solverwp

SolverGuard Spam Shield is the only free WordPress plugin that protects every entry point of your site — contact forms, comment sections, user registrations, login page, REST API, XML-RPC, and your server itself — with zero shortcodes and zero per-form configuration required.
While most anti-spam plugins protect only one area of your site, SolverGuard deploys 30+ independent protection layers across six major modules. Install it, activate it, and your entire WordPress site is defended immediately.
<blockquote>
“Set it and forget it” protection — works automatically from the moment you activate.”
</blockquote>
<h4>🛡️ MODULE 1: Contact Form 7 Protection</h4>
Six independent spam-fighting layers apply automatically to every CF7 form on your site — no per-form setup needed.
<ul>
<li>🍯 Honeypot — An invisible hidden field is silently injected into every form. Real users never see it or fill it in. Bots that auto-fill every field get caught instantly and blocked.</li>
<li>⏱ Time-Based Check — Bots submit forms in milliseconds; humans take a few seconds to read and fill out a form. This module blocks submissions that arrive suspiciously fast (bots) or from stale, expired sessions, eliminating both automated attacks and session replay attacks.</li>
<li>🚫 IP Blocker — Block individual IP addresses or entire CIDR network ranges (e.g. <code>10.0.0.0/8</code>) from submitting any form on your site. The same block list is automatically shared with comments, login, and registration protection for maximum coverage.</li>
<li>🔤 Keyword Filter — Case-insensitive keyword and phrase matching scans every submitted form field simultaneously. Block spam phrases, competitor names, casino/pharma keywords, or any custom list of prohibited terms.</li>
<li>📈 Rate Limiter — Caps the number of form submissions per IP address within a configurable sliding time window. Stops bots that submit the same form hundreds of times per hour, without ever impacting real users.</li>
<li>🤖 Google reCAPTCHA v3 — Silent, frictionless bot scoring via Google’s reCAPTCHA v3. No annoying checkboxes or image puzzles for real visitors — the score is calculated invisibly in the background and submissions below your threshold are blocked automatically.</li>
</ul>
<h4>💬 MODULE 2: Comment Spam Protection</h4>
Ten layers of dedicated comment spam protection, covering every submission path including Gutenberg and headless REST API setups.
<ul>
<li>🍯 Comment Honeypot — A hidden anti-spam field is injected into every WordPress comment form automatically.</li>
<li>⏱ Comment Time Check — Blocks comments submitted too quickly after page load (bots) or from sessions that expired too long ago.</li>
<li>🚫 IP Blocking — Automatically reuses the shared IP block list — block an IP once, block it everywhere.</li>
<li>📈 Comment Rate Limiter — Separate per-IP rate limiting specifically for comments, independent of form rate limiting.</li>
<li>🔤 Comment Keywords — A global keyword list plus comment-specific blocked phrases. Stop spam before it reaches your moderation queue.</li>
<li>🔗 Link Count Limit — Block comments containing more than a configurable number of hyperlinks — the #1 hallmark of spam comments.</li>
<li>📧 Email Domain Blocking — Block registrations and comments from disposable or known spam email domains. Enter a list of blocked domains and all matching email addresses are automatically rejected.</li>
<li>🤖 User-Agent Filtering — Block comments from known spam bot user-agents. Optionally block requests with no user-agent header at all.</li>
<li>⏳ Hold Comments With Author URL — Automatically sends comments from authors with a URL in their display name to moderation, rather than publishing them instantly.</li>
<li>🌐 REST API Protection — All comment spam checks also apply to submissions made via the WordPress REST API (used by Gutenberg and headless/decoupled WordPress setups).</li>
</ul>
<h4>🔐 MODULE 3: Login & Brute-Force Protection</h4>
Stop hackers from guessing your password with automated brute-force attacks.
<ul>
<li>🔒 Login Rate Limiting — After a configurable number of failed login attempts from the same IP, further attempts are blocked for a configurable lockout period. Stops dictionary attacks and credential-stuffing bots cold.</li>
<li>⏱ Configurable Lockout — Set exactly how many failed attempts trigger a lockout, and how many minutes the lockout lasts. Default: 5 attempts, 15-minute lockout.</li>
<li>📋 Full Audit Logging — Every blocked login attempt is logged with the IP address, timestamp, and the reason for the block, so you can see exactly what threats your site faces.</li>
</ul>
<h4>👤 MODULE 4: Registration Spam Protection</h4>
Block fake accounts and spam bot registrations before they are ever created in your database.
<ul>
<li>🍯 Registration Honeypot — A hidden field traps bots that auto-fill every registration field.</li>
<li>⏱ Registration Time Check — Blocks registrations submitted impossibly fast or from expired form sessions.</li>
<li>📧 Email Domain Blocking — Block registrations from specific disposable email domains. Subdomain matching included — blocking <code>spammail.com</code> also blocks <code>user@sub.spammail.com</code>.</li>
<li>🔤 Username & Email Keyword Filter — Blocks registrations with prohibited words in the username or email address.</li>
<li>📈 Registration Rate Limiter — Limits the number of registration attempts per IP in a configurable period.</li>
<li>🌐 REST API & XML-RPC Coverage — Protection applies to ALL registration paths: the standard form, the WordPress REST API, and direct <code>wp_insert_user()</code> calls. Fake accounts are blocked before they are ever written to the database, which also prevents WordPress from sending notification emails for blocked registrations.</li>
</ul>
<h4>🤖 MODULE 5: Advanced Bot Protection</h4>
A dedicated bot-detection engine that runs before WordPress even fully loads — blocking malicious traffic at the earliest possible moment.
<ul>
<li>🕵️ Known Bad Bot Blacklist — 30+ built-in user-agent signatures covering scrapers (AhrefsBot, SemrushBot, MJ12bot), vulnerability scanners (Nikto, sqlmap, WPScan, Acunetix, Nessus), DDoS tools (Slowloris, LOIC), AI crawlers, and spam bots. Fully customizable with your own additional signatures.</li>
<li>🚫 Empty User-Agent Blocking — Blocks all requests with no User-Agent header — a near-universal sign of automated attack traffic.</li>
<li>🔍 Fake Googlebot / Bingbot Detection — Real Googlebots come from specific Google-owned IP ranges with verifiable reverse DNS. This module performs a live reverse DNS lookup to verify any request claiming to be Googlebot or Bingbot, and blocks fakes that don’t pass verification. Protects your server resources from being wasted on impersonators.</li>
<li>⚠️ Suspicious URL Pattern Blocking — Blocks probes for sensitive files and attack patterns including:
<ul>
<li><code>/wp-config.php</code>, <code>/.env</code>, <code>/.git/</code>, <code>/.htaccess</code> access attempts</li>
<li>Web shell uploads (<code>shell.php</code>, <code>c99.php</code>, <code>r57.php</code>)</li>
<li>Directory traversal attacks (<code>../../</code>)</li>
<li>SQL injection in URLs (<code>UNION SELECT</code>, <code>DROP TABLE</code>)</li>
<li>XML/XXE injection attempts</li>
<li>phpMyAdmin and database tool probes</li>
<li>WordPress scanner paths (<code>/wp-content/uploads/*.php</code>)</li>
</ul>
</li>
<li>🌊 Request Flood Protection — Sitewide per-IP rate limiting that blocks any IP sending excessive requests within a configurable time window. Stops DDoS and scraping attacks that would otherwise overload your server.</li>
<li>🔒 HTTP Method Filter — Blocks unnecessary and dangerous HTTP methods such as TRACE and CONNECT that are used by certain attack tools.</li>
<li>🛡️ Security Headers — Automatically adds five HTTP security headers to every response:
<ul>
<li><code>X-Content-Type-Options: nosniff</code></li>
<li><code>X-Frame-Options: SAMEORIGIN</code></li>
<li><code>X-XSS-Protection: 1; mode=block</code></li>
<li><code>Referrer-Policy: strict-origin-when-cross-origin</code></li>
<li><code>Permissions-Policy: geolocation=(), microphone=(), camera=()</code></li>
</ul>
</li>
<li>🎭 Hide WordPress Version — Removes the WordPress version number from page source, RSS feeds, script/style URLs, and HTTP headers — making version-specific exploit scanning much harder.</li>
<li>👤 Block Author Enumeration — Blocks the <code>?author=1</code> URL trick that attackers use to discover your WordPress usernames before launching targeted brute-force attacks.</li>
<li>✏️ Custom Bot Signatures & URL Patterns — Add your own custom bot user-agent signatures and URL regex patterns directly from the admin panel.</li>
</ul>
<h4>⚙️ MODULE 6: General WordPress-Wide Protection</h4>
Site-wide hardening that protects your WordPress installation at the infrastructure level.
<ul>
<li>📡 XML-RPC Protection — Fully disable XML-RPC (a common DDoS amplification vector), or choose the surgical option: disable only the pingback methods while leaving the rest of XML-RPC available for legitimate use (e.g. mobile apps).</li>
<li>🔗 REST API Rate Limiting — Rate-limit unauthenticated REST API requests per IP to prevent API abuse by bots and scrapers.</li>
<li>🚫 REST API User Enumeration Block — Automatically blocks unauthenticated access to the <code>/wp/v2/users</code> REST endpoint, which attackers use to harvest all WordPress usernames on your site.</li>
<li>🏓 Trackback & Pingback Spam Blocking — Block all incoming trackback and pingback requests sitewide. Also removes the <code>X-Pingback</code> HTTP header and the pingback URL from your blog info to hide the endpoint from probes.</li>
<li>🔗 Comment Author URL Hold — Automatically sends any comment to moderation when the author’s display name contains a URL — a common spam technique.</li>
</ul>
<h4>📊 Spam Log & Reporting</h4>
<ul>
<li>Full Audit Log — Every blocked request is logged with the IP address, user-agent, submission data, block reason, and timestamp. Available under Anti-Spam Protection → Spam Log.</li>
<li>Filter by Module — Quickly find blocked entries by protection module (honeypot, rate limiter, bot protection, login, registration, etc.).</li>
<li>Automatic Log Cleanup — Set a log retention period in days and old entries are automatically purged. Keep your database clean without manual work.</li>
<li>One-Click Log Clear — Clear all log entries instantly from the admin panel.</li>
</ul>
<h4>✅ Why Choose SolverGuard Spam Shield?</h4>
 Feature 
 SolverGuard 
 Typical Free Plugin
 CF7 Form Protection 
 ✅ 6 layers 
 ✅ 1-2 layers
 Comment Spam Protection 
 ✅ 10 layers 
 ✅ Basic
 Login Brute-Force Protection 
 ✅ Yes 
 ❌ No
 Registration Spam Protection 
 ✅ Yes 
 ❌ No
 Advanced Bot Protection 
 ✅ 10+ checks 
 ❌ No
 XML-RPC & REST API Hardening 
 ✅ Yes 
 ❌ No
 Security Headers 
 ✅ Yes 
 ❌ No
 Hide WordPress Version 
 ✅ Yes 
 ❌ No
 Author Enumeration Block 
 ✅ Yes 
 ❌ No
 Spam Log with Auto-Cleanup 
 ✅ Yes 
 ❌ No
 Zero Configuration Required 
 ✅ Works instantly 
 ⚠️ Often requires setup
 100% Free 
 ✅ Yes 
 ✅ Yes
<h4>Works Automatically — Zero Configuration Required</h4>
All protection layers activate automatically the moment you install and activate the plugin. No shortcodes to add, no per-form configuration, no template edits. Every module can be individually toggled on or off, and all settings are accessible from a single admin page under Anti-Spam Protection → Settings.
<h3>External Services</h3>
This plugin optionally integrates with Google reCAPTCHA v3 for silent spam scoring on Contact Form 7 submissions. This feature is disabled by default and must be explicitly enabled by the site administrator by entering their own reCAPTCHA site and secret keys.
What data is sent and when? 
When reCAPTCHA is enabled, the visitor’s reCAPTCHA response token and IP address are sent to Google’s servers at the time of a form submission.
No data is sent to Google if the reCAPTCHA module is disabled.
<ul>
<li>Service: Google reCAPTCHA v3</li>
<li>Provider: Google LLC</li>
<li>Terms of Service: https://policies.google.com/terms</li>
<li>Privacy Policy: https://policies.google.com/privacy</li>
</ul>
No other data is sent to any external service. All spam detection is performed locally on your own server.

SolverGuard Spam Shield — Anti-Spam, Bot & Login Protection

The most complete free WordPress anti-spam plugin. Protects Contact Form 7, comments, login, registration, REST API, and XML-RPC — all in one shield.

trustsig

TrustSig Security protects WordPress forms and API endpoints from scripted bots and brute-force attacks. No puzzles. No “I am not a robot” checkboxes. No third-party signup required to start. Coverage depends on the protection mode you choose — see “Protection modes” below.
<a href="https://ps.w.org/trustsig-security/assets/screenshot-1.png" rel="nofollow ugc"></a> 
<a href="https://ps.w.org/trustsig-security/assets/screenshot-2.png" rel="nofollow ugc"></a> 
<a href="https://ps.w.org/trustsig-security/assets/screenshot-3.png" rel="nofollow ugc"></a>
<h4>Why TrustSig</h4>
<ul>
<li>Protects every important form out of the box — login, registration, comments, password reset, WooCommerce checkout, BuddyPress signup, Easy Digital Downloads, Elementor Pro forms, WPForms (including the Mesmerize / Materialis contact form), Contact Form 7, SureForms, and any custom form via shortcode.</li>
<li>Stops brute-force login attempts with built-in lockout after repeated failures.</li>
<li>Invisible to humans — real visitors are verified in under a second by a non-interactive browser check. No CAPTCHA, no images to click.</li>
<li>Three protection modes — Monitor (log only), Challenge (default, soft block with auto-retry), Enforce (hard block).</li>
<li>Zero configuration — activate the plugin and protection is live immediately. Anonymous free tier needs no account.</li>
<li>Works with caching plugins, WPML, multisite and most themes — forms are signed server-side with a per-site secret.</li>
<li>Developer-friendly — PHP helper <code>trustsig_verify()</code>, REST endpoint <code>/wp-json/trustsig/v1/verify</code>, filters and actions for custom forms.</li>
<li>Optional admin-ajax and REST API guard for advanced sites.</li>
<li>GPLv2 — fully open source.</li>
</ul>
<h4>How it works</h4>
TrustSig injects a lightweight browser SDK, signs every rendered form with a per-site secret, and verifies submissions against the TrustSig Edge service. Real visitors pass an invisible check in about a second; scripted clients that never run JavaScript are stopped.
When a request arrives without a valid token, TrustSig does not silently fail 
open. Depending on the mode you choose it serves a lightweight “please wait” 
interstitial that re-verifies the browser and then transparently continues the 
original request — or blocks it.
The plugin works out of the box with no account and no API keys (anonymous 
free tier). Connecting a TrustSig dashboard account is optional and only adds 
analytics and higher limits.
<h4>Protection modes</h4>
<ul>
<li>Monitor — verify and log only, never block. Used for safe rollout; the 
upgrade path also pins existing sites here so behaviour never changes 
silently on update.</li>
<li>Challenge (default for new installs) — a missing or invalid token shows 
the interstitial, then continues or blocks.</li>
<li>Enforce — a missing or invalid token is blocked immediately.</li>
</ul>
<h4>What it protects</h4>
Browser forms are protected automatically with no code:
<ul>
<li>WordPress core — login, registration, comments, lost/reset password</li>
<li>WooCommerce — login, registration, checkout, pay order, lost password</li>
<li>BuddyPress — registration</li>
<li>Easy Digital Downloads — login, registration</li>
<li>Elementor Pro forms</li>
<li>WPForms — contact and other forms, on by default (covers the Mesmerize / Materialis contact section)</li>
<li>Contact Form 7 — feedback submissions, on by default (guarded on the REST endpoint CF7 submits to)</li>
<li>SureForms — form submissions, on by default (guarded on the REST submit-form endpoint)</li>
<li>Any other form (site-wide “protect all forms” option, the <code>[trustsig_form]</code> 
shortcode, or a hidden <code>trustsig-response</code> input)</li>
</ul>
It also includes optional brute-force lockout for repeated failed logins, an 
opt-in admin-ajax / REST API guard, and a developer verification API.
<h4>For developers</h4>
<ul>
<li>PHP: <code>trustsig_verify( array( 'token' => $t, 'action' => 'my_form' ) )</code> 
returns <code>pass</code> | <code>fail</code> | <code>challenge</code>. Filters: <code>trustsig_pre_verify</code>, 
 trustsig_result. Action: <code>trustsig_blocked</code>.</li>
<li>REST: <code>POST /wp-json/trustsig/v1/verify</code> with <code>{ "token": "..." }</code>.</li>
</ul>
<h4>Known limitations</h4>
<ul>
<li>XML-RPC (<code>xmlrpc.php</code>) is intentionally out of scope and is not verified. 
Disable XML-RPC separately if it is unused on your site.</li>
<li>admin-ajax and the REST API are only protected when explicitly enabled in 
Settings, to avoid breaking third-party integrations.</li>
<li>File-upload and AJAX submissions cannot show the interstitial; under 
Challenge or Enforce mode a missing token on those is blocked, never 
silently allowed.</li>
</ul>
<h3>External services</h3>
This plugin relies on the TrustSig Edge service to decide whether a request 
comes from a human or an automated client. This bot-detection verdict cannot be 
produced locally, so the service is required for the plugin’s core 
functionality.
Service provider: TrustSig — https://trustsig.eu
Remote script loaded in the browser: 
 https://edge.trustsig.eu/trustsig.js is loaded on pages that contain a 
protected form, on the login screen, and on the verification interstitial. The 
script runs the non-interactive browser check and produces a verification 
token.
Data sent from the visitor’s browser / your server to 
 https://edge.trustsig.eu/verify:
<ul>
<li>the TrustSig verification token generated by the SDK in the visitor’s browser;</li>
<li>your site’s host name (e.g. <code>example.com</code>) on the anonymous free tier, or, if 
you connect a dashboard account, the secret key you entered;</li>
<li>as part of any HTTPS request, the visitor’s IP address and standard request 
metadata (such as the user-agent) are visible to the service.</li>
</ul>
When data is sent: when the SDK loads on a protected page, when a protected 
form is submitted, and once per browser when the optional verified-session 
cookie is bootstrapped.
Data stored locally on your site: TrustSig writes a verification log to 
your own WordPress database (custom tables) that includes visitor IP addresses, 
the action attempted, and the verdict. This data is not sent to TrustSig; you 
can clear it at any time from Settings → TrustSig → Tools.
By installing and activating this plugin you (the site administrator) consent to 
this data being sent to TrustSig so that requests can be verified. Inform your 
own site’s visitors as required by your local privacy obligations.
<ul>
<li>Terms of Service: https://trustsig.eu/terms-of-service/</li>
<li>Privacy Policy: https://trustsig.eu/privacy</li>
</ul>

TrustSig Security


Deployment was easy, I am not tech savy but was able to get it running in less than a minute. I always had constant email spam from my site, after installing TrustSig it dropped to zero. 10/10


Easy setup and spam stopped

Stop bots, spam and brute-force attacks on every WordPress form. No CAPTCHA. No account. No keys. Installs and protects in one click.

SolverGuard Spam Shield — Anti-Spam, Bot & Login Protection vs TrustSig Security