trustsig

<p><strong>TrustSig Security protects WordPress forms and API endpoints from scripted bots and brute-force attacks.</strong> No puzzles. No “I am not a robot” checkboxes. No third-party signup required to start. Coverage depends on the protection mode you choose — see “Protection modes” below.</p>
<p><a href="https://ps.w.org/trustsig-security/assets/screenshot-1.png" rel="nofollow ugc"></a><br />
<a href="https://ps.w.org/trustsig-security/assets/screenshot-2.png" rel="nofollow ugc"></a><br />
<a href="https://ps.w.org/trustsig-security/assets/screenshot-3.png" rel="nofollow ugc"></a></p>
<h4>Why TrustSig</h4>
<ul>
<li><strong>Protects every important form out of the box</strong> — login, registration, comments, password reset, WooCommerce checkout, BuddyPress signup, Easy Digital Downloads, Elementor Pro forms, WPForms (including the Mesmerize / Materialis contact form), Contact Form 7, SureForms, and any custom form via shortcode.</li>
<li><strong>Stops brute-force login attempts</strong> with built-in lockout after repeated failures.</li>
<li><strong>Invisible to humans</strong> — real visitors are verified in under a second by a non-interactive browser check. No CAPTCHA, no images to click.</li>
<li><strong>Three protection modes</strong> — Monitor (log only), Challenge (default, soft block with auto-retry), Enforce (hard block).</li>
<li><strong>Zero configuration</strong> — activate the plugin and protection is live immediately. Anonymous free tier needs no account.</li>
<li><strong>Works with caching plugins, WPML, multisite and most themes</strong> — forms are signed server-side with a per-site secret.</li>
<li><strong>Developer-friendly</strong> — PHP helper <code>trustsig_verify()</code>, REST endpoint <code>/wp-json/trustsig/v1/verify</code>, filters and actions for custom forms.</li>
<li><strong>Optional admin-ajax and REST API guard</strong> for advanced sites.</li>
<li><strong>GPLv2</strong> — fully open source.</li>
</ul>
<h4>How it works</h4>
<p>TrustSig injects a lightweight browser SDK, signs every rendered form with a per-site secret, and verifies submissions against the TrustSig Edge service. Real visitors pass an invisible check in about a second; scripted clients that never run JavaScript are stopped.</p>
<p>When a request arrives without a valid token, TrustSig does not silently fail<br />
open. Depending on the mode you choose it serves a lightweight “please wait”<br />
interstitial that re-verifies the browser and then transparently continues the<br />
original request — or blocks it.</p>
<p>The plugin works out of the box with <strong>no account and no API keys</strong> (anonymous<br />
free tier). Connecting a TrustSig dashboard account is optional and only adds<br />
analytics and higher limits.</p>
<h4>Protection modes</h4>
<ul>
<li><strong>Monitor</strong> — verify and log only, never block. Used for safe rollout; the<br />
upgrade path also pins existing sites here so behaviour never changes<br />
silently on update.</li>
<li><strong>Challenge</strong> (default for new installs) — a missing or invalid token shows<br />
the interstitial, then continues or blocks.</li>
<li><strong>Enforce</strong> — a missing or invalid token is blocked immediately.</li>
</ul>
<h4>What it protects</h4>
<p>Browser forms are protected automatically with no code:</p>
<ul>
<li>WordPress core — login, registration, comments, lost/reset password</li>
<li>WooCommerce — login, registration, checkout, pay order, lost password</li>
<li>BuddyPress — registration</li>
<li>Easy Digital Downloads — login, registration</li>
<li>Elementor Pro forms</li>
<li>WPForms — contact and other forms, on by default (covers the Mesmerize / Materialis contact section)</li>
<li>Contact Form 7 — feedback submissions, on by default (guarded on the REST endpoint CF7 submits to)</li>
<li>SureForms — form submissions, on by default (guarded on the REST submit-form endpoint)</li>
<li>Any other form (site-wide “protect all forms” option, the <code>[trustsig_form]</code><br />
shortcode, or a hidden <code>trustsig-response</code> input)</li>
</ul>
<p>It also includes optional brute-force lockout for repeated failed logins, an<br />
opt-in admin-ajax / REST API guard, and a developer verification API.</p>
<h4>For developers</h4>
<ul>
<li>PHP: <code>trustsig_verify( array( 'token' => $t, 'action' => 'my_form' ) )</code><br />
returns <code>pass</code> | <code>fail</code> | <code>challenge</code>. Filters: <code>trustsig_pre_verify</code>,<br />
  trustsig_result. Action: <code>trustsig_blocked</code>.</li>
<li>REST: <code>POST /wp-json/trustsig/v1/verify</code> with <code>{ "token": "..." }</code>.</li>
</ul>
<h4>Known limitations</h4>
<ul>
<li>XML-RPC (<code>xmlrpc.php</code>) is intentionally out of scope and is not verified.<br />
Disable XML-RPC separately if it is unused on your site.</li>
<li>admin-ajax and the REST API are only protected when explicitly enabled in<br />
Settings, to avoid breaking third-party integrations.</li>
<li>File-upload and AJAX submissions cannot show the interstitial; under<br />
Challenge or Enforce mode a missing token on those is blocked, never<br />
silently allowed.</li>
</ul>
<h3>External services</h3>
<p>This plugin relies on the <strong>TrustSig Edge</strong> service to decide whether a request<br />
comes from a human or an automated client. This bot-detection verdict cannot be<br />
produced locally, so the service is required for the plugin’s core<br />
functionality.</p>
<p><strong>Service provider:</strong> TrustSig — https://trustsig.eu</p>
<p><strong>Remote script loaded in the browser:</strong><br />
    https://edge.trustsig.eu/trustsig.js is loaded on pages that contain a<br />
protected form, on the login screen, and on the verification interstitial. The<br />
script runs the non-interactive browser check and produces a verification<br />
token.</p>
<p><strong>Data sent from the visitor’s browser / your server to<br />
    https://edge.trustsig.eu/verify:</strong></p>
<ul>
<li>the TrustSig verification token generated by the SDK in the visitor’s browser;</li>
<li>your site’s host name (e.g. <code>example.com</code>) on the anonymous free tier, or, if<br />
you connect a dashboard account, the secret key you entered;</li>
<li>as part of any HTTPS request, the visitor’s IP address and standard request<br />
metadata (such as the user-agent) are visible to the service.</li>
</ul>
<p><strong>When data is sent:</strong> when the SDK loads on a protected page, when a protected<br />
form is submitted, and once per browser when the optional verified-session<br />
cookie is bootstrapped.</p>
<p><strong>Data stored locally on your site:</strong> TrustSig writes a verification log to<br />
your own WordPress database (custom tables) that includes visitor IP addresses,<br />
the action attempted, and the verdict. This data is not sent to TrustSig; you<br />
can clear it at any time from Settings <span aria-hidden="true" class="wp-exclude-emoji">→</span> TrustSig <span aria-hidden="true" class="wp-exclude-emoji">→</span> Tools.</p>
<p>By installing and activating this plugin you (the site administrator) consent to<br />
this data being sent to TrustSig so that requests can be verified. Inform your<br />
own site’s visitors as required by your local privacy obligations.</p>
<ul>
<li>Terms of Service: https://trustsig.eu/terms-of-service/</li>
<li>Privacy Policy: https://trustsig.eu/privacy</li>
</ul>


TrustSig Security


Deployment was easy, I am not tech savy but was able to get it running in less than a minute. I always had constant email spam from my site, after installing TrustSig it dropped to zero. 10/10


Easy setup and spam stopped

Stop bots, spam and brute-force attacks on every WordPress form. No CAPTCHA. No account. No keys. Installs and protects in one click.

Pradnyankur Nikam

<p><a href="https://pkplugins.com/" title="Pk Spam Registration Blocker WordPress plugin Link at pkplugins.com" rel="nofollow ugc">Pk Spam Registration Blocker WordPress plugin</a> blocks spam user registration. This plugin prevents bot or spam user registrations on WordPress websites. Try this WP plugin to disable auto registration, stop test/fake user registrations on WP site. The plugin uses Google reCAPTCHA v3 to stop fake user registration.</p>
<h4>Pk Spam Registration Blocker WordPress Plugin Features</h4>
<ul>
<li>Very simple, easy to install and use.</li>
<li>No complex menus or setting.</li>
<li>Add Google reCaptcha site key & secret key and done.</li>
<li>Enable or disable spam protection on your website.</li>
<li>Enable or disable registration spam protection on specific pages.</li>
<li>Compatible with almost latest version of WordPress.</li>
</ul>
<h4>How Does It Work?</h4>
<p>Once you install & configure Pk Spam Registration Blocker, it protects your website. The back-end plugin codes load Google reCaptcha on selected form pages. The Google reCaptcha v3 automatically block spam activity. When a genuine user submits the form, it is is successful. While, if the bot software tries to automatically submit forms, the request are blocked. In the latest reCaptcha version, that is v3, user don’t need to fill out challenge question. The user activity is detected automatically. And any spam activity is restricted.</p>
<h4>Translations</h4>
<p>Currently the plugin is available in only the English language. We will add more languages soon.</p>
<h4>More Information and Support</h4>
<ul>
<li>Homepage of <a href="https://pkplugins.com/" title="WordPress plugin to stop spam attacks" rel="nofollow ugc">Pk Spam Registration Blocker Plugin</a> for WordPress at pkplugins.com</li>
<li>More <a href="https://pkplugins.com/" title="List of Free WordPress plugins" rel="nofollow ugc">Free WordPress plugins</a></li>
<li><a href="https://pkplugins.com/" title="WordPress Plugin support and help" rel="nofollow ugc">Plugin support and help</a></li>
</ul>
<h3>Read more and Support</h3>
<ul>
<li>If you like Pk Spam Registration Blocker plugin, please provide your valuable feedback and suggestions to improve the quality of the plugin.</li>
<li>Feel free to test the plugin in different WordPress versions and vote in the Compatibility section so that other users can check compatibility and download the appropriate version.</li>
<li>Share your experience by rating the plugin.</li>
<li>Read about plugin news, updates and more on our official website at <a href="https://pkplugins.com/" title="WordPress plugins for your website at pkplugins.com" rel="nofollow ugc">pkplugins.com</a></li>
<li>Do not hesitate to ask questions, report bugs/errors or anything related to our plugin through our support section, author’s website or plugin website.</li>
</ul>
<h4>License</h4>
<p>Pk Spam Registration Blocker WordPress plugin is released under the GPLv2. You can download, install and use this plugin for free on your personal or commercial website.</p>


Pk Spam Registration Blocker

Protect your website registration form from spam attacks. Block test or fake user registrations on your WordPress website.

TrustSig Security vs Pk Spam Registration Blocker