Title: tlloancy Behavioral Ultimate Finisher Author: Thomas Lloancy Published: October 30, 2026 Last modified: October 30, 2026 --- Search plugins ![](https://ps.w.org/tlloancy-behavioral-ultimate-finisher/assets/banner-772x250. png?rev=3775978) ![](https://ps.w.org/tlloancy-behavioral-ultimate-finisher/assets/icon.svg?rev=3775978) # tlloancy Behavioral Ultimate Finisher By [Thomas Lloancy](https://profiles.wordpress.org/tlloancy/) [Download](https://downloads.wordpress.org/plugin/tlloancy-behavioral-ultimate-finisher.1.0.0.zip) * [Details](https://wordpress.org/plugins/tlloancy-behavioral-ultimate-finisher/#description) * [Reviews](https://wordpress.org/plugins/tlloancy-behavioral-ultimate-finisher/#reviews) * [Installation](https://wordpress.org/plugins/tlloancy-behavioral-ultimate-finisher/#installation) * [Development](https://wordpress.org/plugins/tlloancy-behavioral-ultimate-finisher/#developers) [Support](https://wordpress.org/support/plugin/tlloancy-behavioral-ultimate-finisher/) ## Description tlloancy Behavioral Ultimate Finisher looks at **how** a form was filled, not only at what was sent. It scores each submission from a few behavioral signals and lets you decide what happens to the ones that look automated. No CAPTCHA, no cookies, no external service. **A companion for your anti-spam plugin** Honeypots, nonces and form timers are good against simple bots, but a bot that runs JavaScript can satisfy them. Behavioral Ultimate Finisher adds the missing angle: a bot that loads the page, fills the form in a fraction of a second and never touches the mouse or the keyboard gives itself away by how it behaved. It uses standard WordPress hooks and its own field names, so it is designed to sit next to plugins such as La Sentinelle antispam, Antispam Bee or Akismet. Each plugin runs its own check, and a submission is stopped if either one flags it. This plugin is independent and is not affiliated with those projects. **What it catches** * Bots that run JavaScript but do not behave like a person: submitting within a fraction of a second, no mouse, keyboard, touch or scroll, scripted keystrokes, headless-browser windows. * Raw bots that post straight to the form without a browser: by default through the honeypot, and through the missing or forged token once you raise the “no valid token” score (see the FAQ). **What it does not catch** Bots that drive a real browser with genuine input events, and human spammers, can look like a normal visitor. Keep a content-based anti-spam plugin for those. **Signals (each with an editable score)** * Honeypot field filled in * No valid token (direct POST without a browser, forged or expired token) * Form submitted faster than a minimum fill time * No human interaction before the submission (mouse, keyboard, touch, scroll, focus) * Browser reports automation (`navigator.webdriver`) * Browser window reports a size of 0 x 0, typical of headless browsers * Many keystrokes or clicks fired by a script instead of the browser (simulated typing) Scores add up. A submission is flagged when its total reaches your threshold, so one weak signal never blocks a real visitor on its own. **Three modes** * **Reject** (default): every flagged submission is rejected. * **Mark as spam**: flagged comments go to the spam queue, other forms reject the submission. * **Observe**: scores are logged, nothing is blocked. Useful to check the log and calibrate your thresholds on your own traffic. **Protected forms** * WordPress comments (including WooCommerce reviews) * User registration (WordPress and WooCommerce) * Contact Form 7 * Login (optional, off by default) **For developers** ``` $result = tlbuf_evaluate( 'my-plugin' ); returns `score`, `signals` and `flagged` for the current submission. Use the `tlbuf_behavior_score` filter to adjust the score. ``` **Privacy** No cookies, no IP address stored, no data sent to any third-party service. The optional log only keeps the date, form type, score, decision, triggered signals and a short line of event counters (numbers only, never what was typed), and is purged automatically. ## Screenshots [⌊Choose a mode (reject, mark as spam, observe) and the forms to protect.⌉⌊Choose a mode (reject, mark as spam, observe) and the forms to protect.⌉[ Choose a mode (reject, mark as spam, observe) and the forms to protect. [⌊Every signal has its own editable score.⌉⌊Every signal has its own editable score .⌉[ Every signal has its own editable score. [⌊The score log lists each submission with its signals and event counters (demo traffic).⌉⌊The score log lists each submission with its signals and event counters( demo traffic).⌉[ The score log lists each submission with its signals and event counters (demo traffic). ## Installation 1. Upload the plugin folder to `/wp-content/plugins/`, or install it from the Plugins screen. 2. Activate it. 3. Open Settings > Behavioral Ultimate Finisher. The plugin starts in Reject mode, so flagged submissions are blocked right away. 4. Optional: switch to “Observe” or “Mark as spam” if you want to review the log first. ## FAQ ### Does it replace my anti-spam plugin? No, it is meant to work next to it. A content-based plugin judges what was sent, Behavioral Ultimate Finisher judges how the form was filled. You can switch to observe mode at any time to see what it would flag on your own traffic. ### Will it block real visitors? Not on a single signal. By default a visitor with JavaScript disabled only gets the “no valid token” score, which is below the threshold. The trade-off is that raw bots that never fill the honeypot also pass at that setting. Check in the log( observe mode) that your real visitors always have a token, then raise the “no valid token” score to the threshold value to reject raw bots. ### The login form is off by default. Why? Password managers can fill and submit a login form within a second or two, which looks like a bot. Enable it only if you need it, and check the log first. ### Does it work with page caching? Yes. The token is requested from a REST endpoint after the page loads, so cached pages are fine. If a security plugin blocks the REST API for visitors, no token is issued and only the honeypot and the other signals apply. Plugins that delay JavaScript until the first interaction should exclude `tlbuf-tracker.js`. ### Does it stop every bot? No. Bots that drive a real browser with genuine input events, and human spammers, can pass behavioral checks. Use it as a first filter next to a content-based anti- spam plugin. Tokens are valid for 24 hours and are not single-use. ### Does it use an external service or cookies? No. ## Reviews There are no reviews for this plugin. ## Contributors & Developers “tlloancy Behavioral Ultimate Finisher” is open source software. The following people have contributed to this plugin. Contributors * [ Thomas Lloancy ](https://profiles.wordpress.org/tlloancy/) [Translate “tlloancy Behavioral Ultimate Finisher” into your language.](https://translate.wordpress.org/projects/wp-plugins/tlloancy-behavioral-ultimate-finisher) ### Interested in development? [Browse the code](https://plugins.trac.wordpress.org/browser/tlloancy-behavioral-ultimate-finisher/), check out the [SVN repository](https://plugins.svn.wordpress.org/tlloancy-behavioral-ultimate-finisher/), or subscribe to the [development log](https://plugins.trac.wordpress.org/log/tlloancy-behavioral-ultimate-finisher/) by [RSS](https://plugins.trac.wordpress.org/log/tlloancy-behavioral-ultimate-finisher/?limit=100&mode=stop_on_copy&format=rss). ## Changelog #### 1.0.0 * First release. ## Meta * Version **1.0.0** * Last updated **2 days ago** * Active installations **Fewer than 10** * WordPress version ** 6.4 or higher ** * Tested up to **7.1.4** * PHP version ** 7.4 or higher ** * Tags * [anti-spam](https://wordpress.org/plugins/tags/anti-spam/)[bot protection](https://wordpress.org/plugins/tags/bot-protection/) [comments](https://wordpress.org/plugins/tags/comments/)[honeypot](https://wordpress.org/plugins/tags/honeypot/) [spam](https://wordpress.org/plugins/tags/spam/) * [Advanced View](https://wordpress.org/plugins/tlloancy-behavioral-ultimate-finisher/advanced/) ## Ratings No reviews have been submitted yet. [Your review](https://wordpress.org/support/plugin/tlloancy-behavioral-ultimate-finisher/reviews/#new-post) [See all reviews](https://wordpress.org/support/plugin/tlloancy-behavioral-ultimate-finisher/reviews/) ## Contributors * [ Thomas Lloancy ](https://profiles.wordpress.org/tlloancy/) ## Support Got something to say? Need help? [View support forum](https://wordpress.org/support/plugin/tlloancy-behavioral-ultimate-finisher/)