內容簡介
Init Void Shield 是一款專為 WordPress 設計的防止垃圾留言外掛，透過多層次的 honeypot 防禦機制，保護評論表單及登入/註冊/重設密碼表單，無需資料庫表格或外部 JavaScript，並且不影響使用者體驗。
【主要功能】
• 動態欄位名稱防止機器人識別
• CSS 隱藏的 honeypots 技術
• 簽名時間令牌防止時間攻擊
• JavaScript 驗證防止自動化工具
• 可選擇阻擋 REST API 評論
外掛標籤
開發者團隊
② 後台搜尋「Init Void Shield – Zero-DB, Honeypot, Anti-Spam」→ 直接安裝（推薦）
原文外掛簡介
Init Void Shield protects WordPress comment forms, the default login/registration/lost-password forms, and popular form plugins with a layered honeypot defense that requires no database tables, no external JavaScript, and no user friction.
This plugin is part of the Init Plugin Suite — a collection of minimalist, fast, and developer-focused tools for WordPress.
GitHub repository: https://github.com/brokensmile2103/init-void-shield
Core honeypot engine (always on for comments):
Dynamic field names — derived from context + site salt (plus an optional custom prefix) so bots cannot hardcode field names.
CSS-clipped honeypots — a text field and a checkbox hidden with rotating CSS techniques (never display:none or visibility:hidden, the two patterns CSS-aware bots specifically look for and skip) that bots fill but humans never see.
Signed time tokens — each form carries a timestamp + HMAC hash verified server-side with hash_equals() to prevent timing attacks. Submissions under the minimum threshold are rejected.
JavaScript + headless-browser verification — a hidden token is injected after a configurable delay, and the script flags common automation signals (navigator.webdriver, a zero-size browser window) picked up from real Selenium/Puppeteer/Playwright sessions. Static crawlers, instant bots, and unmasked headless browsers all get caught; real users don’t.
Block REST API Comments (optional) — rejects comments posted directly through the wp/v2/comments REST endpoint, which the classic form-based layers cannot cover since those requests never carry the honeypot fields or tokens.
Recent updates (1.4–1.6):
Fixed: a setting could get permanently stuck at its default value once saved back to it, unable to change afterwards — most noticeable on the main “Enable Init Void Shield” toggle, since a fresh install already starts there. Caused by a WordPress core edge case triggered by register_setting()‘s default argument; removed from every setting in this plugin, with no change to displayed defaults.
wpDiscuz compatibility — wpDiscuz builds its comment submissions from a fixed set of fields rather than serializing its form, so this plugin’s checks can never see or verify them. Enabling wpDiscuz on a site now automatically exempts its comments from verification instead of rejecting real visitors with a check they can’t satisfy — a compatibility bypass, not protection.
Fixed: a comment submission’s post ID is now read from the value WordPress core has already resolved, instead of re-reading the raw comment_post_ID POST field directly, which not every comment form sends under that exact name.
Login Guard Scope — a new “wp-login.php only” option for the Login Guard: stop guarding a front-end wp_login_form() usage (e.g. a custom login page, widget, or modal) entirely, keeping full protection on the native wp-login.php form. Useful if that front-end form lives on a page a full-page cache might serve stale. Uses the Referer header as a heuristic to tell the two forms apart — a deliberate, disclosed trade-off; the default (“Everywhere”) remains the strongest option.
Higher Maximum Token Age ceiling — raised from 24 hours to 30 days, for sites with long-lived full-page caching.
Lazy Fetch (Cache-Safe Tokens) — optional layer (off by default): refreshes the time token via a small same-origin fetch() request (plain JavaScript, no jQuery) as soon as the page truly loads, instead of relying only on the value baked in when the page was rendered — which, on a cached page, reflects when the cache was generated, not when a real visitor loaded it. Applies to every guarded form. If the request fails or JavaScript is unavailable, the original baked-in token is used as a fallback, so this can only help, never hurt.
Context-bound, self-expiring time tokens — the signed time token is bound to the specific form it was issued for and rejected once it goes stale, hardening the core anti-replay layer.
Optional real-interaction check — under Advanced Protection, require at least one genuine mouse, keyboard, touch, or scroll event before a submission is accepted, catching bots that simply wait out the JS delay instead of interacting with the page. Off by default.
Three more integrations — WooCommerce (My Account registration), bbPress (New Topic and Reply forms), and BuddyPress (registration), plus a guard for the Multisite site/user signup form (wp-signup.php). Each is off by default, same as the existing integrations.
Optional Dashboard widget — a compact “Blocked Submissions” summary on the WordPress Dashboard, off by default, visible only to users who can manage options.
Key design goals:
No database clutter (zero tables, zero rows; stats use a single non-autoloaded option)
No external JS/CDN calls
No CAPTCHA, no puzzles, no user interruption
Logged-in users are bypassed automatically on the comment form (optional override in settings)
Every guard beyond the core comment form is opt-in — nothing new is silently turned on when you update
Bots receive HTTP 200 OK on the comment form so they think they succeeded and move on
Filters
A short reference of the developer filters shipped with the plugin (all are standard WordPress filters, added with add_filter()):
init_plugin_suite_void_shield_skip_verification — skip comment-form verification for a request.
init_plugin_suite_void_shield_skip_login_verification / _register_verification / _lostpassword_verification / _multisite_signup_verification — force-disable an individual WordPress Core Forms guard, overriding its settings-page toggle.
init_plugin_suite_void_shield_login_scope_exempt — override the Referer-based heuristic used by the “wp-login.php only” Login Guard Scope.
init_plugin_suite_void_shield_honeypot_html — filter the rendered honeypot HTML block; receives the context string as a second argument.
init_plugin_suite_void_shield_kill_response_message / _title / _code — customize the soft-kill response shown to bots on the comment form.
init_plugin_suite_void_shield_min_time / _max_time / _js_delay — override the Minimum Submit Time, Maximum Token Age, and JS Token Delay thresholds.
init_plugin_suite_void_shield_hidden_style_variants — customize the pool of CSS techniques used to hide honeypot fields.
init_plugin_suite_void_shield_{context}_blocked_message — customize the rejection message for a given guard (e.g. ..._login_blocked_message, ..._woocommerce_blocked_message, ..._bbpress_blocked_message).
License
This plugin is licensed under the GPLv2 or later.
