Artem Frolov

Good Question is a free simple WordPress plugin to stop spam comments and registrations on the site. 
Allows to add a question on the comments and registration form, easy for humans, but not solvable for the spam bots. User must select correct answers, otherwise registration will fail.
The best thing of this super simple plugin is that it 100% works!
The smartest bots that easily pass the Google reCAPTCHA are helpless against the Good Question. Just because they don’t know what to do with that. Bots are not trained pass the Good Question validation because it’s not so popular as Google reCAPTCHA or other services.
The Good Question plugin successfully protects WordPress sites from spam registrations since 2013 and up for today.
Key features of the plugin:
<ul>
<li>100% effective. There are no services to help the bot to answer the abstract question, so they can’t pass validation.</li>
<li>Compatible with the most of the WordPress themes, including all AppThemes themes.</li>
<li>Works on the Registration form.</li>
<li>Works with WordPress MU Sign Up form.</li>
<li>Works on the Comments form.</li>
<li>Simple and lightweight.</li>
<li>Allow to create your own unique Question and set of Answers.</li>
<li>Allow to edit all CSS properties for Question and each of Answers separately.</li>
<li>There is absolutely no difference of which question and how many answers you configure for a good question, just make it easy for your real visitors.</li>
<li>You can set colors or images through CSS properties, instead of simple text answers.</li>
</ul>

Good Question

Simple plugin to stop spam comments and registrations on your site. Adds a question field on the form, easy for humans, but not solvable for the bots.

ZeroBot

ZeroBot Security brings the full ZeroBot antibot platform to WordPress, adding six layered defenses 
managed from a single dashboard. Every event is screened against a 1.5M+ IP intelligence database, 
fingerprint-based scoring, and real-time threat sharing across the ZeroBot network.
<h4>Six Protection Layers</h4>
<ul>
<li>Page Protection — Per-page antibot screening. Renders Cloudflare Turnstile or the ZeroBot 
native slider captcha for borderline visitors before letting them through.</li>
<li>Firewall — Site-wide screening of every public request against the ZeroBot threat database.</li>
<li>Login Brute-Force Guard — Tracks failed logins per IP, auto-blocks after N attempts, 
optionally pushes IPs to your ZeroBot blacklist.</li>
<li>Comment Guard — Blocks bot comments before they’re saved.</li>
<li>REST API Guard — Screens public REST calls (with configurable exempt routes).</li>
<li>XML-RPC Guard — Disables XML-RPC entirely (a major attack vector).</li>
</ul>
<h4>Full Platform Management</h4>
<ul>
<li>Domain Rules — Create, edit, and delete antibot rules from inside wp-admin.</li>
<li>Whitelist — IPs, CIDR ranges, and ASNs scoped per service. Bulk import supported.</li>
<li>Blacklist — Same scoping and bulk import as the whitelist.</li>
<li>Threat Logs — Filterable, paginated viewer of every traffic event with CSV export.</li>
<li>Dashboard — Live stats, 7-day traffic chart, recent threats, account info.</li>
</ul>
<h4>Other Features</h4>
<ul>
<li>Cloudflare / proxy IP detection (CF-Connecting-IP, X-Real-IP, X-Forwarded-For)</li>
<li>Decision cache via WordPress object cache (Redis/Memcached) with transient fallback</li>
<li>Fail-open by default — never breaks your site if the API is unreachable</li>
<li>Daily license verification via wp-cron</li>
<li>WP-admin dashboard widget showing bots/humans (24h)</li>
<li>Pure PHP + vanilla JS — no jQuery, no React, no external CDN</li>
</ul>
<h3>External Services</h3>
This plugin connects to the following third-party service to provide its core bot-detection 
and threat-intelligence features. Nothing is contacted until the administrator enters a 
license key and activates a protection layer.
1. ZeroBot API (https://zerobot.info)
<ul>
<li>What it does: Classifies visitors as human or bot, synchronizes domain rules / whitelists / 
blacklists, and returns threat log data for the dashboard.</li>
<li>When it’s called: On every public request that one of the enabled protection layers handles 
(Firewall, Page Protection, Login Guard, Comment Guard, REST API Guard). Also called from the 
admin dashboard for stats, rules, lists, and traffic logs. Also called once per day by 
wp-cron for license verification.</li>
<li>Data transmitted: Visitor IP address, user agent, current URL host, site domain, and the 
plugin’s license key. No post content, no customer personal data, no form submissions.</li>
<li>What it returns: A JSON decision object (<code>is_bot</code>, <code>reason</code>, <code>risk_score</code>, optional 
 captcha_html), plan metadata, and aggregate stats for the dashboard.</li>
<li>Terms & Privacy: https://zerobot.info/terms — https://zerobot.info/policy</li>
</ul>
2. ZeroBot Fingerprint Collector (https://zerobot.info/fingerprint/index.js)
<ul>
<li>What it does: Collects client-side browser signals (canvas, WebGL, fonts, behavior) to detect 
headless browsers, VMs, and automation frameworks.</li>
<li>When it’s loaded: Injected on public pages and the login screen ONLY when the administrator 
enables “Browser Fingerprint” in Protection Settings. It is disabled by default; the plugin 
does not load any external JavaScript out of the box.</li>
<li>Data transmitted: Browser fingerprint signals and the visitor’s IP address. No WordPress 
user data, no cookies, no form data.</li>
<li>What it returns: A risk score used to decide whether a visitor should face a soft challenge.</li>
<li>Terms & Privacy: https://zerobot.info/terms — https://zerobot.info/policy</li>
</ul>
3. FlagCDN (https://flagcdn.com)
<ul>
<li>What it does: Serves tiny country-flag PNG images for the admin-only traffic log.</li>
<li>When it’s loaded: Only inside wp-admin, only when the administrator opens the Dashboard or 
Threat Logs page. It is never loaded on the public site. Only 2-letter ISO country codes are 
transmitted as part of the image URL.</li>
<li>Data transmitted: The 2-letter country code and standard image-request metadata. No visitor 
data, no WordPress data, no cookies.</li>
<li>Service homepage: https://flagcdn.com</li>
</ul>
If you do not wish to transmit any data to ZeroBot, simply do not activate a license — the 
plugin stays dormant.
<h3>Privacy</h3>
This plugin does not store visitor personal data in your WordPress database beyond IP 
addresses in the local threat-log table (<code>wp_zb_threats</code>, dropped on uninstall). It does 
not set any cookies on visitors. Data sent to the ZeroBot service is described in the 
External Services section above.

ZeroBot Security

Full-stack antibot, firewall, captcha, and threat intelligence for WordPress — powered by the ZeroBot platform.

Good Question vs ZeroBot Security