Team beta version

<p><strong>Note: This plugin requires HTTPS to function (due to Web Crypto API usage).</strong></p>
<p><strong>The Story: The Forging of the Ultimate Defense</strong></p>
<p>This project began with a simple goal: to create a lightweight honeypot trap to catch basic bots. But during development, we faced a harsh reality: <strong>Simple traps are obsolete.</strong> Modern AI bots and headless browsers can easily step over traditional defenses. A basic trap was no longer enough; we needed a fortress.</p>
<p>So, we forged a completely new architecture. We added Proof of Work, Behavioral Analysis, and Rate Limiting. What started as a simple honeypot evolved into a <strong>15-layer invisible firewall</strong>. Like a samurai’s blade, it operates with absolute precision—completely invisible to your real customers, yet ruthlessly executing a “Silent Kill” on spam bots before they ever reach your inbox or database.</p>
<p>Samurai Honeypot protects every Contact Form 7 and WPForms form with fifteen independent defense layers.<br />
Each layer contributes a score, and blocked submissions are handled by a <strong>3-Tier Triage System</strong>:</p>
<h4>3-Tier Triage System</h4>
<ul>
<li><strong>Tier 1 (Pass):</strong> Score below the threshold (default 50) — email is sent normally.</li>
<li><strong>Tier 2 (Quarantine):</strong> Score between the threshold and 99 — email is silently suppressed (Silent Kill) and the submission is saved to the built-in <strong>Quarantine Log</strong> for admin review.</li>
<li><strong>Tier 3 (Drop / Instant Kill):</strong> Score of 100 or higher — email is silently suppressed and the submission is <strong>permanently dropped without logging</strong>. This protects your database from bloat during DDoS or mass bot attacks.</li>
</ul>
<p><strong>Warning — False Positives:</strong> Depending on your environment, legitimate emails may occasionally be flagged as spam. Enterprise proxies, strict corporate firewalls, outdated browsers, VPNs, and unusual network configurations can trigger detection layers. <strong>You MUST check the Quarantine Log periodically</strong> to identify and recover any false positives. The plugin cannot distinguish all edge cases automatically.</p>
<h4>Defense Layers</h4>
<ol>
<li><strong>JS Injection Gate</strong> — Blocks bots that cannot execute JavaScript. Tokens are fetched via REST API for full page-cache compatibility.</li>
<li><strong>Polymorphic Honeypot</strong> — Decoy field name is cryptographically derived per token (not exposed in the API response), hidden from humans via CSS.</li>
<li><strong>Token Signature</strong> — HMAC-SHA256 signed stateless token with IP and Form ID binding.</li>
<li><strong>Time Trap</strong> — Detects impossibly fast submissions. Browser autofill is automatically exempt.</li>
<li><strong>Proof of Work</strong> — SHA-256 computational challenge via Web Crypto API that forces CPU cost on bots.</li>
<li><strong>Behavioral Entropy</strong> — Hash-verified human-like event counters: mouse, keyboard, touch, scroll. Uniqueness tracking detects script reuse.</li>
<li><strong>Headless UA Block</strong> — Server-side User-Agent check instantly blocks known headless browsers and automated tools (Headless Chrome, Puppeteer, PhantomJS, Selenium, Playwright, Nightmare, Electron). Toggleable in settings for E2E testing compatibility.</li>
<li><strong>Headless Detection</strong> — Detects automated browser environments (navigator.webdriver, plugin count, window.chrome, language count).</li>
<li><strong>UA Age Detection</strong> — Scores based on Chrome version age. 2+ years: +10, 3+ years: +20, 4+ years: +30. Bots often use hardcoded old User-Agent strings that never update.</li>
<li><strong>Rate Limiting</strong> — Per-IP submission rate limiting with IPv6 /64 normalization.</li>
<li><strong>Replay Protection</strong> — Atomic token consumption (INSERT IGNORE) + TTL expiry enforcement.</li>
<li><strong>IP Blacklist</strong> — Manually configured IP/CIDR blacklist for known bad actors.</li>
<li><strong>Content: URL Limit</strong> — Flags messages containing more URLs than the configured threshold.</li>
<li><strong>Content: BBCode</strong> — Detects BBCode link syntax (<code>[url=...]</code>) that never appears in legitimate form submissions.</li>
<li><strong>Content: Denylist</strong> — Matches against WordPress Disallowed Comment Keys (Settings > Discussion).</li>
</ol>
<h4>Key Features</h4>
<ul>
<li><strong>3-Tier Triage</strong> — Pass, Quarantine (with local log), or Drop. No legitimate message is lost without a trace — quarantined submissions are saved for admin review.</li>
<li><strong>Built-in Quarantine Log</strong> — Blocked Tier 2 submissions are saved to a local database table (up to 1,000 entries, FIFO). View date, score, trigger reasons, and full form data from the admin panel. No external plugin required.</li>
<li><strong>DDoS-Resilient Tier 3 Drop</strong> — Submissions scoring 100+ are immediately dropped from memory without any database write. This prevents database exhaustion during mass bot attacks.</li>
<li><strong>GDPR Compliant</strong> — No cookies, no external service calls, no plugin-specific PII stored. IP addresses are one-way hashed with a site-specific salt before any storage — raw IPs never touch the database. No consent banner required.</li>
<li><strong>Stateless Tokens</strong> — No database writes for token generation; prevents DoS via DB bloat.</li>
<li><strong>Zero Trust Client</strong> — All client-submitted data is verified server-side with HMAC signatures and hash integrity checks.</li>
<li><strong>Zero Configuration</strong> — Activate and all Contact Form 7 / WPForms forms are protected automatically.</li>
<li><strong>Cache Compatible</strong> — Tokens are fetched via REST API, so page caching works fine.</li>
<li><strong>Multiple Forms</strong> — Works correctly with multiple forms on the same page.</li>
<li><strong>IP Whitelist / Blacklist</strong> — Whitelist trusted IPs or CIDR ranges to skip all scoring. Blacklist known bad IPs to add +100 score instantly. Optionally whitelist all logged-in WordPress users.</li>
<li><strong>Headless Browser Blocking</strong> — Server-side User-Agent check instantly blocks Headless Chrome, Puppeteer, Selenium, and other automated browsers (+100 score). Enabled by default; can be toggled off for E2E testing.</li>
<li><strong>Content Rules</strong> — Detect spam patterns in form content: excessive URLs, BBCode link syntax, and WordPress Disallowed Comment Keys matching.</li>
<li><strong>Trusted Proxy Support</strong> — Optional mode for Cloudflare and reverse proxy environments with IP range validation.</li>
<li><strong>Lightweight</strong> — Three PHP files, no external dependencies, no jQuery.</li>
</ul>


Samurai Honeypot for Forms

Invisible 15-layer anti-spam for Contact Form 7 & WPForms. Score-based 3-Tier Triage silently blocks bots — no CAPTCHA, no user friction.

yonifre

WpMaspik

<p>Maspik is an advanced WordPress anti-spam plugin that blocks bots, fake leads, and unwanted submissions across your entire site — without hurting real users.</p>
<p>Trusted by thousands of websites worldwide. Works automatically on activation.</p>
<p>👉 Works with all major form plugins. No CAPTCHA. No coding. Immediate results.</p>
<h3>Why block spam with Maspik?</h3>
<ul>
<li>🚀 <strong>Instant protection</strong> – Works as soon as you activate the plugin.</li>
<li>🎯 <strong>High success rate</strong> – Better protection than traditional CAPTCHA.</li>
<li>🔍 <strong>Smart detection</strong> – Identifies spam patterns automatically with advanced rules and optional AI spam detection.</li>
<li>🌐 <strong>Wide compatibility</strong> – Supports all major form plugins and WordPress core forms (comments, registration).</li>
<li>🛠️ <strong>Fully customizable</strong> – Blacklists, IP blocking, character limits, link limits, countries, languages, and more.</li>
<li>👥 <strong>Spam Block Guarantee</strong> – We are committed to helping you block spam. See the <a href="#-spam-block-guarantee---for-all-users" rel="nofollow ugc">Spam Block Guarantee</a> section.</li>
</ul>
<h3>Key Features</h3>
<p>✅ Works instantly with popular form plugins and core WordPress forms<br />
✅ No CAPTCHA required – silent protection for your visitors<br />
✅ Forbidden keywords list system (Blacklist/Blocklist) – block any word, phrase, or pattern you want per field type<br />
✅ IP blacklist & API integrations<br />
✅ Phone number validation<br />
✅ Multiple honeypot methods and advanced key checks<br />
✅ Multi-language support<br />
✅ Maspik Matrix – Cloud-based Multi-layer spam protection engine</p>
<h3>Detailed Features – Advanced Spam Protection & Filtering</h3>
<h3>Maspik Matrix – Advanced Multi-Layer Spam Protection</h3>
<p>Maspik Matrix is a powerful layered spam filter that combines multiple detection methods into one unified protection system.</p>
<p>This engine performs several checks in parallel to increase accuracy and reduce false positives, including:</p>
<ul>
<li>IP reputation and risk scoring  </li>
<li>Pattern matching and keyword analysis  </li>
<li>Heuristic behavior checks  </li>
<li>Structural and content-based evaluation  </li>
<li>AI Spam Check scoring mechanisms  </li>
<li>Learn from spam submissions and improve over time</li>
</ul>
<p>Maspik Matrix provides stronger, faster, and more reliable spam detection by evaluating each submission through multiple layers of protection simultaneously.</p>
<p>Maspik includes <strong>100 free Matrix checks</strong> so you can start protecting forms immediately.<br />
<strong>Pro users get unlimited Matrix checks</strong>.</p>
<p>Note – Local checks are not counted towards the monthly limit, only API calls are counted.</p>
<h3>Blacklisting by Field Type</h3>
<ul>
<li><strong>Text fields/Text area fields</strong> (e.g. name, subject, message)</li>
<li><strong>Email fields</strong> (supports regex/wildcard patterns)</li>
<li><strong>URL fields</strong></li>
<li><strong>Phone number fields</strong> (regex/wildcard support)</li>
</ul>
<h3>Blocking Capabilities</h3>
<ul>
<li>Specific IP addresses</li>
<li>Spam submissions in:
<ul>
<li>WordPress comments</li>
<li>WordPress registration forms</li>
<li>Contact forms from supported plugins (see list below)</li>
</ul>
</li>
<li>Option to block submissions containing emojis in textarea fields</li>
<li>Blocking bot-generated submissions</li>
<li>Advanced key checks to detect automated submissions</li>
</ul>
<h3>Advanced Blocking</h3>
<ul>
<li>Honeypot fields (multiple strategies)</li>
<li>IP verification (100 checks/month in free version)</li>
<li>Advanced key check engine</li>
</ul>
<h3>Character Control</h3>
<ul>
<li>Maximum characters in text fields</li>
<li>Maximum characters in textarea fields</li>
</ul>
<h3>Link Limitation</h3>
<ul>
<li>Limit the number of links allowed in textarea fields (for example, 0–1 links)</li>
</ul>
<h3>API Integrations</h3>
<ul>
<li><strong>Proxycheck.io</strong> – Check IP addresses against proxy/VPN/TOR</li>
<li><strong>AbuseIPDB.com</strong> – Check IP addresses against abuse/spam/malicious/proxy/VPN/TOR</li>
<li><strong>Numverify.com</strong> – Validate phone numbers to block spam phone numbers</li>
</ul>
<h3>Spam Log</h3>
<ul>
<li>Review blocked submissions</li>
<li>Understand why and how spam was blocked</li>
<li>Use logs to fine-tune your spam protection</li>
</ul>
<h3>Detailed Statistics</h3>
<ul>
<li>Track how many spam submissions were blocked</li>
<li>Analyze patterns</li>
<li>Monitor protection over time</li>
<li>Advanced spam statistics dashboard in the admin</li>
</ul>
<h3>Supported Forms</h3>
<p>Maspik integrates seamlessly with a wide range of popular form plugins and WordPress core forms:</p>
<ul>
<li>Elementor Forms</li>
<li>Elementor Atomic Forms</li>
<li>Contact Form 7</li>
<li>Hello Plus</li>
<li>Ninja Forms</li>
<li>Everest Forms</li>
<li>Formidable Forms</li>
<li>JetFormBuilder</li>
<li>Forminator Forms</li>
<li>Fluent Forms</li>
<li>Bricks Builder Forms</li>
<li>Breakdance Builder Forms</li>
<li>Divi Contact Form (Divi theme or Divi Builder plugin)</li>
<li>BuddyPress</li>
<li>Bitforms</li>
<li>Metform</li>
<li>WordPress comments</li>
<li>WordPress registration form</li>
<li>Custom PHP forms</li>
<li>WPForms*  </li>
<li>Gravity Forms*  </li>
<li>WooCommerce registration form*  </li>
<li>WooCommerce review*</li>
<li>WooCommerce checkout*</li>
</ul>
<p>(*) Pro license required.</p>
<h3>Pro Version Features 🌟</h3>
<p>Upgrade to Maspik Pro to unlock powerful additional features:</p>
<ul>
<li>⭐ Maspik Matrix – Unlimited checks</li>
<li>⭐ Custom spam dashboard for multiple sites – manage all spam settings from one place</li>
<li>⭐ Country-based filtering – block spam by country or allow only specific countries</li>
<li>⭐ Language-based filtering – block spam by language or allow only specific languages</li>
<li>⭐ Settings import/export</li>
<li>⭐ Premium support</li>
</ul>
<p>Learn more and get Maspik Pro at:<br />
https://wpmaspik.com/?readme-file</p>
<h3>Important Note</h3>
<p>Be cautious when selecting words to blacklist, as every website has different needs.<br />
For example, if you are a digital marketing agency and blacklist the word “SEO”, you may lose some valid leads.</p>
<p>The plugin is provided “as is” and the user assumes full responsibility for configuring and using it appropriately for their specific needs.</p>
<p>Maspik is GDPR compliant.</p>
<h3>Support & Community</h3>
<ul>
<li>🚀 <a href="https://wpmaspik.com/documentation/getting-started/?readme-file" rel="nofollow ugc">Get Started guide</a></li>
<li>📚 <a href="https://wpmaspik.com/documentation/?readme-file" rel="nofollow ugc">Documentation</a></li>
<li>💬 <a href="https://www.facebook.com/groups/maspik" rel="nofollow ugc">Community Forum</a></li>
<li>🐛 <a href="https://wpmaspik.com/#support?readme-file" rel="nofollow ugc">Report Issues</a></li>
<li>💡 <a href="https://wpmaspik.com/#support?readme-file" rel="nofollow ugc">Feature Requests</a></li>
<li>💰 <a href="https://wpmaspik.com/get-maspik-pro-for-free-share-your-expertise/?readme-file" rel="nofollow ugc">Receive Maspik Pro for free</a></li>
<li>💖 <a href="https://wordpress.org/support/plugin/contact-forms-anti-spam/reviews/#new-post" rel="ugc">Support us with a 5-star review</a></li>
<li>✨ <a href="https://wpmaspik.com/?readme-file" rel="nofollow ugc">WP Maspik Website</a></li>
</ul>
<h3>🛡️ Spam Block Guarantee – for all users</h3>
<p>We stand behind our protection. If spam is still getting through your forms, our team is here to help and guide you to block it.</p>
<h3>Getting Help is Easy</h3>
<ol>
<li>Join our <a href="https://www.facebook.com/groups/maspik" rel="nofollow ugc">Community Forum</a></li>
<li>Create a new post with:
<ul>
<li>Your website URL and form page URL (optional)</li>
<li>Description of the spam you are receiving</li>
<li>Screenshot or text of sample spam submissions</li>
<li>Your Maspik version</li>
<li>Screenshot or export of your current Maspik settings</li>
</ul>
</li>
</ol>
<p>Our team will guide you step-by-step to block the spam effectively.</p>


Maspik – Ultimate Spam Protection


Easily the best solution for fighting spam. Their support is top notch as well.


Excellent solution

No more fake leads or unwanted submissions — Maspik blocks spam instantly across all forms without using CAPTCHA.

Samurai Honeypot for Forms vs Maspik – Ultimate Spam Protection