Shield.

The pitch

Everything Shield does

No CAPTCHAs, no third-party API keys, no monthly fee. Shield stops spam with layered, self-hosted defenses — and every layer is documented in the chapters below.

Chapter 1

Defense in depth: one class per layer

Spam isn't one problem — it's bots, scrapers, brute-forcers and keyword flooders, each needing a different counter. So Shield's architecture maps one class to one defense: Honeypot, Rate_Limiter, Ip_Blocker, Keyword_Filter — and one class per surface: Comments, Login, Registration, CF7. A Logger records every catch.

The order matters and it's a performance story: the IP blocklist runs first (cheapest check, ends the request immediately), then rate limits, then the honeypot, then keywords (most expensive, runs last and least). Most spam dies at layer one without touching the database.

Chapter 2

Evidence tables: log everything you block

An antispam plugin that silently deletes things is a liability — you need an audit trail. Shield writes two tables: a spam log (every blocked attempt with IP, type, reason, page URL and user-agent) and a blocked-IPs table with optional expiry for temporary bans.

CREATE TABLE wp_aipt_shield_blocked_ips (
  id           bigint(20)  NOT NULL AUTO_INCREMENT,
  ip_address   varchar(45) NOT NULL,        -- 45 chars: IPv6-ready
  reason       varchar(200),
  blocked_at   datetime    NOT NULL,
  expires_at   datetime    DEFAULT NULL,    -- NULL = permanent
  auto_blocked tinyint(1)  NOT NULL DEFAULT 0,
  PRIMARY KEY  (id),
  UNIQUE KEY   ip_address (ip_address)
);

The UNIQUE key on the IP makes blocking idempotent, and the log table is indexed on IP, spam type and date — so the dashboard's trend chart and filters stay fast even after months of attacks. A retention setting auto-purges old log rows on a schedule.

Chapter 3

The honeypot: a trap only bots can see

The most effective antispam technique costs your human visitors nothing. Render a text field positioned 9,999 pixels off-screen, skipped by keyboard tab order, with a name that looks valuable to a bot scanning the DOM — website_url_confirm. Humans never see it. Bots fill it. Anything in that field is spam, full stop.

echo '<div style="position:absolute;left:-9999px;top:-9999px;" aria-hidden="true">';
echo '<label for="website_url_confirm">Leave this field empty</label>';
echo '<input type="text" name="website_url_confirm" value=""
       tabindex="-1" autocomplete="off">';
echo '<input type="hidden" name="aipt_hp_nonce" value="' . esc_attr( $nonce ) . '">';
echo '</div>';

The second input is the quiet hero: a WordPress nonce. Scrapers that copy your form once and replay it from a script submit a stale or missing nonce — caught, even when they're smart enough to leave the honeypot empty. Two traps, zero friction, no CAPTCHA squinting.

Chapter 4

Rate limits & the IP jail

Bots are impatient. Humans submit a comment form twice a minute at most; bots hit it twenty times. Shield counts attempts per IP in a WordPress transient that expires with the window — no cron, no cleanup, the cache does the housekeeping.

$count = intval( get_transient( $key ) ) + 1;
set_transient( $key, $count, $window );   // expires by itself

if ( $count > $max_attempts ) {
    $this->ip_blocker->maybe_auto_block( $ip );  // repeat offender → jail
    return true; // blocked
}

Cross the rate limit often enough and the escalation kicks in: after a configurable number of total offences, the IP is automatically written to the blocklist — with an optional expiry so a shared library IP isn't banned forever. From then on, that visitor is rejected at layer one for the cost of a single indexed lookup.

Chapter 5

The keyword filter: strings, regex and Cyrillic floods

Some spam sails past behavioral traps because it's submitted by humans paid to type it. That's what content filtering is for. Shield's keyword list accepts plain strings (casino, buy followers) and — the power feature — full regular expressions, one per line.

/[\x{0400}-\x{04FF}]/u    ← matches any Cyrillic character

casino
buy followers
shorturl.fm

If your audience is English-speaking and your comment section drowns in Russian-language spam (a depressingly common pattern), that one line stops all of it. The filter checks the comment body, author name, email and URL — and every match is logged with the exact keyword that triggered it, so you can audit for false positives.

Chapter 6

Four surfaces, one pipeline

Each protected surface is a thin adapter that feeds the same defense pipeline:

1. Comments hook pre_comment_approved — spam is rejected before WordPress even writes it to the moderation queue, keeping wp_comments clean.
2. Login hooks authenticate — rate limiting turns brute-force attacks into a slow drip, and repeat offenders land in the IP jail.
3. Registration hooks registration_errors — honeypot plus rate limit stops fake-account farms cold.
4. Contact Form 7 — the honeypot auto-injects into every CF7 form, or place it yourself with the [aipt_honeypot] form tag. Validation hooks into CF7's own spam-check filter, so it cooperates instead of fighting.

Chapter 7

The war-room dashboard

Blocking spam invisibly breeds doubt — is it even working? Shield's dashboard answers with numbers: blocked today, blocked total, a Chart.js trend line of attacks over time, and the full evidence log with the IP, surface, trigger reason, page and user-agent for every catch.

Next to it sits the comment scanner: a bulk-action table for your existing comment queue, with select-all, per-status filters and a satisfying "nuke by status" for clearing thousands of old pending-spam comments in one click. IP management lives on its own screen — block manually, unblock, see what was auto-blocked and why. Email alerts are optional for sites that want to know the moment an attack wave starts, and the whole interface ships in the suite's shared dark/light admin theme with the persisted toggle.

Chapter 8

Shipping it — including the scars

What actually bit us while building and rebranding Shield:

And the standing checklist: prepared statements on every query, nonces and capability checks on every admin action, escaped output, translation-ready strings, and an uninstall routine that cleans up — gated so an upgrade swap can't destroy a user's evidence log.

Make it yours

Rebrand it. Seriously, we encourage it.

Educational means take it, rename it, ship it. The rename map for Shield — change these consistently and nothing breaks: