內容簡介
SyGy Security Log & Anti-Bot 是一款專為 WordPress 設計的主動式防機器人外掛，能有效阻擋自動化垃圾郵件請求，並保護網站不受盲目機器人攻擊，同時不會增加資料庫負擔或影響網站速度。
【主要功能】
• 主動式防護，無需 CAPTCHA
• 確保資料庫不受垃圾郵件影響
• 使用 HMAC-SHA256 加密驗證
• 即時 HTTP 403 禁止回應
• 提升網站性能與安全性
外掛標籤
開發者團隊
② 後台搜尋「SyGy Security Log & Anti-Bot」→ 直接安裝（推薦）
原文外掛簡介
Proactive Anti-Bot shield for WP Comments, WooCommerce, CF7, WPForms, Elementor, wpForo, bbPress & BuddyPress with GDPR logging.
Stop Blind Bots at the Gate. Zero CAPTCHAs. Zero Database Bloat. 100% Cache Friendly.
Every day, WordPress websites are hammered by thousands of automated spam requests. Most of this traffic does not come from real browsers—it comes from “Blind Bots” (headless scripts, cURL botnets, and automated scrapers) that send direct POST requests to wp-comments-post.php, wp-login.php, wp-signup.php, contact forms, and forum endpoints, completely bypassing your frontend pages.
Traditional anti-spam plugins make a critical architectural mistake: they let the bot in first. They process the request, run heavy regular expressions, query external cloud APIs, and save the spam inside your MySQL database. Over time, this bloats your database, slows down queries, and wastes server CPU and RAM. Other plugins force your visitors to solve annoying CAPTCHAs or load heavy third-party JavaScript libraries that destroy your Core Web Vitals and PageSpeed score.
SyGy Security Log & Anti-Bot flips the paradigm with a Proactive Client-Side Cryptographic Behavioral Shield.
How It Works: Surgical Precision at Zero Server Cost
Instead of analyzing spam after it hits your database, SyGy Security Log & Anti-Bot verifies how the user interacts with your form:
Per-Site Cryptographic Split Token (HMAC-SHA256): A tiny, dependency-free inline JavaScript snippet dynamically assembles and injects a site-unique HMAC-SHA256 validation token into your forms upon page load (DOMContentLoaded) and real human interaction (focusin, pointerdown, submit).
Instant HTTP 403 Termination: When a request reaches your server without the behavioral token, the plugin verifies the signature via timing-safe hash_equals() and terminates bot execution immediately with an HTTP 403 Forbidden response.
Untouched Database: MySQL is never queried for spam storage, external APIs are never called, and legitimate human visitors never see a single CAPTCHA puzzle.
All-in-One Ecosystem Protection (10 Auto-Detecting Modules)
You don’t need five different anti-spam plugins. SyGy Security Log & Anti-Bot uses conditional loading to automatically protect the plugins you already use, with zero overhead for modules you don’t have installed:
WordPress Native Comments: Full protection for standard themes and custom templates built with Elementor, Divi, Bricks, WPBakery, and Gutenberg blocks ([WP-COMMENTS]).
WordPress Native User Registration: Protects both Single Site (wp-login.php?action=register) and Multisite (wp-signup.php) against automated fake account creation ([WP-REGISTER]).
WooCommerce (Reviews & Customer Registration): Protects product reviews ([WOOCOMMERCE]) and My Account registration forms ([WC-REGISTER]), plus adds a direct Open Anti-Bot Log shortcut inside Products > Reviews.
Contact Form 7 (CF7): Hooks seamlessly into wpcf7_spam to silently block automated contact form floods ([CF7]).
WPForms: Protects all WPForms Lite and Pro submissions ([WPFORMS]).
Elementor Pro Forms: Shields Elementor Pro contact and lead forms before emails are sent or entries are saved ([ELEMENTOR-FORM]).
wpForo Forums: Protects both new forum topics ([WPFORO-TOPIC]) and thread replies ([WPFORO-REPLY]).
bbPress Forums: Protects new forum topics ([BBPRESS-TOPIC]) and thread replies ([BBPRESS-REPLY]).
BuddyPress & Ultimate Member: Shields community registration pages ([BUDDYPRESS-SIGNUP] and [ULTIMATE-MEMBER]) from fake bot profiles.
Key Strengths & Enterprise Features
Native Control Panel under Tools > SyGy Anti-Bot: Zero external CSS or JS files. View live protection status across all 10 ecosystems, manage logging preferences, and monitor log file size from a clean native dashboard.
Smart 3-Tier Diagnostic Log (BOT BLOCKED, HUMAN ACCEPTED, USER ACCEPTED): By default, the log records blocked bots (BOT BLOCKED) and anonymous guest submissions (HUMAN ACCEPTED), while skipping legitimate actions from already logged-in members so busy forums and communities never bloat the log file. Need to debug logged-in users? Enable [USER ACCEPTED] logging per-site with one click in Tools > SyGy Anti-Bot!
Advanced WordPress Multisite Architecture (Centralized or Split-per-Subsite Logs): Each subsite has independent logging toggles. Furthermore, Super Admins can choose between a Single Centralized Network Log (default) or Isolated Per-Subsite Logs (Multi-Tenant mode, where each subsite stores and manages its own encrypted log file independently, with automatic subsite file cleanup if reverted).
Immune to Source-Code Inspection: Every WordPress installation generates its own cryptographic HMAC-SHA256 token split in JavaScript. Even if an attacker downloads the plugin source code, they cannot craft a universal cURL bypass payload.
100% Page Cache & “Delay JS” Compatible: Works flawlessly with WP Rocket, LiteSpeed Cache, W3 Total Cache, WP Fastest Cache, SiteGround Optimizer, Varnish, and Cloudflare. Automatically flushes major caches upon activation.
Triple-Layer GDPR Log Security: Stored in /wp-content/uploads/sygy-security-logs/ and shielded via Apache .htaccess (Require all denied), index.php, and a 16-character cryptographic random filename hash (protecting Nginx servers as well).
10 MB Auto-Rotation (DDoS Safe) & 512 KB Tail Reader: Automatically rotates the log file at 10 MB to prevent disk exhaustion during massive botnet attacks, and uses fseek() to read the last 512 KB without ever exhausting PHP RAM.
