trustsig

TrustSig Security protects WordPress forms and API endpoints from scripted bots and brute-force attacks. No puzzles. No “I am not a robot” checkboxes. No third-party signup required to start. Coverage depends on the protection mode you choose — see “Protection modes” below.
<a href="https://ps.w.org/trustsig-security/assets/screenshot-1.png" rel="nofollow ugc"></a> 
<a href="https://ps.w.org/trustsig-security/assets/screenshot-2.png" rel="nofollow ugc"></a> 
<a href="https://ps.w.org/trustsig-security/assets/screenshot-3.png" rel="nofollow ugc"></a>
<h4>Why TrustSig</h4>
<ul>
<li>Protects every important form out of the box — login, registration, comments, password reset, WooCommerce checkout, BuddyPress signup, Easy Digital Downloads, Elementor Pro forms, WPForms (including the Mesmerize / Materialis contact form), Contact Form 7, SureForms, and any custom form via shortcode.</li>
<li>Stops brute-force login attempts with built-in lockout after repeated failures.</li>
<li>Invisible to humans — real visitors are verified in under a second by a non-interactive browser check. No CAPTCHA, no images to click.</li>
<li>Three protection modes — Monitor (log only), Challenge (default, soft block with auto-retry), Enforce (hard block).</li>
<li>Zero configuration — activate the plugin and protection is live immediately. Anonymous free tier needs no account.</li>
<li>Works with caching plugins, WPML, multisite and most themes — forms are signed server-side with a per-site secret.</li>
<li>Developer-friendly — PHP helper <code>trustsig_verify()</code>, REST endpoint <code>/wp-json/trustsig/v1/verify</code>, filters and actions for custom forms.</li>
<li>Optional admin-ajax and REST API guard for advanced sites.</li>
<li>GPLv2 — fully open source.</li>
</ul>
<h4>How it works</h4>
TrustSig injects a lightweight browser SDK, signs every rendered form with a per-site secret, and verifies submissions against the TrustSig Edge service. Real visitors pass an invisible check in about a second; scripted clients that never run JavaScript are stopped.
When a request arrives without a valid token, TrustSig does not silently fail 
open. Depending on the mode you choose it serves a lightweight “please wait” 
interstitial that re-verifies the browser and then transparently continues the 
original request — or blocks it.
The plugin works out of the box with no account and no API keys (anonymous 
free tier). Connecting a TrustSig dashboard account is optional and only adds 
analytics and higher limits.
<h4>Protection modes</h4>
<ul>
<li>Monitor — verify and log only, never block. Used for safe rollout; the 
upgrade path also pins existing sites here so behaviour never changes 
silently on update.</li>
<li>Challenge (default for new installs) — a missing or invalid token shows 
the interstitial, then continues or blocks.</li>
<li>Enforce — a missing or invalid token is blocked immediately.</li>
</ul>
<h4>What it protects</h4>
Browser forms are protected automatically with no code:
<ul>
<li>WordPress core — login, registration, comments, lost/reset password</li>
<li>WooCommerce — login, registration, checkout, pay order, lost password</li>
<li>BuddyPress — registration</li>
<li>Easy Digital Downloads — login, registration</li>
<li>Elementor Pro forms</li>
<li>WPForms — contact and other forms, on by default (covers the Mesmerize / Materialis contact section)</li>
<li>Contact Form 7 — feedback submissions, on by default (guarded on the REST endpoint CF7 submits to)</li>
<li>SureForms — form submissions, on by default (guarded on the REST submit-form endpoint)</li>
<li>Any other form (site-wide “protect all forms” option, the <code>[trustsig_form]</code> 
shortcode, or a hidden <code>trustsig-response</code> input)</li>
</ul>
It also includes optional brute-force lockout for repeated failed logins, an 
opt-in admin-ajax / REST API guard, and a developer verification API.
<h4>For developers</h4>
<ul>
<li>PHP: <code>trustsig_verify( array( 'token' => $t, 'action' => 'my_form' ) )</code> 
returns <code>pass</code> | <code>fail</code> | <code>challenge</code>. Filters: <code>trustsig_pre_verify</code>, 
 trustsig_result. Action: <code>trustsig_blocked</code>.</li>
<li>REST: <code>POST /wp-json/trustsig/v1/verify</code> with <code>{ "token": "..." }</code>.</li>
</ul>
<h4>Known limitations</h4>
<ul>
<li>XML-RPC (<code>xmlrpc.php</code>) is intentionally out of scope and is not verified. 
Disable XML-RPC separately if it is unused on your site.</li>
<li>admin-ajax and the REST API are only protected when explicitly enabled in 
Settings, to avoid breaking third-party integrations.</li>
<li>File-upload and AJAX submissions cannot show the interstitial; under 
Challenge or Enforce mode a missing token on those is blocked, never 
silently allowed.</li>
</ul>
<h3>External services</h3>
This plugin relies on the TrustSig Edge service to decide whether a request 
comes from a human or an automated client. This bot-detection verdict cannot be 
produced locally, so the service is required for the plugin’s core 
functionality.
Service provider: TrustSig — https://trustsig.eu
Remote script loaded in the browser: 
 https://edge.trustsig.eu/trustsig.js is loaded on pages that contain a 
protected form, on the login screen, and on the verification interstitial. The 
script runs the non-interactive browser check and produces a verification 
token.
Data sent from the visitor’s browser / your server to 
 https://edge.trustsig.eu/verify:
<ul>
<li>the TrustSig verification token generated by the SDK in the visitor’s browser;</li>
<li>your site’s host name (e.g. <code>example.com</code>) on the anonymous free tier, or, if 
you connect a dashboard account, the secret key you entered;</li>
<li>as part of any HTTPS request, the visitor’s IP address and standard request 
metadata (such as the user-agent) are visible to the service.</li>
</ul>
When data is sent: when the SDK loads on a protected page, when a protected 
form is submitted, and once per browser when the optional verified-session 
cookie is bootstrapped.
Data stored locally on your site: TrustSig writes a verification log to 
your own WordPress database (custom tables) that includes visitor IP addresses, 
the action attempted, and the verdict. This data is not sent to TrustSig; you 
can clear it at any time from Settings → TrustSig → Tools.
By installing and activating this plugin you (the site administrator) consent to 
this data being sent to TrustSig so that requests can be verified. Inform your 
own site’s visitors as required by your local privacy obligations.
<ul>
<li>Terms of Service: https://trustsig.eu/terms-of-service/</li>
<li>Privacy Policy: https://trustsig.eu/privacy</li>
</ul>

TrustSig Security


Deployment was easy, I am not tech savy but was able to get it running in less than a minute. I always had constant email spam from my site, after installing TrustSig it dropped to zero. 10/10


Easy setup and spam stopped

Stop bots, spam and brute-force attacks on every WordPress form. No CAPTCHA. No account. No keys. Installs and protects in one click.

POTAR

Checkout Origin Guard protects your WooCommerce store from fake, fraudulent, or automated checkout attempts by identifying and blocking abusive origins before they clutter your order table or your logs.
The plugin runs client-origin heuristics, IP controls, and sequence analysis to detect non-human traffic and suspicious behavior at checkout. It adds Company Shield for business and email sanity checks and an optional AVS “U” signal handler for gateways that report “Address not checked / unavailable”.
All controls live on a single admin screen; you can adjust sensitivity, manage allowlists and blocklists, and review traffic logs in one place.
<h3>Three layers of protection</h3>
<ol>
<li>
Bot Block (traffic level) 
Detects and throttles abusive requests before they become orders:
<ul>
<li>Analyzes user agents, referrers, and known bot signatures </li>
<li>Watches rapid-fire hits to checkout and wc-ajax endpoints </li>
<li>Supports monitor, soft, and hard blocking modes </li>
<li>Built-in allowlist for search engines, uptime monitors, and core WordPress services</li>
</ul>
</li>
<li>
Company Shield (checkout level) 
Validates business identity and email quality at checkout:
<ul>
<li>Flags suspicious or synthetic business names </li>
<li>Detects repeated syllables, odd vowel ratios, and gibberish patterns </li>
<li>Identifies disposable email domains and role-based accounts (admin, info, sales, etc.) </li>
<li>Can run in:
<ul>
<li>Monitor; log and annotate orders </li>
<li>Soft; create the order and automatically place it on hold or pending </li>
<li>Hard; block checkout with a user-facing error message</li>
</ul>
</li>
</ul>
</li>
<li>
Payment AVS signals (post-payment; optional) 
For gateways that expose AVS results in order meta, Checkout Origin Guard can treat “AVS: U; unavailable / not checked” as a risk signal:
<ul>
<li>Does not change how your gateway authorizes or captures payments </li>
<li>Can be configured to:
<ul>
<li>Ignore the signal </li>
<li>Add an order note only </li>
<li>Add an order note and bump a risk-score meta field </li>
<li>Put the order on hold for manual review </li>
</ul>
</li>
<li>Uses flexible pattern matching; can scan specific gateway meta keys or fall back to scanning all order meta for common “AVS: U” messages such as the PayPal string </li>
<li>Off by default; you opt in and choose the behavior</li>
</ul>
</li>
</ol>
<h3>Key Features</h3>
<ul>
<li>🛡️ Bot Block; Detects and blocks automated bots by analyzing user agents, referrers, and checkout behavior patterns.</li>
<li>⚡ Rapid Sequence Detection; Monitors frequency and timing between checkout attempts to identify scripted attacks and card testing activity.</li>
<li>🧠 Company Shield; Flags suspicious or AI-generated business names, email domains, and mixed-character spam entries at checkout.</li>
<li>🌎 Allowlist Controls; Preserve access for search engines, uptime monitors, and essential WordPress and WooCommerce services.</li>
<li>🔒 Hard / Soft / Monitor Modes; Choose between logging only, soft blocking, or full hard blocking.</li>
<li>🧾 AVS “U” Risk Signals (optional); Treat “Address not checked / unavailable” as a post-payment risk signal; add notes, increase risk score, or hold the order.</li>
<li>🗂️ Log Viewer; See activity including timestamps, IPs, user agents, paths, and detection outcomes.</li>
<li>🧩 One-Page Dashboard; Configure settings, review logs, and manage allow/deny lists from a single screen.</li>
<li>🚫 Manual Block / Unblock; Instantly remove or restore access for specific IPs with one click.</li>
<li>💾 CSV Export; Download checkout-origin activity logs for security review or record keeping.</li>
</ul>
<h3>Why Online Shops Need it</h3>
WooCommerce checkouts are frequent targets for:
<ul>
<li>Card testing and BIN probing </li>
<li>Fake business registrations and spam accounts </li>
<li>Automated scripts hammering your checkout endpoints </li>
</ul>
Checkout Origin Guard focuses on checkout behavior and identity quality, not just generic firewall rules. It helps you:
<ul>
<li>Reduce chargeback and fraud risk </li>
<li>Keep your order list clean and reviewable </li>
<li>Shorten the time spent cleaning up junk orders and bogus signups </li>
</ul>
The plugin works alongside any existing firewall, CDN, or WAF; it does not rely on external APIs or subscriptions. All data stays on your server.
<h3>Use Cases</h3>
<ul>
<li>Prevent card testing or order spam </li>
<li>Stop bots using nonsense or AI-generated company names </li>
<li>Detect rapid repeat checkout attempts from the same IP </li>
<li>Block suspicious POST requests that hit checkout endpoints </li>
<li>Add an extra layer of review for orders where the gateway reports “AVS unavailable / not checked” </li>
<li>Maintain cleaner order history and logs for real customers</li>
</ul>
<h3>Credits</h3>
Developed by Michael Winchester 
For documentation and updates, visit https://michaelwinchester.com

Checkout Origin Guard

One-page WooCommerce checkout hardening; bot blocking, rate/sequence checks, business/email heuristics, and optional AVS-based risk signals.

TrustSig Security vs Checkout Origin Guard