trustsig

<p><strong>TrustSig Security protects WordPress forms and API endpoints from scripted bots and brute-force attacks.</strong> No puzzles. No “I am not a robot” checkboxes. No third-party signup required to start. Coverage depends on the protection mode you choose — see “Protection modes” below.</p>
<p><a href="https://ps.w.org/trustsig-security/assets/screenshot-1.png" rel="nofollow ugc"></a><br />
<a href="https://ps.w.org/trustsig-security/assets/screenshot-2.png" rel="nofollow ugc"></a><br />
<a href="https://ps.w.org/trustsig-security/assets/screenshot-3.png" rel="nofollow ugc"></a></p>
<h4>Why TrustSig</h4>
<ul>
<li><strong>Protects every important form out of the box</strong> — login, registration, comments, password reset, WooCommerce checkout, BuddyPress signup, Easy Digital Downloads, Elementor Pro forms, WPForms (including the Mesmerize / Materialis contact form), Contact Form 7, SureForms, and any custom form via shortcode.</li>
<li><strong>Stops brute-force login attempts</strong> with built-in lockout after repeated failures.</li>
<li><strong>Invisible to humans</strong> — real visitors are verified in under a second by a non-interactive browser check. No CAPTCHA, no images to click.</li>
<li><strong>Three protection modes</strong> — Monitor (log only), Challenge (default, soft block with auto-retry), Enforce (hard block).</li>
<li><strong>Zero configuration</strong> — activate the plugin and protection is live immediately. Anonymous free tier needs no account.</li>
<li><strong>Works with caching plugins, WPML, multisite and most themes</strong> — forms are signed server-side with a per-site secret.</li>
<li><strong>Developer-friendly</strong> — PHP helper <code>trustsig_verify()</code>, REST endpoint <code>/wp-json/trustsig/v1/verify</code>, filters and actions for custom forms.</li>
<li><strong>Optional admin-ajax and REST API guard</strong> for advanced sites.</li>
<li><strong>GPLv2</strong> — fully open source.</li>
</ul>
<h4>How it works</h4>
<p>TrustSig injects a lightweight browser SDK, signs every rendered form with a per-site secret, and verifies submissions against the TrustSig Edge service. Real visitors pass an invisible check in about a second; scripted clients that never run JavaScript are stopped.</p>
<p>When a request arrives without a valid token, TrustSig does not silently fail<br />
open. Depending on the mode you choose it serves a lightweight “please wait”<br />
interstitial that re-verifies the browser and then transparently continues the<br />
original request — or blocks it.</p>
<p>The plugin works out of the box with <strong>no account and no API keys</strong> (anonymous<br />
free tier). Connecting a TrustSig dashboard account is optional and only adds<br />
analytics and higher limits.</p>
<h4>Protection modes</h4>
<ul>
<li><strong>Monitor</strong> — verify and log only, never block. Used for safe rollout; the<br />
upgrade path also pins existing sites here so behaviour never changes<br />
silently on update.</li>
<li><strong>Challenge</strong> (default for new installs) — a missing or invalid token shows<br />
the interstitial, then continues or blocks.</li>
<li><strong>Enforce</strong> — a missing or invalid token is blocked immediately.</li>
</ul>
<h4>What it protects</h4>
<p>Browser forms are protected automatically with no code:</p>
<ul>
<li>WordPress core — login, registration, comments, lost/reset password</li>
<li>WooCommerce — login, registration, checkout, pay order, lost password</li>
<li>BuddyPress — registration</li>
<li>Easy Digital Downloads — login, registration</li>
<li>Elementor Pro forms</li>
<li>WPForms — contact and other forms, on by default (covers the Mesmerize / Materialis contact section)</li>
<li>Contact Form 7 — feedback submissions, on by default (guarded on the REST endpoint CF7 submits to)</li>
<li>SureForms — form submissions, on by default (guarded on the REST submit-form endpoint)</li>
<li>Any other form (site-wide “protect all forms” option, the <code>[trustsig_form]</code><br />
shortcode, or a hidden <code>trustsig-response</code> input)</li>
</ul>
<p>It also includes optional brute-force lockout for repeated failed logins, an<br />
opt-in admin-ajax / REST API guard, and a developer verification API.</p>
<h4>For developers</h4>
<ul>
<li>PHP: <code>trustsig_verify( array( 'token' => $t, 'action' => 'my_form' ) )</code><br />
returns <code>pass</code> | <code>fail</code> | <code>challenge</code>. Filters: <code>trustsig_pre_verify</code>,<br />
  trustsig_result. Action: <code>trustsig_blocked</code>.</li>
<li>REST: <code>POST /wp-json/trustsig/v1/verify</code> with <code>{ "token": "..." }</code>.</li>
</ul>
<h4>Known limitations</h4>
<ul>
<li>XML-RPC (<code>xmlrpc.php</code>) is intentionally out of scope and is not verified.<br />
Disable XML-RPC separately if it is unused on your site.</li>
<li>admin-ajax and the REST API are only protected when explicitly enabled in<br />
Settings, to avoid breaking third-party integrations.</li>
<li>File-upload and AJAX submissions cannot show the interstitial; under<br />
Challenge or Enforce mode a missing token on those is blocked, never<br />
silently allowed.</li>
</ul>
<h3>External services</h3>
<p>This plugin relies on the <strong>TrustSig Edge</strong> service to decide whether a request<br />
comes from a human or an automated client. This bot-detection verdict cannot be<br />
produced locally, so the service is required for the plugin’s core<br />
functionality.</p>
<p><strong>Service provider:</strong> TrustSig — https://trustsig.eu</p>
<p><strong>Remote script loaded in the browser:</strong><br />
    https://edge.trustsig.eu/trustsig.js is loaded on pages that contain a<br />
protected form, on the login screen, and on the verification interstitial. The<br />
script runs the non-interactive browser check and produces a verification<br />
token.</p>
<p><strong>Data sent from the visitor’s browser / your server to<br />
    https://edge.trustsig.eu/verify:</strong></p>
<ul>
<li>the TrustSig verification token generated by the SDK in the visitor’s browser;</li>
<li>your site’s host name (e.g. <code>example.com</code>) on the anonymous free tier, or, if<br />
you connect a dashboard account, the secret key you entered;</li>
<li>as part of any HTTPS request, the visitor’s IP address and standard request<br />
metadata (such as the user-agent) are visible to the service.</li>
</ul>
<p><strong>When data is sent:</strong> when the SDK loads on a protected page, when a protected<br />
form is submitted, and once per browser when the optional verified-session<br />
cookie is bootstrapped.</p>
<p><strong>Data stored locally on your site:</strong> TrustSig writes a verification log to<br />
your own WordPress database (custom tables) that includes visitor IP addresses,<br />
the action attempted, and the verdict. This data is not sent to TrustSig; you<br />
can clear it at any time from Settings <span aria-hidden="true" class="wp-exclude-emoji">→</span> TrustSig <span aria-hidden="true" class="wp-exclude-emoji">→</span> Tools.</p>
<p>By installing and activating this plugin you (the site administrator) consent to<br />
this data being sent to TrustSig so that requests can be verified. Inform your<br />
own site’s visitors as required by your local privacy obligations.</p>
<ul>
<li>Terms of Service: https://trustsig.eu/terms-of-service/</li>
<li>Privacy Policy: https://trustsig.eu/privacy</li>
</ul>


TrustSig Security


Deployment was easy, I am not tech savy but was able to get it running in less than a minute. I always had constant email spam from my site, after installing TrustSig it dropped to zero. 10/10


Easy setup and spam stopped

Stop bots, spam and brute-force attacks on every WordPress form. No CAPTCHA. No account. No keys. Installs and protects in one click.

neosoft

<p>Protect your WordPress blog with our amazing bot&SPAM blocker. Don’t let hackers get your website down, prevent spam and content scraping, block all hacking attempts and boost your blog performance.</p>
<h3>Bot Attack & SPAM Blocker</h3>
<p>This module determines whether a bot or real visitor is on your site in real time and blocks the activity of bots, while accelerating the loading of pages for real visitors, thereby improving the user experience. This reduces the load on hosting and on the server, saves on traffic and increases page load several times over.</p>
<p>The necessary bots (google, yahoo, Msn, etc) will easily get on your site and index pages, just like real users. The required search bots are determined based on the User-Agent and PTR records. All the rest are checked by the module’s algorithm and only complete browsers that have passed the model’s algorithm check are let through.</p>
<h3>Content Scraping Protection</h3>
<p>Content scraping can bring the most serious consequences for your site. Every day, hundreds of bots go from site to site to copy content and pictures to publish them on their site. As soon as your content is published on third-party sites, Google does not consider it as useful content for users, which means it lowers the position of your site in search results. Our module will protect your content, your pictures, and position in Google.</p>
<h3>Performance Optimization</h3>
<p>Our research shows that 70% of the server load comes from bots, scrapers, and hacker scripts that visit your site to steal content, search for vulnerabilities, or try to find your users’ passwords. Our module blocks all types of bots even before they try to load your site, thus, the server load is reduced by 30-40 percent, which will significantly speed up the loading of the website for real visitors, and thus improve their user experience.</p>
<h4>Cyber Attack Prevention</h4>
<p>Searches for vulnerabilities on a site, as a rule, are performed automatically. Hackers scan millions of sites daily with specially designed utilities. Once a vulnerability has been found on your site, the hacker uses it to gain access to restricted information on your site. Our module blocks all possible vulnerability scan utilities. Thus, it does not allow 99% of all vulnerability scanners to your site, and therefore reduces the likelihood of hacking the site.</p>
<h4>SPAM Prevention</h4>
<p>Our module stops all automatic spam utilities. It blocks such types of spam as: comment spam, user registration, spam through a feedback form, and spam on forums. Thanks to the algorithm for determining who are real visitors, all spam bots are blocked when they try to enter your site</p>
<h4>Fraud Prevention</h4>
<p>Every day, hackers break into hundreds of online stores and get access to customers’ credit cards. The next step is to check credit cards for validity. To do this, automatic bots are used to enter card data into your store in order to check if the credit card works or not. We designed our module in such a way that it blocks 99% of such bots, which means you don’t have to spend time issuing refunds and identifying fraud transactions.</p>
<h4>Price Scraping Protection</h4>
<p>Competitors often use automated scripts to monitor your prices. As soon as you reduce or increase the cost of your goods, they do the same, thereby disrupting your sales with their own. Our module does not allow price scrapers to get information about your discounts, which means competitors will be able to get information about the cost of your goods only by personally visiting your site every day.</p>


Bad Bot Blocker

Protect your Wordpress blog with our amazing bot&SPAM blocker. Don't let hackers get your website down, prevent spam and content scraping, bl …

TrustSig Security vs Bad Bot Blocker