DEV Community

Cover image for Init Void Shield – Zero-DB, Honeypot, Anti-Spam for WordPress
Hao Nguyen
Hao Nguyen

Posted on

Init Void Shield – Zero-DB, Honeypot, Anti-Spam for WordPress

#wordpress #plugin #antispam #honeypot

Init Void Shield is a lightweight, zero-database honeypot anti-spam plugin for WordPress comments, core forms, WooCommerce, bbPress, BuddyPress, Contact Form 7, WPForms, Gravity Forms, and more.

No CAPTCHA. No external JavaScript. No database tables. No user friction.

It uses layered, context-bound honeypot protection, signed time tokens, delayed browser verification, headless-browser detection, non-browser User-Agent detection, and cross-site submission blocking to stop automated submissions while keeping the experience invisible to real users.

Why Init Void Shield?

Spam protection often comes with a trade-off: either annoy real users with CAPTCHA challenges or add another heavy plugin full of JavaScript, tracking, external services, and database records.

Init Void Shield takes a different approach.

The core comment guard is always enabled and requires no configuration to start protecting a site. Additional guards are explicitly opt-in, so enabling a new feature in a plugin update never silently changes which forms are protected.

The plugin is designed to be:

  • Invisible to humans — no CAPTCHA, puzzles, or extra UI
  • A void to bots — honeypots, signed tokens, browser verification, and behavioral checks
  • Zero-DB — no custom tables and no per-submission logs
  • Cache-aware — optional Lazy Fetch refreshes tokens on genuinely loaded pages
  • Developer-friendly — a full filter API lets you customize almost every layer

It's part of the Init Plugin Suite and follows the same minimalist, performance-first philosophy.

Features at a Glance

Layered Honeypot Protection

  • Dynamic honeypot field names derived from context and site salt
  • Optional custom field-name prefix
  • CSS-clipped text and checkbox traps instead of display:none or visibility:hidden
  • Rotating CSS hiding techniques and trap field order
  • Signed, context-bound, self-expiring time tokens
  • HMAC verification with hash_equals() to prevent timing attacks
  • Per-form signed JavaScript proofs
  • Configurable JavaScript delay with random jitter
  • Headless-browser detection for common automation signals
  • Selenium / ChromeDriver automation marker detection
  • Non-browser User-Agent detection
  • Cross-site submission blocking via Sec-Fetch-Site

Human-Friendly UX

  • No CAPTCHA
  • No external JavaScript
  • No CDN dependencies
  • No additional fields visible to visitors
  • Logged-in users bypass comment verification by default
  • Submit Hold automatically waits for the guard when a real visitor submits too quickly, such as immediately after browser autofill

A genuine visitor is never asked to solve anything. The protection happens in the background.

WordPress Core Forms

Optional protection for:

  • Login
  • Registration
  • Lost Password
  • Multisite Signup

Each guard is independently configurable and disabled by default.

Form Plugin Integrations

One-click protection for:

  • Contact Form 7
  • WPForms
  • Gravity Forms

The integration activates only when the corresponding plugin is detected as active.

WooCommerce & Community Integrations

Optional protection for:

  • WooCommerce Registration
  • WooCommerce Login
  • WooCommerce Lost Password
  • bbPress New Topic
  • bbPress Reply
  • BuddyPress Registration

These integrations are also opt-in and automatically detect whether the target plugin is active.

Comment Content Filtering

Behavioral honeypot checks are not always enough. Init Void Shield also provides optional content-based rules that inspect what was actually submitted:

  • Maximum Links per Comment
  • Block BBCode Links
  • Block URLs in Author Name

These filters can catch spam even when the submission comes from a real browser or bypasses the normal honeypot flow.

Cache-Safe Protection

Aggressively cached WordPress sites can create a subtle problem: a timestamp generated when a page was cached is not the same as the time a real visitor loaded the page.

Lazy Fetch solves that by refreshing the time token and signed JavaScript proof through a small same-origin fetch() request after the page genuinely loads.

No jQuery. No external API. If the request fails, Init Void Shield falls back to the original token.

Lightweight Statistics

  • Blocked submission counter
  • Statistics by channel
  • Statistics by reason
  • No per-submission logging
  • No personal data storage
  • Stored as a single non-autoloaded WordPress option
  • Optional Dashboard widget

Core Defense Layers

Layer What it does
Dynamic Honeypots Generates context-specific hidden trap fields
CSS Trap Rotation Randomizes how honeypots are hidden and ordered
Signed Time Token Prevents instant submissions and token replay
Signed JS Proof Verifies the expected browser-side execution for that exact form
Headless Detection Detects common Selenium, Puppeteer, Playwright, and headless-browser signals
Non-Browser UA Detection Blocks scripted HTTP clients such as curl, Python requests, HTTPX, aiohttp, axios, and similar clients
Cross-Site Blocking Rejects submissions reported by the browser as Sec-Fetch-Site: cross-site
Real User Interaction Optionally requires mouse, keyboard, touch, or scroll activity
Same-Site Referer Optionally validates the Referer header on comment submissions
Content Filters Optionally blocks excessive links, BBCode links, and URLs in author names
REST API Guard Optionally blocks direct comment creation through wp/v2/comments
Submit Hold Temporarily holds early native submissions until the browser guard is ready
Soft Kill Returns HTTP 200 OK to comment bots so they believe the submission succeeded

How It Works

When a visitor opens a guarded form, Init Void Shield injects a set of protection values specific to that form.

A simplified flow looks like this:

Visitor loads form
       ↓
Dynamic honeypots generated
       ↓
Signed time token issued
       ↓
Delayed JS proof scheduled
       ↓
Browser loads and verifies itself
       ↓
Visitor fills and submits form
       ↓
Server validates all enabled gates
       ↓
   ┌───────────────┐
   │ Valid human?  │
   └───────┬───────┘
           │
      ┌────┴────┐
      │         │
     YES        NO
      │         │
   Accept     Reject
Enter fullscreen mode Exit fullscreen mode

On submission, the server can validate:

  1. The browser does not report the request as cross-site.
  2. The User-Agent does not identify a known scripted HTTP client.
  3. Honeypot fields remain empty.
  4. The signed JavaScript proof is present and matches the exact form and time token.
  5. No headless-browser or automation signal is reported.
  6. The time token is valid and bound to the form that issued it.
  7. The submission is not too fast.
  8. The token has not expired.
  9. Optional same-site Referer requirements are satisfied.
  10. Optional comment content rules pass.

If any enabled check fails, the submission is rejected.

For the core comment form, the response can intentionally remain HTTP 200 OK so automated spam software cannot easily distinguish a successful submission from a blocked one.

Core Modules

Module What it does
Comment Guard Always-on layered honeypot protection for WordPress comments
Core Form Guards Optional login, registration, lost-password, and Multisite signup protection
Form Integrations Contact Form 7, WPForms, and Gravity Forms
WooCommerce Guards Registration, login, and lost-password protection
Community Guards bbPress topics/replies and BuddyPress registration
Content Filters Link limits, BBCode link blocking, and URL detection in names
Headless Detection Detects browser automation signals without external services
User-Agent Blocking Rejects scripted HTTP clients
Cross-Site Protection Uses Sec-Fetch-Site to detect cross-site submissions
Lazy Fetch Refreshes tokens after real page load for cached environments
Submit Hold Prevents genuine early submissions from being rejected
Statistics Lightweight blocked-submission counters
Dashboard Widget Optional blocked-submission summary in wp-admin

Developer Hooks

Init Void Shield is designed for developers who want precise control without modifying plugin core files.

For example, you can bypass verification for a specific request:

add_filter( 'init_plugin_suite_void_shield_skip_verification', '__return_true' );
Enter fullscreen mode Exit fullscreen mode

Force-disable a specific WordPress core form guard:

add_filter( 'init_plugin_suite_void_shield_skip_login_verification', '__return_true' );
add_filter( 'init_plugin_suite_void_shield_skip_register_verification', '__return_true' );
add_filter( 'init_plugin_suite_void_shield_skip_lostpassword_verification', '__return_true' );
add_filter( 'init_plugin_suite_void_shield_skip_multisite_signup_verification', '__return_true' );
Enter fullscreen mode Exit fullscreen mode

Add your own comment content rule:

add_filter( 'init_plugin_suite_void_shield_comment_content_violation', function ( $reason, $commentdata ) {
    // Return a non-empty reason key to block the comment.
    // Return an empty string to allow it through.
    return $reason;
}, 10, 2 );
Enter fullscreen mode Exit fullscreen mode

Customize the honeypot markup:

add_filter( 'init_plugin_suite_void_shield_honeypot_html', function ( $html, $context ) {
    return $html;
}, 10, 2 );
Enter fullscreen mode Exit fullscreen mode

Customize the minimum submit time and token lifetime:

add_filter( 'init_plugin_suite_void_shield_min_time', function ( $seconds, $context ) {
    return 5;
}, 10, 2 );

add_filter( 'init_plugin_suite_void_shield_max_time', function ( $seconds, $context ) {
    return 7200;
}, 10, 2 );
Enter fullscreen mode Exit fullscreen mode

Customize the JavaScript delay:

add_filter( 'init_plugin_suite_void_shield_js_delay', function ( $milliseconds ) {
    return 1500;
} );
Enter fullscreen mode Exit fullscreen mode

Customize the random delay jitter:

add_filter( 'init_plugin_suite_void_shield_js_delay_jitter_max', function ( $milliseconds ) {
    return 600;
} );
Enter fullscreen mode Exit fullscreen mode

Add your own non-browser User-Agent signature:

add_filter( 'init_plugin_suite_void_shield_blocked_user_agent_signatures', function ( $signatures ) {
    $signatures[] = 'my-internal-test-client';

    return $signatures;
} );
Enter fullscreen mode Exit fullscreen mode

Force-exempt a request from cross-site submission blocking:

add_filter( 'init_plugin_suite_void_shield_cross_site_exempt', function ( $exempt, $context ) {
    return $exempt;
}, 10, 2 );
Enter fullscreen mode Exit fullscreen mode

Control Submit Hold for a custom guard context:

add_filter( 'init_plugin_suite_void_shield_submit_hold_enabled', function ( $enabled, $context ) {
    return $enabled;
}, 10, 2 );
Enter fullscreen mode Exit fullscreen mode

Customize how long Submit Hold waits for Lazy Fetch:

add_filter( 'init_plugin_suite_void_shield_submit_hold_fetch_wait', function ( $milliseconds, $context ) {
    return $milliseconds;
}, 10, 2 );
Enter fullscreen mode Exit fullscreen mode

The plugin also exposes filters for CSS trap variants, login scope exemptions, Referer checks, interaction timing, blocked messages, soft-kill response codes, and more.

Soft-Kill Responses

For comment spam, Init Void Shield can intentionally return a successful HTTP status instead of exposing an obvious block response.

add_filter( 'init_plugin_suite_void_shield_kill_response_message', function ( $msg ) {
    return 'Spam detected.';
} );

add_filter( 'init_plugin_suite_void_shield_kill_response_title', function ( $title ) {
    return 'Blocked';
} );

add_filter( 'init_plugin_suite_void_shield_kill_response_code', function ( $code ) {
    return 200;
} );
Enter fullscreen mode Exit fullscreen mode

The default response code is 200, which makes the request look successful from the perspective of a basic spam bot.

Cache-Safe Tokens

Full-page caching introduces a classic anti-spam problem.

Imagine a page containing a token generated at 10:00 AM, cached by the server, and served to visitors at 12:00 PM. The token may now represent the cache time rather than the actual browser session.

Init Void Shield's Lazy Fetch feature refreshes the time token and signed JavaScript proof immediately after the page genuinely loads.

Cached HTML
    ↓
Page loads in browser
    ↓
Same-origin fetch()
    ↓
Fresh signed token + JS proof
    ↓
Visitor submits
    ↓
Server validates fresh values
Enter fullscreen mode Exit fullscreen mode

The request uses plain JavaScript and has no dependency on jQuery.

This is particularly useful on sites using aggressive full-page caching or CDN caching.

Login Guard Scope

The Login Guard supports two modes:

Everywhere

Protect both:

wp-login.php
wp_login_form()
Enter fullscreen mode Exit fullscreen mode

wp-login.php only

Protect only the native WordPress login page while leaving front-end wp_login_form() usage untouched.

This is useful when a custom front-end login form lives on a page that may be served through full-page caching and should remain unguarded.

Where Data Lives

Init Void Shield is intentionally designed to keep its footprint close to zero.

  • No custom database tables
  • No per-submission records
  • No personal data stored for statistics
  • One non-autoloaded WordPress option for lightweight counters
  • No external anti-spam service
  • No external JavaScript or CDN dependency

That means less database clutter and less runtime overhead compared with systems that persist every blocked request.

Settings

Navigate to:

Settings → Init Void Shield
Enter fullscreen mode Exit fullscreen mode

The settings are grouped by protection layer.

Comments

Configure the core comment guard, logged-in user bypass, REST API protection, Referer validation, and optional content filters.

Timing & Token Engine

Tune:

  • Minimum Submit Time
  • Account Forms Minimum Submit Time
  • JavaScript Token Delay
  • Maximum Token Age

The separate account-form threshold is useful because browser autofill can allow legitimate login or registration submissions to happen much faster than a normal content form.

WordPress Core Forms

Enable protection individually for:

  • Login
  • Registration
  • Lost Password
  • Multisite Signup

Form Plugin Integrations

Enable guards for:

  • Contact Form 7
  • WPForms
  • Gravity Forms

Only detected active plugins are eligible.

Community & E-commerce Integrations

Enable guards for:

  • WooCommerce Registration
  • WooCommerce Login
  • WooCommerce Lost Password
  • bbPress Topics & Replies
  • BuddyPress Registration

Advanced Protection

Configure:

  • Custom Field Prefix
  • CSS Trap Rotation
  • Headless Browser Detection
  • Non-Browser User-Agent Blocking
  • Cross-Site Submission Blocking
  • Real User Interaction
  • Lazy Fetch

Statistics

Track blocked submissions by channel and reason using the lightweight non-autoloaded statistics option.

You can also enable the optional Dashboard widget.

Safe by Default

Init Void Shield follows an intentionally conservative activation model.

The comment guard is enabled by default.

Everything else is opt-in.

That means activating a new integration does not silently start modifying a login page, WooCommerce form, or community form simply because a supported plugin happens to be installed.

You decide which surfaces should be protected.

Upgrading to 1.11

Version 1.11 introduces a new signed, per-form JavaScript proof instead of relying on a fixed JS token value.

After upgrading, purge your page cache and CDN cache once.

A page still being served from a pre-1.11 cache contains the old script. Submissions from that stale HTML can fail with an Invalid JS proof reason until the cache is refreshed.

Version 1.11 also adds:

  • Submit Hold for early native submissions
  • Selenium / ChromeDriver automation detection
  • Extended non-browser User-Agent detection
  • Cross-site submission blocking
  • Comment content filters
  • WooCommerce Login protection
  • WooCommerce Lost Password protection
  • Signed per-form JS proofs

Installation

Install via WordPress.org or clone the repository:

git clone https://github.com/brokensmile2103/init-void-shield.git
Enter fullscreen mode Exit fullscreen mode

Then:

  1. Upload the plugin to /wp-content/plugins/ if installing manually
  2. Activate Init Void Shield
  3. Go to Settings → Init Void Shield
  4. Review the comment protection settings
  5. Enable any optional core form, form plugin, WooCommerce, bbPress, or BuddyPress guards you need

That's it.

Your WordPress comments are protected out of the box, while every additional guard stays under your control.

Part of the Init Plugin Suite

Init Void Shield is part of the Init Plugin Suite — a collection of minimalist, high-performance WordPress plugins built for developers and creators who care about speed, clean architecture, and practical UX.

No bloat. No unnecessary services. No CAPTCHA.

Just a quiet layer between your forms and automated spam.

Thanks for reading. Got feedback or questions?

→ Project Page
→ GitHub

Top comments (0)