Init Void Shield – Zero-DB, Honeypot, Bot-Blocking

Init Void Shield protects your WordPress comment forms with a 4-layer honeypot defense that requires no database tables, no external JavaScript, and no user friction.

This plugin is part of the Init Plugin Suite — a collection of minimalist, fast, and developer-focused tools for WordPress.

How it works (4 layers):

1. Dynamic field names — derived from post ID + site salt so bots cannot hardcode field names.
2. CSS-clipped honeypots — a text field and a checkbox hidden via clip: rect() (not display:none) that bots fill but humans never see.
3. Signed time tokens — each form carries a timestamp + HMAC hash verified server-side with hash_equals() to prevent timing attacks. Submissions under the minimum threshold are rejected.
4. JavaScript verification — a hidden token is injected after a configurable delay. Static crawlers and instant headless browsers miss it; real users don’t.

Key design goals:

• No database clutter (zero tables, zero rows)
• No external JS/CDN calls
• No CAPTCHA, no puzzles, no user interruption
• Logged-in users are bypassed automatically (optional override in settings)
• Bots receive HTTP 200 OK so they think they succeeded and move on

License

This plugin is licensed under the GPLv2 or later.