SyGy Security Log & Anti-Bot

Proactive Anti-Bot shield for WP Comments, WooCommerce, CF7, WPForms, Elementor, wpForo, bbPress & BuddyPress with GDPR logging.

Stop Blind Bots at the Gate. Zero CAPTCHAs. Zero Database Bloat. 100% Cache Friendly.

Every day, WordPress websites are hammered by thousands of automated spam requests. Most of this traffic does not come from real browsers—it comes from “Blind Bots” (headless scripts, cURL botnets, and automated scrapers) that send direct POST requests to wp-comments-post.php, wp-login.php, wp-signup.php, contact forms, and forum endpoints, completely bypassing your frontend pages.

Traditional anti-spam plugins make a critical architectural mistake: they let the bot in first. They process the request, run heavy regular expressions, query external cloud APIs, and save the spam inside your MySQL database. Over time, this bloats your database, slows down queries, and wastes server CPU and RAM. Other plugins force your visitors to solve annoying CAPTCHAs or load heavy third-party JavaScript libraries that destroy your Core Web Vitals and PageSpeed score.

SyGy Security Log & Anti-Bot flips the paradigm with a Proactive Client-Side Cryptographic Behavioral Shield.

How It Works: Surgical Precision at Zero Server Cost

Instead of analyzing spam after it hits your database, SyGy Security Log & Anti-Bot verifies how the user interacts with your form:

1. Per-Site Cryptographic Split Token (HMAC-SHA256): A tiny, dependency-free inline JavaScript snippet dynamically assembles and injects a site-unique HMAC-SHA256 validation token into your forms upon page load (DOMContentLoaded) and real human interaction (focusin, pointerdown, submit).
2. Instant HTTP 403 Termination: When a request reaches your server without the behavioral token, the plugin verifies the signature via timing-safe hash_equals() and terminates bot execution immediately with an HTTP 403 Forbidden response.
3. Untouched Database: MySQL is never queried for spam storage, external APIs are never called, and legitimate human visitors never see a single CAPTCHA puzzle.

All-in-One Ecosystem Protection (10 Auto-Detecting Modules)

You don’t need five different anti-spam plugins. SyGy Security Log & Anti-Bot uses conditional loading to automatically protect the plugins you already use, with zero overhead for modules you don’t have installed:

• WordPress Native Comments: Full protection for standard themes and custom templates built with Elementor, Divi, Bricks, WPBakery, and Gutenberg blocks ([WP-COMMENTS]).
• WordPress Native User Registration: Protects both Single Site (wp-login.php?action=register) and Multisite (wp-signup.php) against automated fake account creation ([WP-REGISTER]).
• WooCommerce (Reviews & Customer Registration): Protects product reviews ([WOOCOMMERCE]) and My Account registration forms ([WC-REGISTER]), plus adds a direct Open Anti-Bot Log shortcut inside Products > Reviews.
• Contact Form 7 (CF7): Hooks seamlessly into wpcf7_spam to silently block automated contact form floods ([CF7]).
• WPForms: Protects all WPForms Lite and Pro submissions ([WPFORMS]).
• Elementor Pro Forms: Shields Elementor Pro contact and lead forms before emails are sent or entries are saved ([ELEMENTOR-FORM]).
• wpForo Forums: Protects both new forum topics ([WPFORO-TOPIC]) and thread replies ([WPFORO-REPLY]).
• bbPress Forums: Protects new forum topics ([BBPRESS-TOPIC]) and thread replies ([BBPRESS-REPLY]).
• BuddyPress & Ultimate Member: Shields community registration pages ([BUDDYPRESS-SIGNUP] and [ULTIMATE-MEMBER]) from fake bot profiles.

Key Strengths & Enterprise Features

• Native Control Panel under Tools > SyGy Anti-Bot: Zero external CSS or JS files. View live protection status across all 10 ecosystems, manage logging preferences, and monitor log file size from a clean native dashboard.
• Smart 3-Tier Diagnostic Log (BOT BLOCKED, HUMAN ACCEPTED, USER ACCEPTED): By default, the log records blocked bots (BOT BLOCKED) and anonymous guest submissions (HUMAN ACCEPTED), while skipping legitimate actions from already logged-in members so busy forums and communities never bloat the log file. Need to debug logged-in users? Enable [USER ACCEPTED] logging per-site with one click in Tools > SyGy Anti-Bot!
• Advanced WordPress Multisite Architecture (Centralized or Split-per-Subsite Logs): Each subsite has independent logging toggles. Furthermore, Super Admins can choose between a Single Centralized Network Log (default) or Isolated Per-Subsite Logs (Multi-Tenant mode, where each subsite stores and manages its own encrypted log file independently, with automatic subsite file cleanup if reverted).
• Immune to Source-Code Inspection: Every WordPress installation generates its own cryptographic HMAC-SHA256 token split in JavaScript. Even if an attacker downloads the plugin source code, they cannot craft a universal cURL bypass payload.
• 100% Page Cache & “Delay JS” Compatible: Works flawlessly with WP Rocket, LiteSpeed Cache, W3 Total Cache, WP Fastest Cache, SiteGround Optimizer, Varnish, and Cloudflare. Automatically flushes major caches upon activation.
• Triple-Layer GDPR Log Security: Stored in /wp-content/uploads/sygy-security-logs/ and shielded via Apache .htaccess (Require all denied), index.php, and a 16-character cryptographic random filename hash (protecting Nginx servers as well).
• 10 MB Auto-Rotation (DDoS Safe) & 512 KB Tail Reader: Automatically rotates the log file at 10 MB to prevent disk exhaustion during massive botnet attacks, and uses fseek() to read the last 512 KB without ever exhausting PHP RAM.