Zero-DB, zero-external-JS honeypot anti-spam for WordPress comments, core forms, and popular form plugins. Invisible to humans, a void to bots.

Init Void Shield – Zero-DB, Honeypot, Anti-Spam

Init Void Shield protects WordPress comment forms, the default login/registration/lost-password forms, and popular form plugins with a layered honeypot defense that requires no database tables, no external JavaScript, and no user friction.
This plugin is part of the <a href="https://en.inithtml.com/init-plugin-suite-minimalist-powerful-and-free-wordpress-plugins/" rel="nofollow ugc">Init Plugin Suite</a> — a collection of minimalist, fast, and developer-focused tools for WordPress.
GitHub repository: <a href="https://github.com/brokensmile2103/init-void-shield" rel="nofollow ugc">https://github.com/brokensmile2103/init-void-shield</a>
Core honeypot engine (always on for comments):
<ol>
<li>Dynamic field names — derived from context + site salt (plus an optional custom prefix) so bots cannot hardcode field names.</li>
<li>CSS-clipped honeypots — a text field and a checkbox hidden with rotating CSS techniques (never <code>display:none</code> or <code>visibility:hidden</code>, the two patterns CSS-aware bots specifically look for and skip) that bots fill but humans never see.</li>
<li>Signed time tokens — each form carries a timestamp + HMAC hash verified server-side with <code>hash_equals()</code> to prevent timing attacks. Submissions under the minimum threshold are rejected.</li>
<li>JavaScript + headless-browser verification — a hidden token is injected after a configurable delay, and the script flags common automation signals (<code>navigator.webdriver</code>, a zero-size browser window) picked up from real Selenium/Puppeteer/Playwright sessions. Static crawlers, instant bots, and unmasked headless browsers all get caught; real users don&#8217;t.</li>
<li>Block REST API Comments (optional) — rejects comments posted directly through the <code>wp/v2/comments</code> REST endpoint, which the classic form-based layers cannot cover since those requests never carry the honeypot fields or tokens.</li>
</ol>
New in 1.2 — optional, opt-in guards you can turn on individually:
<ul>
<li>WordPress core forms — the same honeypot engine can guard the default login, registration, and lost-password forms at <code>wp-login.php</code>.</li>
<li>Form plugin integrations — Contact Form 7, WPForms, and Gravity Forms each get a one-click toggle; the guard only activates if the corresponding plugin is actually installed and active.</li>
<li>Custom field prefix — change the honeypot field-name prefix if you suspect a spammer has targeted your site specifically.</li>
<li>CSS trap rotation — randomizes which hiding technique and field order is used on every render, so bots can&#8217;t learn one fixed pattern.</li>
<li>Lightweight statistics — optional counters of blocked submissions by channel and reason, stored in a single non-autoloaded option (no per-submission logs, no personal data).</li>
</ul>
Key design goals:
<ul>
<li>No database clutter (zero tables, zero rows; stats use a single non-autoloaded option)</li>
<li>No external JS/CDN calls</li>
<li>No CAPTCHA, no puzzles, no user interruption</li>
<li>Logged-in users are bypassed automatically on the comment form (optional override in settings)</li>
<li>Every guard beyond the core comment form is opt-in — nothing new is silently turned on when you update</li>
<li>Bots receive HTTP 200 OK on the comment form so they think they succeeded and move on</li>
</ul>
<h3>License</h3>
This plugin is licensed under the GPLv2 or later.

Alternative Plugins for

Discover the Lists with Init Void Shield – Zero-DB, Honeypot, Anti-Spam