Protection against bots during registration - plugin for the "Site" application

What types of registrations does plugin "Protection against bots during registration" block.

Plugin intercepts registration form submissions and checks the visitor against several criteria. Registration is blocked if at least one of them is met. Each blocked attempt is logged with the date, IP address, reason for blocking, and the URL of the page where it occurred.

Plugin prevents:

• mass automated registrations with fake accounts;
• spam bots sending news on behalf of new users;
• brute-force and guessing attempts via the form;
• server load caused by automated requests.

Protection technologies.

Plugin uses four independent verification methods. They can be enabled and configured separately in plugins settings, so you can use all of them together or only the ones you need.

Honeypot field.

A hidden field is added to the form, invisible to humans. A regular visitor does not see it and leaves it empty. Automated programs often fill all form fields sequentially, including hidden ones. If the honeypot field is filled, plugin treats the registration as a bot action and blocks it. This method requires no user interaction and is invisible on the page.

Time check.

Plugin records the moment the form is opened and the moment it is submitted. A human needs at least 10 seconds to read the fields and enter data, while a bot submits the form almost instantly. If the form is filled faster than the set minimum time, the attempt is blocked. The interval is configurable in plugins settings.

JavaScript check.

Before form submission, a verification JavaScript code runs in the visitor's browser. A real browser executes it automatically and returns the result within milliseconds. Automated programs that do not run a full browser cannot execute this code, so their attempts are blocked. The check is completely invisible to humans.

Computational task (Proof-of-Work).

The visitor's browser is given a small computational task: find a value matching a given condition (hash search). For a single person, solving it takes a fraction of a second and is imperceptible. But for a program trying to send thousands of forms in a row, each submission requires additional calculations, making mass attacks impractical. The task difficulty level is configurable.

Why is captcha no longer needed?

Captchas increasingly let bots through, not to mention that many visitors dislike solving distorted text and images and abandon registration. Plugin checks visitors in the background, and the user does not need to perform any additional actions. The form remains as short and simple as without protection.

Tested on a real website!

Plugin was tested on a live website without captcha. The test confirmed the effectiveness of protection: automated registrations were blocked immediately after installing plugins, while the registration process for regular visitors remained unchanged.

Before installing plugins:

After installing plugins:

Who is plugin for?

• online stores and sites with user accounts;
• portals and services where users register;
• sites already receiving spam registrations;
• site owners who do not want to install captcha because it is inconvenient.

Main advantages.

• No captcha. Customers register quickly and do not need to solve puzzles.
• Four levels of protection. Independent methods work together and complement each other.
• Block log. All attempts are recorded with IP address, reason, and page, making analysis easier.
• Flexible settings. Each method can be enabled separately; fill time and task difficulty are configurable.
• Invisible to users. All checks run in a fraction of a second without human involvement.
• Compatibility. Works with registration forms of "Site", "Shopy-Script", "Blog", "Hub", "Photos", WCMS, and "Register form" apps.