memory usage: Negligible footprint during comment processing

GhostTrap

Advanced 5-layer invisible spam protection for comments. No captcha, no user friction - professional spam blocking.

WPChef

nikita.global

<a href="https://www.limitloginattempts.com" rel="nofollow ugc">Limit Login Attempts Reloaded</a> functions as a robust deterrent against <a href="https://www.limitloginattempts.com/cracking-the-code-unveiling-the-mechanics-behind-brute-force-attacks/" rel="nofollow ugc">brute force attacks</a>, bolstering your website’s security measures and optimizing its performance. It achieves this by restricting the number of login attempts allowed. This applies not only to the standard login method, but also to XMLRPC, Woocommerce, and custom login pages. With more than 2.5 million active users, this plugin fulfills all your login security requirements.
The plugin functions by automatically preventing further attempts from a particular Internet Protocol (IP) address and/or username once a predetermined limit of retries has been surpassed. This significantly weakens the effectiveness of brute force attacks on your website.
By default, WordPress permits an unlimited number of login attempts, posing a vulnerability where passwords can be easily deciphered through brute force methods.
Limit Login Attempts Reloaded Premium (Try Free with <a href="https://www.limitloginattempts.com/premium-security-zero-cost-discover-the-benefits-of-micro-cloud/" rel="nofollow ugc">Micro Cloud</a>) 
Upgrade to <a href="https://www.limitloginattempts.com/plans/" rel="nofollow ugc">Limit Login Attempts Reloaded Premium</a> to extend cloud-based protection to the Limit Login Attempts Reloaded plugin, thereby enhancing your login security. The premium version includes a range of highly beneficial features, including <a href="https://www.limitloginattempts.com/features/ip-intelligence/" rel="nofollow ugc">IP intelligence</a> to detect, counter and deny malicious login attempts. Your <a href="https://www.limitloginattempts.com/failed-login-attempts-in-wordpress/" rel="nofollow ugc">failed login attempts</a> will be safely neutralized in the cloud so your website can function at its optimal performance during an attack.
<iframe loading="lazy" title="Why Upgrading to Our Premium Version is a Game-Changer for Brute Force Protection" width="750" height="422" src="https://www.youtube.com/embed/JfkvIiQft14?feature=oembed" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share" referrerpolicy="strict-origin-when-cross-origin" allowfullscreen></iframe>
<h4>Features (Free Version):</h4>
<ul>
<li>Limit Logins – Limit the number of retry attempts when logging in (per each IP).</li>
<li>Configurable Lockout Timings – Modify the amount of time a user or IP must wait after a lockout.</li>
<li>Remaining Tries – Informs the user about the remaining retries or lockout time on the login page.</li>
<li>Lockout Email Notifications – Informs the admin via email of lockouts.</li>
<li>Denied Attempt Logs – View a log of all denied attempts and lockouts.</li>
<li>IP & Username Safelist/Denylist – Control access to usernames and IPs.</li>
<li>New User Registration Protection (Micro Cloud Accounts) – Protects default WP registration.</li>
<li>Sucuri compatibility.</li>
<li>Wordfence compatibility.</li>
<li>Ultimate Member compatibility.</li>
<li>WPS Hide Login compatibility.</li>
<li>MemberPress compatibility.</li>
<li>XMLRPC gateway protection.</li>
<li>Woocommerce login page protection.</li>
<li>Multi-site compatibility with extra MU settings.</li>
<li>GDPR compliant.</li>
<li>Custom IP origins support (Cloudflare, Sucuri, etc.).</li>
<li>llar_admin own capability.</li>
</ul>
<h4>Features (Premium Version):</h4>
<ul>
<li>Performance Optimizer – Offload the burden of excessive failed logins from your server to protect your server resources, resulting in improved speed and efficiency of your website.</li>
<li>Enhanced IP Intelligence – Identify repetitive and suspicious login attempts to detect potential brute force attacks. IPs with known malicious activity are stored and used to help prevent and counter future attacks.</li>
<li>Enhanced Throttling – Longer lockout intervals each time a malicious IP or username tries to login unsuccessfully.</li>
<li>Deny By Country – <a href="https://www.limitloginattempts.com/block-logins-by-country-in-wordpress/" rel="nofollow ugc">Block logins by country</a> by simply selecting the countries you want to deny.</li>
<li>Auto IP Denylist – Automatically add IP addresses to your active cloud deny list that repeatedly fail login attempts.</li>
<li>New User Registration Protection – Protects default WP registration.</li>
<li>Global Denylist Protection – Utilize our active cloud IP data from thousands of websites in the LLAR network.</li>
<li>Synchronized Lockouts – Lockout IP data can be shared between multiple domains for enhanced protection in your network.</li>
<li>Synchronized Safelist/Denylist – Safelist/Denylist IP and username data can be shared between multiple domains.</li>
<li>Premium Support – Email support with a security tech.</li>
<li>Auto Backups of All IP Data – Store your active IP data in the cloud.</li>
<li>Successful Logins Log – Store successful logins in the cloud including IP info, city, state and lat/long.</li>
<li>Enhanced lockout logs – Gain valuable insights into the origins of IPs that are attempting logins.</li>
<li>CSV Download of IP Data – Download IP data direclty from the cloud.</li>
<li>Supports IPV6 Ranges For Safelist/Denylist</li>
<li>Unlock The Locked Admin – Easily <a href="https://www.limitloginattempts.com/how-to-unlock-your-site-if-you-are-locked-out-by-limit-login-attempts-reloaded/" rel="nofollow ugc">unlock the locked admin</a> through the cloud.</li>
</ul>
*Some features require higher level plans.
<h4>Upgrading from the old Limit Login Attempts plugin?</h4>
<ol>
<li>Go to the Plugins section in your site’s backend.</li>
<li>Remove the Limit Login Attempts plugin.</li>
<li>Install the Limit Login Attempts Reloaded plugin.</li>
</ol>
All your settings will be kept intact!
Many languages are currently supported in the Limit Login Attempts Reloaded plugin but we welcome any additional ones.
Help us bring Limit Login Attempts Reloaded to even more countries.
Translations: Bulgarian, Brazilian Portuguese, Catalan, Chinese (Traditional), Czech, Dutch, Finnish, French, German, Hungarian, Norwegian, Persian, Romanian, Russian, Spanish, Swedish, Turkish
Plugin uses standard actions and filters only.
Based on the original code from Limit Login Attempts plugin by Johan Eenfeldt.
<h4>Branding Guidelines</h4>
Limit Login Attempts Reloaded™ is a trademark of Atlantic Silicon Inc. When writing about the plugin, please make sure to use Reloaded after Limit Login Attempts. Limit Login Attempts is the old plugin.
<ul>
<li>Limit Login Attempts Reloaded (correct)</li>
<li>Limit Login Attempts (incorrect)</li>
</ul>

Limit Login Attempts Reloaded – Login Security, Brute Force Protection, Firewall

Love that it shows how many attempts are left, so hopefully users don't lock themselves out. Also ought to deter hackers if they see that... and if it doesn't, then they get locked out anyway :)

It works great!


некоторое время работал, потом, видимо, пришло обновление и капец - начало просто всех подряд блокировать. Зайти в админку невозможно


перестал нормально работать

Just excellent

Block excessive login attempts and protect your site against brute force attacks. Simple, yet powerful tools to improve site performance.

GhostTrap vs Limit Login Attempts Reloaded – Login Security, Brute Force Protection, Firewall