Title: SyGy Security Log & Anti-Bot Author: SyGy Published: October 14, 2026 Last modified: October 14, 2026 --- Search plugins ![](https://ps.w.org/sygy-security-log-anti-bot/assets/banner-772x250.jpeg?rev=3747170) ![](https://ps.w.org/sygy-security-log-anti-bot/assets/icon-256x256.jpeg?rev=3747170) # SyGy Security Log & Anti-Bot By [SyGy](https://profiles.wordpress.org/sygy88/) [Download](https://downloads.wordpress.org/plugin/sygy-security-log-anti-bot.4.4.0.zip) * [Details](https://wordpress.org/plugins/sygy-security-log-anti-bot/#description) * [Reviews](https://wordpress.org/plugins/sygy-security-log-anti-bot/#reviews) * [Installation](https://wordpress.org/plugins/sygy-security-log-anti-bot/#installation) * [Development](https://wordpress.org/plugins/sygy-security-log-anti-bot/#developers) [Support](https://wordpress.org/support/plugin/sygy-security-log-anti-bot/) ## Description Proactive Anti-Bot shield for WP Comments, WooCommerce, CF7, WPForms, Elementor, wpForo, bbPress & BuddyPress with GDPR logging. ### Stop Blind Bots at the Gate. Zero CAPTCHAs. Zero Database Bloat. 100% Cache Friendly. Every day, WordPress websites are hammered by thousands of automated spam requests. Most of this traffic does not come from real browsers—it comes from **“Blind Bots”**( headless scripts, cURL botnets, and automated scrapers) that send direct `POST` requests to `wp-comments-post.php`, `wp-login.php`, `wp-signup.php`, contact forms, and forum endpoints, completely bypassing your frontend pages. Traditional anti-spam plugins make a critical architectural mistake: **they let the bot in first.** They process the request, run heavy regular expressions, query external cloud APIs, and save the spam inside your MySQL database. Over time, this bloats your database, slows down queries, and wastes server CPU and RAM. Other plugins force your visitors to solve annoying CAPTCHAs or load heavy third-party JavaScript libraries that destroy your Core Web Vitals and PageSpeed score. **SyGy Security Log & Anti-Bot** flips the paradigm with a **Proactive Client-Side Cryptographic Behavioral Shield**. ### How It Works: Surgical Precision at Zero Server Cost Instead of analyzing spam _after_ it hits your database, **SyGy Security Log & Anti- Bot** verifies _how_ the user interacts with your form: 1. **Per-Site Cryptographic Split Token (`HMAC-SHA256`):** A tiny, dependency-free inline JavaScript snippet dynamically assembles and injects a site-unique `HMAC- SHA256` validation token into your forms upon page load (`DOMContentLoaded`) and real human interaction (`focusin`, `pointerdown`, `submit`). 2. **Instant HTTP 403 Termination:** When a request reaches your server without the behavioral token, the plugin verifies the signature via timing-safe `hash_equals()` and terminates bot execution immediately with an **HTTP 403 Forbidden** response. 3. **Untouched Database:** MySQL is never queried for spam storage, external APIs are never called, and legitimate human visitors never see a single CAPTCHA puzzle. ### All-in-One Ecosystem Protection (10 Auto-Detecting Modules) You don’t need five different anti-spam plugins. **SyGy Security Log & Anti-Bot** uses conditional loading to automatically protect the plugins you already use, with** zero overhead** for modules you don’t have installed: * **WordPress Native Comments:** Full protection for standard themes and custom templates built with **Elementor, Divi, Bricks, WPBakery**, and Gutenberg blocks(`[ WP-COMMENTS]`). * **WordPress Native User Registration:** Protects both Single Site (`wp-login. php?action=register`) and Multisite (`wp-signup.php`) against automated fake account creation (`[WP-REGISTER]`). * **WooCommerce (Reviews & Customer Registration):** Protects product reviews (`[ WOOCOMMERCE]`) and My Account registration forms (`[WC-REGISTER]`), plus adds a direct **Open Anti-Bot Log** shortcut inside _Products > Reviews_. * **Contact Form 7 (CF7):** Hooks seamlessly into `wpcf7_spam` to silently block automated contact form floods (`[CF7]`). * **WPForms:** Protects all WPForms Lite and Pro submissions (`[WPFORMS]`). * **Elementor Pro Forms:** Shields Elementor Pro contact and lead forms before emails are sent or entries are saved (`[ELEMENTOR-FORM]`). * **wpForo Forums:** Protects both new forum topics (`[WPFORO-TOPIC]`) and thread replies (`[WPFORO-REPLY]`). * **bbPress Forums:** Protects new forum topics (`[BBPRESS-TOPIC]`) and thread replies (`[BBPRESS-REPLY]`). * **BuddyPress & Ultimate Member:** Shields community registration pages (`[BUDDYPRESS- SIGNUP]` and `[ULTIMATE-MEMBER]`) from fake bot profiles. ### Key Strengths & Enterprise Features * **Native Control Panel under Tools > SyGy Anti-Bot:** Zero external CSS or JS files. View live protection status across all 10 ecosystems, manage logging preferences, and monitor log file size from a clean native dashboard. * **Smart 3-Tier Diagnostic Log (`BOT BLOCKED`, `HUMAN ACCEPTED`, `USER ACCEPTED`):** By default, the log records blocked bots (`BOT BLOCKED`) and anonymous guest submissions (`HUMAN ACCEPTED`), while skipping legitimate actions from already logged-in members so busy forums and communities never bloat the log file. Need to debug logged-in users? Enable `[USER ACCEPTED]` logging per-site with one click in _Tools > SyGy Anti-Bot_! * **Advanced WordPress Multisite Architecture (Centralized or Split-per-Subsite Logs):** Each subsite has independent logging toggles. Furthermore, Super Admins can choose between a **Single Centralized Network Log** (default) or **Isolated Per-Subsite Logs** (Multi-Tenant mode, where each subsite stores and manages its own encrypted log file independently, with automatic subsite file cleanup if reverted). * **Immune to Source-Code Inspection:** Every WordPress installation generates its own cryptographic `HMAC-SHA256` token split in JavaScript. Even if an attacker downloads the plugin source code, they cannot craft a universal cURL bypass payload. * **100% Page Cache & “Delay JS” Compatible:** Works flawlessly with **WP Rocket, LiteSpeed Cache, W3 Total Cache, WP Fastest Cache, SiteGround Optimizer, Varnish, and Cloudflare**. Automatically flushes major caches upon activation. * **Triple-Layer GDPR Log Security:** Stored in `/wp-content/uploads/sygy-security- logs/` and shielded via Apache `.htaccess` (`Require all denied`), `index.php`, and a **16-character cryptographic random filename hash** (protecting Nginx servers as well). * **10 MB Auto-Rotation (DDoS Safe) & 512 KB Tail Reader:** Automatically rotates the log file at 10 MB to prevent disk exhaustion during massive botnet attacks, and uses `fseek()` to read the last 512 KB without ever exhausting PHP RAM. ## Screenshots [⌊Main dashboard displaying the active HMAC-SHA256 cryptographic shield and real- time protection status for WordPress forms and plugins.⌉⌊Main dashboard displaying the active HMAC-SHA256 cryptographic shield and real-time protection status for WordPress forms and plugins.⌉[ Main dashboard displaying the active HMAC-SHA256 cryptographic shield and real-time protection status for WordPress forms and plugins. [⌊Diagnostic log management panel with real-time file size monitoring, auto-rotation limits, and a one-click log clearing tool.⌉⌊Diagnostic log management panel with real-time file size monitoring, auto-rotation limits, and a one-click log clearing tool.⌉[ Diagnostic log management panel with real-time file size monitoring, auto-rotation limits, and a one-click log clearing tool. [⌊The lightweight, zero-database flat-file log showing detailed tracking of blocked bot IP addresses and targeted URLs.⌉⌊The lightweight, zero-database flat-file log showing detailed tracking of blocked bot IP addresses and targeted URLs.⌉[ The lightweight, zero-database flat-file log showing detailed tracking of blocked bot IP addresses and targeted URLs. ## Installation 1. Upload the `sygy-security-log-anti-bot` folder to `/wp-content/plugins/` or install the `.zip` file via **Plugins > Add New** in WordPress. 2. Activate the plugin through the **Plugins** menu (or **Network Activate** on Multisite). 3. Anti-Bot protection and logging are immediately active. Open **Tools > SyGy Anti- Bot** (or click **Settings** in the Plugins list) to view active ecosystem modules, manage log settings, or view/clear the security log. ## FAQ ### Can spammers bypass this plugin by reading its public source code? No. SyGy Security Log & Anti-Bot computes a unique cryptographic `HMAC-SHA256` token for each individual WordPress installation and assembles it dynamically via JavaScript. ### Will my log file fill up if I have thousands of logged-in users posting on bbPress or wpForo? No. By default, the Smart Log records all blocked bot attacks (`BOT BLOCKED`) and guest submissions (`HUMAN ACCEPTED`), while ignoring routine legitimate posts from already logged-in members. If you ever want to log logged-in users as well (`USER ACCEPTED`), you can toggle that option on in **Tools > SyGy Anti-Bot**. ### How does logging work on WordPress Multisite? Each subsite can independently enable or pause logging and `[USER ACCEPTED]` tracking. By default, all sites write to a single **Centralized Network Log** (`[Site: domain. com/subsite]`). If you prefer total multi-tenant isolation, the Super Admin can enable **Split Log Files per Subsite (Multisite)** in _Tools > SyGy Anti-Bot_ so each subsite manages its own separate log file. ### Can a massive botnet attack fill up my server disk with logs? No. The plugin includes an automatic 10 MB safety cap. If the log file reaches 10 MB during a heavy DDoS spam wave, it automatically rotates the file, keeping the latest 512 KB of events and purging older records. ## Reviews There are no reviews for this plugin. ## Contributors & Developers “SyGy Security Log & Anti-Bot” is open source software. The following people have contributed to this plugin. Contributors * [ SyGy ](https://profiles.wordpress.org/sygy88/) [Translate “SyGy Security Log & Anti-Bot” into your language.](https://translate.wordpress.org/projects/wp-plugins/sygy-security-log-anti-bot) ### Interested in development? [Browse the code](https://plugins.trac.wordpress.org/browser/sygy-security-log-anti-bot/), check out the [SVN repository](https://plugins.svn.wordpress.org/sygy-security-log-anti-bot/), or subscribe to the [development log](https://plugins.trac.wordpress.org/log/sygy-security-log-anti-bot/) by [RSS](https://plugins.trac.wordpress.org/log/sygy-security-log-anti-bot/?limit=100&mode=stop_on_copy&format=rss). ## Changelog #### 4.4.0 * Multi-Tenant Multisite Architecture: Made logging toggles independent per subsite and added a Super Admin option to split log files per subsite (`Split Log Files per Subsite`), complete with automatic subsite log cleanup when reverting to centralized mode. * Native Admin Dashboard: Added a zero-overhead control panel under **Tools > SyGy Anti-Bot** displaying real-time protection status across all 10 supported ecosystems, log size metrics, and log management tools. * Smart 3-Tier Logging: Introduced `[USER ACCEPTED]` status for logged-in members( disabled by default to keep logs lean on busy forums/communities). #### 4.2.0 * Enterprise Ecosystem Expansion: Added automatic conditional protection for WordPress User Registration (`wp-login.php` & Multisite `wp-signup.php`), WooCommerce Customer Registration, WPForms, Elementor Pro Forms, bbPress, and Ultimate Member. #### 4.1.0 * Security Hardening: Replaced static token with a per-site cryptographic `HMAC- SHA256` split token verified via timing-safe `hash_equals()` and 10 MB log auto- rotation. #### 1.0.0 * Initial release. ## Meta * Version **4.4.0** * Last updated **2 days ago** * Active installations **Fewer than 10** * WordPress version ** 5.7 or higher ** * Tested up to **7.1.3** * PHP version ** 7.4 or higher ** * Tags * [anti-spam](https://wordpress.org/plugins/tags/anti-spam/)[contact form 7](https://wordpress.org/plugins/tags/contact-form-7/) [security](https://wordpress.org/plugins/tags/security/)[woocommerce](https://wordpress.org/plugins/tags/woocommerce/) [WPForms](https://wordpress.org/plugins/tags/wpforms/) * [Advanced View](https://wordpress.org/plugins/sygy-security-log-anti-bot/advanced/) ## Ratings No reviews have been submitted yet. [Your review](https://wordpress.org/support/plugin/sygy-security-log-anti-bot/reviews/#new-post) [See all reviews](https://wordpress.org/support/plugin/sygy-security-log-anti-bot/reviews/) ## Contributors * [ SyGy ](https://profiles.wordpress.org/sygy88/) ## Support Got something to say? Need help? [View support forum](https://wordpress.org/support/plugin/sygy-security-log-anti-bot/)