{"id":348379,"date":"2026-08-22T07:02:49","date_gmt":"2026-08-22T07:02:49","guid":{"rendered":"https:\/\/wordpress.org\/plugins\/init-void-shield\/"},"modified":"2026-08-24T05:00:48","modified_gmt":"2026-08-24T05:00:48","slug":"init-void-shield","status":"publish","type":"plugin","link":"https:\/\/cs.wordpress.org\/plugins\/init-void-shield\/","author":14479633,"comment_status":"closed","ping_status":"closed","template":"","meta":{"version":"1.3","stable_tag":"1.3","tested":"7.1","requires":"5.7","requires_php":"7.4","requires_plugins":null,"header_name":"Init Void Shield","header_author":"Init HTML","header_description":"Zero-DB, zero-external-JS honeypot anti-spam for WordPress comments. Invisible to humans, a void to bots.","assets_banners_color":"222222","last_updated":"2026-08-24 05:00:48","external_support_url":"","external_repository_url":"","donate_link":"","header_plugin_uri":"https:\/\/inithtml.com\/plugin\/init-void-shield\/","header_author_uri":"https:\/\/inithtml.com\/","rating":0,"author_block_rating":0,"active_installs":0,"downloads":196,"num_ratings":0,"support_threads":0,"support_threads_resolved":0,"author_block_count":0,"sections":["description","installation","faq","changelog"],"tags":{"1.1":{"tag":"1.1","author":"brokensmile.2103","date":"2026-08-22 16:38:48"},"1.2":{"tag":"1.2","author":"brokensmile.2103","date":"2026-08-23 06:51:43"},"1.3":{"tag":"1.3","author":"brokensmile.2103","date":"2026-08-24 05:00:48"}},"upgrade_notice":[],"ratings":[],"assets_icons":{"icon-128x128.png":{"filename":"icon-128x128.png","revision":3660085,"resolution":"128x128","location":"assets","locale":"","width":128,"height":128},"icon-256x256.png":{"filename":"icon-256x256.png","revision":3660085,"resolution":"256x256","location":"assets","locale":"","width":256,"height":256}},"assets_banners":{"banner-1544x500.png":{"filename":"banner-1544x500.png","revision":3660085,"resolution":"1544x500","location":"assets","locale":"","width":1544,"height":500},"banner-772x250.png":{"filename":"banner-772x250.png","revision":3660085,"resolution":"772x250","location":"assets","locale":"","width":772,"height":250}},"assets_blueprints":{},"all_blocks":[],"tagged_versions":["1.1","1.2","1.3"],"block_files":[],"assets_screenshots":{"screenshot-1.png":{"filename":"screenshot-1.png","revision":3661467,"resolution":"1","location":"assets","locale":"","width":1346,"height":1605}},"screenshots":{"1":"Settings page"}},"plugin_section":[],"plugin_tags":[109,107,598,4902,599],"plugin_category":[44,54],"plugin_contributors":[242666],"plugin_business_model":[],"class_list":["post-348379","plugin","type-plugin","status-publish","hentry","plugin_tags-antispam","plugin_tags-comments","plugin_tags-honeypot","plugin_tags-no-captcha","plugin_tags-spam","plugin_category-discussion-and-community","plugin_category-security-and-spam-protection","plugin_contributors-brokensmile2103-1","plugin_committers-brokensmile2103-1"],"banners":{"banner":"https:\/\/ps.w.org\/init-void-shield\/assets\/banner-772x250.png?rev=3660085","banner_2x":"https:\/\/ps.w.org\/init-void-shield\/assets\/banner-1544x500.png?rev=3660085","banner_rtl":false,"banner_2x_rtl":false},"icons":{"svg":false,"icon":"https:\/\/ps.w.org\/init-void-shield\/assets\/icon-128x128.png?rev=3660085","icon_2x":"https:\/\/ps.w.org\/init-void-shield\/assets\/icon-256x256.png?rev=3660085","generated":false},"screenshots":[{"src":"https:\/\/ps.w.org\/init-void-shield\/assets\/screenshot-1.png?rev=3661467","caption":"Settings page"}],"raw_content":"\n

Init Void Shield<\/strong> protects WordPress comment forms, the default login\/registration\/lost-password forms, and popular form plugins with a layered honeypot defense that requires no database tables, no external JavaScript, and no user friction.<\/p>\n\n

This plugin is part of the Init Plugin Suite<\/a> \u2014 a collection of minimalist, fast, and developer-focused tools for WordPress.<\/p>\n\n

GitHub repository: https:\/\/github.com\/brokensmile2103\/init-void-shield<\/a><\/p>\n\n

Core honeypot engine (always on for comments):<\/strong><\/p>\n\n

    \n
  1. Dynamic field names<\/strong> \u2014 derived from context + site salt (plus an optional custom prefix) so bots cannot hardcode field names.<\/li>\n
  2. CSS-clipped honeypots<\/strong> \u2014 a text field and a checkbox hidden with rotating CSS techniques (never display:none<\/code> or visibility:hidden<\/code>, the two patterns CSS-aware bots specifically look for and skip) that bots fill but humans never see.<\/li>\n
  3. Signed time tokens<\/strong> \u2014 each form carries a timestamp + HMAC hash verified server-side with hash_equals()<\/code> to prevent timing attacks. Submissions under the minimum threshold are rejected.<\/li>\n
  4. JavaScript + headless-browser verification<\/strong> \u2014 a hidden token is injected after a configurable delay, and the script flags common automation signals (navigator.webdriver<\/code>, a zero-size browser window) picked up from real Selenium\/Puppeteer\/Playwright sessions. Static crawlers, instant bots, and unmasked headless browsers all get caught; real users don't.<\/li>\n
  5. Block REST API Comments<\/strong> (optional)<\/em> \u2014 rejects comments posted directly through the wp\/v2\/comments<\/code> REST endpoint, which the classic form-based layers cannot cover since those requests never carry the honeypot fields or tokens.<\/li>\n<\/ol>\n\n

    New in 1.2 \u2014 optional, opt-in guards you can turn on individually:<\/strong><\/p>\n\n

      \n
    • WordPress core forms<\/strong> \u2014 the same honeypot engine can guard the default login, registration, and lost-password forms at wp-login.php<\/code>.<\/li>\n
    • Form plugin integrations<\/strong> \u2014 Contact Form 7, WPForms, and Gravity Forms each get a one-click toggle; the guard only activates if the corresponding plugin is actually installed and active.<\/li>\n
    • Custom field prefix<\/strong> \u2014 change the honeypot field-name prefix if you suspect a spammer has targeted your site specifically.<\/li>\n
    • CSS trap rotation<\/strong> \u2014 randomizes which hiding technique and field order is used on every render, so bots can't learn one fixed pattern.<\/li>\n
    • Lightweight statistics<\/strong> \u2014 optional counters of blocked submissions by channel and reason, stored in a single non-autoloaded option (no per-submission logs, no personal data).<\/li>\n<\/ul>\n\n

      Key design goals:<\/strong><\/p>\n\n

        \n
      • No database clutter (zero tables, zero rows; stats use a single non-autoloaded option)<\/li>\n
      • No external JS\/CDN calls<\/li>\n
      • No CAPTCHA, no puzzles, no user interruption<\/li>\n
      • Logged-in users are bypassed automatically on the comment form (optional override in settings)<\/li>\n
      • Every guard beyond the core comment form is opt-in \u2014 nothing new is silently turned on when you update<\/li>\n
      • Bots receive HTTP 200 OK on the comment form so they think they succeeded and move on<\/li>\n<\/ul>\n\n

        License<\/h3>\n\n

        This plugin is licensed under the GPLv2 or later.<\/p>\n\n\n

          \n
        1. Upload the plugin folder to \/wp-content\/plugins\/<\/code><\/li>\n
        2. Activate via Plugins \u2192 Init Void Shield<\/strong><\/li>\n
        3. Go to Settings \u2192 Init Void Shield<\/strong> to review or adjust thresholds, and to opt in to the WordPress core form guards or any form plugin integrations you use<\/li>\n<\/ol>\n\n\n
          \n

          Does this work with page builders or custom comment forms?<\/h3><\/dt>\n

          The plugin hooks into comment_form_after_fields<\/code>. If your theme uses a custom form, you may need to adjust the hook or manually call the render function.<\/p><\/dd>\n

          Can I use this alongside Akismet or other anti-spam plugins?<\/h3><\/dt>\n

          Yes. Init Void Shield acts as the first line of defense. Other plugins can serve as a secondary layer.<\/p><\/dd>\n

          Will this block legitimate users?<\/h3><\/dt>\n

          No. Logged-in users are bypassed by default on the comment form. Guests only need to wait a few seconds between page load and submit \u2014 something every human naturally does.<\/p><\/dd>\n

          Can I force verification for logged-in users too?<\/h3><\/dt>\n

          Yes. Enable Apply to Logged-in Users<\/strong> in the settings if your site has open registration or untrusted members.<\/p><\/dd>\n

          Does this protect comments submitted through the REST API?<\/h3><\/dt>\n

          Not by default. The core layers only run on the classic comment form (preprocess_comment<\/code>); comments posted directly to wp\/v2\/comments<\/code> never carry a honeypot or JS token, so those checks don't apply. The optional \"Block REST API Comments\" setting is available to close that endpoint entirely if you do not use a headless app or other legitimate REST client for comments.<\/p><\/dd>\n

          Are the WordPress login\/registration\/lost-password guards enabled by default?<\/h3><\/dt>\n

          No, all three are off by default since they guard authentication itself. Turn them on individually under WordPress Core Forms<\/strong> in the settings, and confirm your own login flow still works afterward. Each covers WordPress's own default form markup at wp-login.php<\/code>, and the login guard also covers wp_login_form()<\/code> when used on the front end (e.g. a widget or theme template). A custom login page\/plugin, or Multisite's wp-signup.php<\/code> registration flow, renders different markup and isn't covered. Each guard can also be force-disabled per request with a dedicated filter (init_plugin_suite_void_shield_skip_login_verification<\/code>, ..._skip_register_verification<\/code>, ..._skip_lostpassword_verification<\/code>), which takes priority over the settings-page toggle.<\/p><\/dd>\n

          Are the Contact Form 7 \/ WPForms \/ Gravity Forms integrations enabled by default?<\/h3><\/dt>\n

          No. Each is off by default and only takes effect if the matching plugin is active \u2014 the settings page shows a \"detected \/ not detected\" status next to each toggle.<\/p><\/dd>\n

          Can I change the honeypot field names?<\/h3><\/dt>\n

          Yes. Set a Custom Field Prefix<\/strong> under Advanced Protection. Field names are still dynamically derived per context and site salt on top of that prefix.<\/p><\/dd>\n

          Does the headless-browser detection call any external service?<\/h3><\/dt>\n

          No. It only reads navigator.webdriver<\/code> and the browser window size on the visitor's own device \u2014 no external requests, no tracking.<\/p><\/dd>\n

          What does the statistics feature store?<\/h3><\/dt>\n

          Only aggregate counters (a total, a breakdown by channel, a breakdown by block reason, and a last-blocked timestamp) in one non-autoloaded option. No per-submission logs, IP addresses, or personal data are recorded. It can be turned off or reset from the settings page at any time.<\/p><\/dd>\n

          Can developers customize the behavior?<\/h3><\/dt>\n

          Yes. A comprehensive filter API is available. See the documentation on GitHub.<\/p><\/dd>\n\n<\/dl>\n\n\n

          1.3 \u2013 August 24, 2026<\/h4>\n\n
            \n
          • Fixed: the login guard now also covers wp_login_form()<\/code> (used to place a login form anywhere on the front end, e.g. a widget or theme template). Previously only the native wp-login.php form was guarded; a front-end wp_login_form()<\/code> submission carried no honeypot fields and was always rejected with \"Invalid login attempt.\" once the login guard was enabled.<\/li>\n
          • Added three developer filters \u2014 init_plugin_suite_void_shield_skip_login_verification<\/code>, init_plugin_suite_void_shield_skip_register_verification<\/code>, and init_plugin_suite_void_shield_skip_lostpassword_verification<\/code> \u2014 to force-disable each WordPress Core Forms guard for a given request regardless of its settings-page toggle.<\/li>\n<\/ul>\n\n

            1.2 \u2013 August 23, 2026<\/h4>\n\n
              \n
            • Added optional honeypot guards for the default WordPress login, registration, and lost-password forms (each off by default; enable individually under WordPress Core Forms).<\/li>\n
            • Added optional honeypot integrations for Contact Form 7, WPForms, and Gravity Forms (each off by default; only activates if the corresponding plugin is active).<\/li>\n
            • Added a custom honeypot field-name prefix setting under Advanced Protection.<\/li>\n
            • Added CSS trap rotation: the inline hiding technique and trap field order are now randomized per render to make pattern-learning harder for CSS-aware bots.<\/li>\n
            • Added lightweight, opt-out statistics (total\/by-channel\/by-reason blocked-submission counters) stored in a single option with autoload explicitly disabled, plus a reset action on the settings page.<\/li>\n
            • Added client-side headless-browser detection (navigator.webdriver<\/code>, zero-size window) layered on top of the existing JS token check; no external calls.<\/li>\n
            • Refactored the honeypot engine into a shared internal module reused by the comment form, the WP core form guards, and all three form-plugin integrations.<\/li>\n
            • Fixed a duplicate \"Settings saved.\" admin notice on the settings page (WordPress core already prints this automatically for pages under the Settings menu; the plugin no longer prints it a second time).<\/li>\n
            • Changed: the init_plugin_suite_void_shield_honeypot_html<\/code> filter's second parameter is now the generic guard context string (e.g. comment_123<\/code>, login<\/code>, cf7_4<\/code>) instead of only a numeric comment post ID.<\/li>\n<\/ul>\n\n

              1.1 \u2013 August 13, 2026<\/h4>\n\n
                \n
              • Added an optional Layer 5: \"Block REST API Comments\" setting to reject comments posted directly through the wp\/v2\/comments<\/code> REST endpoint, which the classic 4-layer honeypot cannot cover since it never sees those requests.<\/li>\n
              • Removed the legacy pre-5.7 inline script fallback; the plugin now always uses wp_get_inline_script_tag()<\/code>, matching the existing \"Requires at least: 5.7\" requirement.<\/li>\n<\/ul>\n\n

                1.0 \u2013 July 30, 2026<\/h4>\n\n
                  \n
                • Initial release<\/li>\n
                • 4-layer honeypot: dynamic fields, CSS-clipped traps, signed time tokens, JS verification<\/li>\n
                • Settings page: enable\/disable, apply to logged-in users, min submit time, JS delay<\/li>\n
                • Full filter API for developers<\/li>\n
                • Zero database footprint<\/li>\n
                • Soft-kill with HTTP 200 to deceive bots<\/li>\n<\/ul>","raw_excerpt":"Zero-DB, zero-external-JS honeypot anti-spam for WordPress comments, core forms, and popular form plugins. Invisible to humans, a void to bots.","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/cs.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin\/348379","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cs.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin"}],"about":[{"href":"https:\/\/cs.wordpress.org\/plugins\/wp-json\/wp\/v2\/types\/plugin"}],"replies":[{"embeddable":true,"href":"https:\/\/cs.wordpress.org\/plugins\/wp-json\/wp\/v2\/comments?post=348379"}],"author":[{"embeddable":true,"href":"https:\/\/cs.wordpress.org\/plugins\/wp-json\/wporg\/v1\/users\/brokensmile2103-1"}],"wp:attachment":[{"href":"https:\/\/cs.wordpress.org\/plugins\/wp-json\/wp\/v2\/media?parent=348379"}],"wp:term":[{"taxonomy":"plugin_section","embeddable":true,"href":"https:\/\/cs.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_section?post=348379"},{"taxonomy":"plugin_tags","embeddable":true,"href":"https:\/\/cs.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_tags?post=348379"},{"taxonomy":"plugin_category","embeddable":true,"href":"https:\/\/cs.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_category?post=348379"},{"taxonomy":"plugin_contributors","embeddable":true,"href":"https:\/\/cs.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_contributors?post=348379"},{"taxonomy":"plugin_business_model","embeddable":true,"href":"https:\/\/cs.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_business_model?post=348379"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}