Init Void Shield – Zero-DB, Honeypot, Anti-Spam

Init Void Shield protects WordPress comment forms, the default login/registration/lost-password forms, and popular form plugins with a layered honeypot defense that requires no database tables, no external JavaScript, and no user friction.

This plugin is part of the Init Plugin Suite — a collection of minimalist, fast, and developer-focused tools for WordPress.

GitHub repository: https://github.com/brokensmile2103/init-void-shield

Core honeypot engine (always on for comments):

1. Dynamic field names — derived from context + site salt (plus an optional custom prefix) so bots cannot hardcode field names.
2. CSS-clipped honeypots — a text field and a checkbox hidden with rotating CSS techniques (never display:none or visibility:hidden, the two patterns CSS-aware bots specifically look for and skip) that bots fill but humans never see. The text field is also marked readonly, so browser and password-manager autofill (Chrome, saved-password prompts, and similar) never writes into it either — bots that scrape the raw HTML or drive a headless browser still fall for it exactly the same.
3. Signed time tokens — each form carries a timestamp + HMAC hash verified server-side with hash_equals() to prevent timing attacks. Submissions under the minimum threshold are rejected; login/registration/other account-style forms use their own, shorter threshold by default (see Account Forms Minimum Submit Time), since a browser autofilling saved credentials lets a genuine visitor submit faster than someone typing a comment from scratch.
4. JavaScript + headless-browser verification — a hidden token is injected after a configurable delay (plus a small random jitter, so the exact wait can’t be read from the page source and timed around), and the script flags common automation signals (navigator.webdriver, a zero-size browser window) picked up from real Selenium/Puppeteer/Playwright sessions. Static crawlers, instant bots, and unmasked headless browsers all get caught; real users don’t.
5. Non-browser User-Agent detection — rejects submissions whose User-Agent identifies a scripted HTTP client (curl, Python requests, Go, Scrapy, and similar) rather than a real browser, catching bots that skip JavaScript entirely and simply replay the static form fields. On by default; the signature list is filterable.
6. Block REST API Comments (optional) — rejects comments posted directly through the wp/v2/comments REST endpoint, which the classic form-based layers cannot cover since those requests never carry the honeypot fields or tokens.
7. Require Same-Site Referer (optional) — rejects a comment submission whose Referer header is missing or points elsewhere, catching bots that post directly to the comment endpoint. Off by default and disclosed as a trade-off, since some privacy-focused browsers strip Referer even on genuine same-site submissions.

Key design goals:

• No database clutter (zero tables, zero rows; stats use a single non-autoloaded option)
• No external JS/CDN calls
• No CAPTCHA, no puzzles, no user interruption
• Logged-in users are bypassed automatically on the comment form (optional override in settings)
• Every guard beyond the core comment form is opt-in — nothing new is silently turned on when you update
• Bots receive HTTP 200 OK on the comment form so they think they succeeded and move on

Filters

A short reference of the developer filters shipped with the plugin (all are standard WordPress filters, added with add_filter()):

• init_plugin_suite_void_shield_skip_verification — skip comment-form verification for a request.
• init_plugin_suite_void_shield_skip_login_verification / _register_verification / _lostpassword_verification / _multisite_signup_verification — force-disable an individual WordPress Core Forms guard, overriding its settings-page toggle.
• init_plugin_suite_void_shield_login_scope_exempt — override the Referer-based heuristic used by the “wp-login.php only” Login Guard Scope.
• init_plugin_suite_void_shield_honeypot_html — filter the rendered honeypot HTML block; receives the context string as a second argument.
• init_plugin_suite_void_shield_kill_response_message / _title / _code — customize the soft-kill response shown to bots on the comment form.
• init_plugin_suite_void_shield_min_time / _max_time / _js_delay — override the Minimum Submit Time, Maximum Token Age, and JS Token Delay thresholds.
• init_plugin_suite_void_shield_hidden_style_variants — customize the pool of CSS techniques used to hide honeypot fields.
• init_plugin_suite_void_shield_{context}_blocked_message — customize the rejection message for a given guard (e.g. ..._login_blocked_message, ..._woocommerce_blocked_message, ..._bbpress_blocked_message).
• init_plugin_suite_void_shield_blocked_user_agent_signatures — customize the list of non-browser User-Agent substrings checked by Block Non-Browser User Agents.
• init_plugin_suite_void_shield_js_delay_jitter_max — override the maximum random jitter (milliseconds) added on top of the JavaScript Token Delay.
• init_plugin_suite_void_shield_min_interaction_delay — override the minimum time (milliseconds) that must pass before a Require Real User Interaction event is accepted.
• init_plugin_suite_void_shield_referer_exempt — force-exempt a request from the Require Same-Site Referer check regardless of its settings-page toggle.

License

This plugin is licensed under the GPLv2 or later.