Protection against bots during registration for Site app

Support for both UI 1.3 and 2.0 interfaces

The "Bot protection for registration" plugin works in both backend interfaces of the Site app and supports both the light and dark backend themes for UI 2.0.

The plugin protects your site's registration form from automated registrations. It analyzes visitor behavior and blocks bots before the form is submitted. Captcha is no longer needed: the plugin works invisibly and does not disturb real users.

What registrations the plugin blocks.

The plugin intercepts the submission of the registration form and checks the visitor by several criteria. Registration is blocked if at least one of them is triggered. Every blocked attempt is recorded in a log with the date, IP address, blocking reason, and the URL of the page where it occurred.

The plugin stops:

• bulk automated registrations with fake accounts;
• spam bots sending messages on behalf of new users;
• brute-force attempts and data guessing through the form;
• server load caused by automated requests.

Protection technologies.

The plugin uses four independent verification methods. They can be enabled and configured separately in the plugin settings, so you can use all of them at once or only the ones you need.

Honeypot (hidden trap field).

A field invisible to humans is added to the form. An ordinary visitor does not see it and leaves it empty. Automated programs often fill in all form fields in a row, including hidden ones. If the trap turns out to be filled, the plugin treats the registration as bot activity and blocks it. The method requires no user interaction and is invisible on the page.

Time-based check.

The plugin records the moment the form is opened and the moment it is submitted. A human needs at least 10 seconds to read the fields and enter data, while a bot submits the form almost instantly. If the form is filled faster than the minimum configured time, the attempt is blocked. The interval is set in the plugin settings.

JavaScript check.

Before the form is submitted, a verification code in JavaScript is executed in the visitor's browser. A real browser runs it automatically and returns the result within a few milliseconds. Automated programs that do not run a full browser cannot execute this code, so their attempts are blocked. The check is completely invisible to humans.

Proof-of-Work.

The visitor's browser is given a small computational task: to find a value that matches a given condition (hash search). For a single person, solving it takes a fraction of a second and is imperceptible. But for a program trying to submit thousands of forms in a row, each submission requires extra computation, making mass attacks impractical. The task difficulty level is configurable.

Why captcha is no longer needed?

Captchas are increasingly letting bots through these days, not to mention that many visitors do not want to solve distorted text and images and abandon registration. The plugin checks the visitor in the background, and the customer does not have to do a single extra action. The form stays just as short and simple as it would be without protection.

Tested on a real website!

The plugin has been tested on a live website without captcha. The test confirms the effectiveness of the protection: automated registrations are blocked immediately after the plugin is installed, while the registration process for regular visitors remains unchanged.

Before installing the plugin:

Fake registrations before installing the plugin

After installing the plugin:

Blocked registrations (plugin log)

Who is the plugin for?

• online stores and websites with customer accounts;
• portals and services where users register;
• websites that are already receiving spam registrations;
• owners who do not want to set up captcha because it is inconvenient.

Key benefits.

• No captcha. Customers register quickly and do not have to solve puzzles.
• Four levels of protection. Independent methods work together and cover each other.
• Blocking log. All attempts are saved with the IP address, reason, and page, making analysis easy.
• Flexible settings. Each method can be enabled separately; fill-in time and task difficulty are configurable.
• Invisible to users. All checks run in a fraction of a second without any human action.
• Compatibility. Works with registration forms of the "Site", "Shop-Script", "Blog", "Hub", "Photos", WCMS, and "Registration form" apps.

Frequently asked questions

The plugin has been tested and is fully compatible with PHP versions 7.4.33 - 8.3.30.