Init Void Shield – Zero-DB, Honeypot, Anti-Spam

Init Void Shield protects WordPress comment forms, the default login/registration/lost-password forms, and popular form plugins with a layered honeypot defense that requires no database tables, no external JavaScript, and no user friction.

This plugin is part of the Init Plugin Suite — a collection of minimalist, fast, and developer-focused tools for WordPress.

GitHub repository: https://github.com/brokensmile2103/init-void-shield

Core honeypot engine (always on for comments):

1. Dynamic field names — derived from context + site salt (plus an optional custom prefix) so bots cannot hardcode field names.
2. CSS-clipped honeypots — a text field and a checkbox hidden with rotating CSS techniques (never display:none or visibility:hidden, the two patterns CSS-aware bots specifically look for and skip) that bots fill but humans never see. The text field is also marked readonly, so browser and password-manager autofill (Chrome, saved-password prompts, and similar) never writes into it either — bots that scrape the raw HTML or drive a headless browser still fall for it exactly the same.
3. Signed time tokens — each form carries a timestamp + HMAC hash verified server-side with hash_equals() to prevent timing attacks. Submissions under the minimum threshold are rejected; login/registration/other account-style forms use their own, shorter threshold by default (see Account Forms Minimum Submit Time), since a browser autofilling saved credentials lets a genuine visitor submit faster than someone typing a comment from scratch.
4. JavaScript + headless-browser verification — a signed, per-form JS proof is injected after a configurable delay (plus a small random jitter, so the exact wait can’t be read from the page source and timed around), and the script flags common automation signals (navigator.webdriver, a zero-size browser window, HeadlessChrome/PhantomJS, Selenium/ChromeDriver traces) picked up from real Selenium/Puppeteer/Playwright sessions. The proof is bound to the form’s own time token and never appears in plain text in the page, so a bot that scrapes the HTML and replays hidden values can’t produce it. Static crawlers, instant bots, and unmasked headless browsers all get caught; real users don’t.
5. Submit Hold — on login, registration, comment, and other forms that submit without AJAX, a visitor who clicks submit before the guard is ready (typically right after the browser autofills a saved password) is held for a moment and submitted automatically once it is, instead of being rejected. Nothing is relaxed server-side.
6. Non-browser User-Agent detection — rejects submissions whose User-Agent identifies a scripted HTTP client (curl, Python requests, Go, Scrapy, and similar) rather than a real browser, catching bots that skip JavaScript entirely and simply replay the static form fields. On by default; the signature list is filterable.
7. Block Cross-Site Submissions — rejects a submission the browser itself reports as sent from a different website (Sec-Fetch-Site: cross-site), a header page scripts cannot forge and privacy extensions don’t strip. A request without the header is never rejected by this check. On by default.
8. Block REST API Comments (optional) — rejects comments posted directly through the wp/v2/comments REST endpoint, which the classic form-based layers cannot cover since those requests never carry the honeypot fields or tokens.
9. Require Same-Site Referer (optional) — rejects a comment submission whose Referer header is missing or points elsewhere, catching bots that post directly to the comment endpoint. Off by default and disclosed as a trade-off, since some privacy-focused browsers strip Referer even on genuine same-site submissions.
10. Comment content filters (optional) — a maximum number of links per comment, BBCode link blocking, and blocking web addresses in the author name. Unlike the behavioral layers, these read what was actually written, so they also catch spam posted by a real person or a real browser — including wpDiscuz comments, which the honeypot layers can’t see.

Key design goals:

• No database clutter (zero tables, zero rows; stats use a single non-autoloaded option)
• No external JS/CDN calls
• No CAPTCHA, no puzzles, no user interruption
• Logged-in users are bypassed automatically on the comment form (optional override in settings)
• Every guard beyond the core comment form is opt-in — no new form is silently guarded when you update
• Bots receive HTTP 200 OK on the comment form so they think they succeeded and move on

Filters

A short reference of the developer filters shipped with the plugin (all are standard WordPress filters, added with add_filter()):

• init_plugin_suite_void_shield_skip_verification — skip comment-form verification for a request.
• init_plugin_suite_void_shield_skip_login_verification / _register_verification / _lostpassword_verification / _multisite_signup_verification — force-disable an individual WordPress Core Forms guard, overriding its settings-page toggle.
• init_plugin_suite_void_shield_login_scope_exempt — override the Referer-based heuristic used by the “wp-login.php only” Login Guard Scope.
• init_plugin_suite_void_shield_honeypot_html — filter the rendered honeypot HTML block; receives the context string as a second argument.
• init_plugin_suite_void_shield_kill_response_message / _title / _code — customize the soft-kill response shown to bots on the comment form.
• init_plugin_suite_void_shield_min_time / _max_time / _js_delay — override the Minimum Submit Time, Maximum Token Age, and JS Token Delay thresholds.
• init_plugin_suite_void_shield_hidden_style_variants — customize the pool of CSS techniques used to hide honeypot fields.
• init_plugin_suite_void_shield_{context}_blocked_message — customize the rejection message for a given guard (e.g. ..._login_blocked_message, ..._woocommerce_blocked_message, ..._bbpress_blocked_message).
• init_plugin_suite_void_shield_blocked_user_agent_signatures — customize the list of non-browser User-Agent substrings checked by Block Non-Browser User Agents.
• init_plugin_suite_void_shield_js_delay_jitter_max — override the maximum random jitter (milliseconds) added on top of the JavaScript Token Delay.
• init_plugin_suite_void_shield_min_interaction_delay — override the minimum time (milliseconds) that must pass before a Require Real User Interaction event is accepted.
• init_plugin_suite_void_shield_referer_exempt — force-exempt a request from the Require Same-Site Referer check regardless of its settings-page toggle.
• init_plugin_suite_void_shield_cross_site_exempt — force-exempt a request from the Block Cross-Site Submissions check; receives the guard context as a second argument.
• init_plugin_suite_void_shield_submit_hold_enabled — enable or disable Submit Hold for a given guard context (e.g. for a custom natively-submitted form added via init_plugin_suite_void_shield_build_guard_markup()).
• init_plugin_suite_void_shield_submit_hold_fetch_wait — maximum time (milliseconds) Submit Hold waits for a pending Lazy Fetch request. Default 4000.
• init_plugin_suite_void_shield_skip_content_filters — skip the comment content filters for a request.
• init_plugin_suite_void_shield_comment_content_violation — add your own comment content rules: return a reason key to block a comment, or an empty string to allow it.

License

This plugin is licensed under the GPLv2 or later.