Init Void Shield – Zero-DB, Honeypot, Anti-Spam

Nejčastější dotazy

Does this work with page builders or custom comment forms?

The plugin hooks into comment_form_after_fields. If your theme uses a custom form, you may need to adjust the hook or manually call the render function.

Can I use this alongside Akismet or other anti-spam plugins?

Yes. Init Void Shield acts as the first line of defense. Other plugins can serve as a secondary layer.

Will this block legitimate users?

No. Logged-in users are bypassed by default on the comment form. Guests only need to wait a few seconds between page load and submit — something every human naturally does.

Can I force verification for logged-in users too?

Yes. Enable Apply to Logged-in Users in the settings if your site has open registration or untrusted members.

Does this protect comments submitted through the REST API?

Not by default. The core layers only run on the classic comment form (preprocess_comment); comments posted directly to wp/v2/comments never carry a honeypot or JS token, so those checks don’t apply. The optional „Block REST API Comments“ setting is available to close that endpoint entirely if you do not use a headless app or other legitimate REST client for comments.

Are the WordPress login/registration/lost-password guards enabled by default?

No, all three are off by default since they guard authentication itself. Turn them on individually under WordPress Core Forms in the settings, and confirm your own login flow still works afterward. Each covers WordPress’s own default form markup at wp-login.php, and the login guard also covers wp_login_form() when used on the front end (e.g. a widget or theme template). A custom login page/plugin, or Multisite’s wp-signup.php registration flow, renders different markup and isn’t covered. Each guard can also be force-disabled per request with a dedicated filter (init_plugin_suite_void_shield_skip_login_verification, ..._skip_register_verification, ..._skip_lostpassword_verification), which takes priority over the settings-page toggle.

Are the Contact Form 7 / WPForms / Gravity Forms integrations enabled by default?

No. Each is off by default and only takes effect if the matching plugin is active — the settings page shows a „detected / not detected“ status next to each toggle.

Can I change the honeypot field names?

Yes. Set a Custom Field Prefix under Advanced Protection. Field names are still dynamically derived per context and site salt on top of that prefix.

Does the headless-browser detection call any external service?

No. It only reads navigator.webdriver and the browser window size on the visitor’s own device — no external requests, no tracking.

What does the statistics feature store?

Only aggregate counters (a total, a breakdown by channel, a breakdown by block reason, and a last-blocked timestamp) in one non-autoloaded option. No per-submission logs, IP addresses, or personal data are recorded. It can be turned off or reset from the settings page at any time.

Can developers customize the behavior?

Yes. A comprehensive filter API is available. See the documentation on GitHub.