Title: TrustSig Security Author: trustsig Published: May 23, 2026 Last modified: May 23, 2026 --- Search plugins ![](https://ps.w.org/trustsig-security/assets/icon-256x256.png?rev=3545156) # TrustSig Security By [trustsig](https://profiles.wordpress.org/robertvahhi/) [Download](https://downloads.wordpress.org/plugin/trustsig-security.1.2.8.zip) * [Details](https://wordpress.org/plugins/trustsig-security/#description) * [Reviews](https://wordpress.org/plugins/trustsig-security/#reviews) * [Installation](https://wordpress.org/plugins/trustsig-security/#installation) * [Development](https://wordpress.org/plugins/trustsig-security/#developers) [Support](https://wordpress.org/support/plugin/trustsig-security/) ## Description **TrustSig Security blocks scripted bots before they ever reach your site — silently, with zero friction for real visitors.** No puzzles. No “I am not a robot” checkboxes. No third-party signup required to start. #### Why TrustSig * 🛡️ **Protects every important form out of the box** — login, registration, comments, password reset, WooCommerce checkout, BuddyPress signup, Easy Digital Downloads, Elementor Pro forms, and any custom form via shortcode. * 🚫 **Stops brute-force login attempts** with built-in lockout after repeated failures. * 👻 **Invisible to humans** — real visitors are verified in under a second by a non-interactive browser check. No CAPTCHA, no images to click. * ⚙️ **Three protection modes** — Monitor (log only), Challenge (default, soft block with auto-retry), Enforce (hard block). * 🔌 **Zero configuration** — activate the plugin and protection is live immediately. Anonymous free tier needs no account. * 🧩 **Works with caching plugins, WPML, multisite and most themes** — forms are signed server-side with a per-site secret. * 🛠️ **Developer-friendly** — PHP helper `trustsig_verify()`, REST endpoint `/wp- json/trustsig/v1/verify`, filters and actions for custom forms. * 🔒 **Optional admin-ajax and REST API guard** for advanced sites. * 📜 **GPLv2** — fully open source. #### How it works TrustSig injects a lightweight browser SDK, signs every rendered form with a per- site secret, and verifies submissions against the TrustSig Edge service. Real visitors pass an invisible check in about a second; scripted clients that never run JavaScript are stopped. When a request arrives without a valid token, TrustSig does not silently fail open. Depending on the mode you choose it serves a lightweight “please wait” interstitial that re-verifies the browser and then transparently continues the original request— or blocks it. The plugin works out of the box with **no account and no API keys** (anonymous free tier). Connecting a TrustSig dashboard account is optional and only adds analytics and higher limits. #### Protection modes * **Monitor** — verify and log only, never block. Used for safe rollout; the upgrade path also pins existing sites here so behaviour never changes silently on update. * **Challenge** (default for new installs) — a missing or invalid token shows the interstitial, then continues or blocks. * **Enforce** — a missing or invalid token is blocked immediately. #### What it protects Browser forms are protected automatically with no code: * WordPress core — login, registration, comments, lost/reset password * WooCommerce — login, registration, checkout, pay order, lost password * BuddyPress — registration * Easy Digital Downloads — login, registration * Elementor Pro forms * Any other form (site-wide “protect all forms” option, the `[trustsig_form]` shortcode, or a hidden `trustsig-response` input) It also includes optional brute-force lockout for repeated failed logins, an opt- in admin-ajax / REST API guard, and a developer verification API. #### For developers * PHP: `trustsig_verify( array( 'token' => $t, 'action' => 'my_form' ) )` returns` pass` | `fail` | `challenge`. Filters: `trustsig_pre_verify`, trustsig_result. Action: `trustsig_blocked`. * REST: `POST /wp-json/trustsig/v1/verify` with `{ "token": "..." }`. #### Known limitations * XML-RPC (`xmlrpc.php`) is intentionally out of scope and is not verified. Disable XML-RPC separately if it is unused on your site. * admin-ajax and the REST API are only protected when explicitly enabled in Settings, to avoid breaking third-party integrations. * File-upload and AJAX submissions cannot show the interstitial; under Challenge or Enforce mode a missing token on those is blocked, never silently allowed. ### External services This plugin relies on the **TrustSig Edge** service to decide whether a request comes from a human or an automated client. This bot-detection verdict cannot be produced locally, so the service is required for the plugin’s core functionality. **Service provider:** TrustSig — https://trustsig.eu **Remote script loaded in the browser:** https://edge.trustsig.eu/trustsig.js is loaded on pages that contain a protected form, on the login screen, and on the verification interstitial. The script runs the non-interactive browser check and produces a verification token. **Data sent from the visitor’s browser / your server to https://edge.trustsig.eu/ verify: * the TrustSig verification token generated by the SDK in the visitor’s browser; * your site’s host name (e.g. `example.com`) on the anonymous free tier, or, if you connect a dashboard account, the secret key you entered; * as part of any HTTPS request, the visitor’s IP address and standard request metadata (such as the user-agent) are visible to the service. **When data is sent:** when the SDK loads on a protected page, when a protected form is submitted, and once per browser when the optional verified-session cookie is bootstrapped. **Data stored locally on your site:** TrustSig writes a verification log to your own WordPress database (custom tables) that includes visitor IP addresses, the action attempted, and the verdict. This data is not sent to TrustSig; you can clear it at any time from Settings TrustSig Tools. By installing and activating this plugin you (the site administrator) consent to this data being sent to TrustSig so that requests can be verified. Inform your own site’s visitors as required by your local privacy obligations. * Terms of Service: https://trustsig.eu/terms-of-service/ * Privacy Policy: https://trustsig.eu/privacy ## Screenshots * [[ * TrustSig dashboard overview: protection status, recent verifications, and the current mode at a glance. * [[ * Protection details: per-form coverage across WordPress core, WooCommerce, BuddyPress, EDD, and Elementor. * [[ * Settings: switch between Monitor, Challenge, and Enforce, configure brute-force lockout, and link an optional dashboard account. ## Installation 1. Upload the `trustsig-security` folder to `/wp-content/plugins/`, or install the plugin through the WordPress Plugins screen. 2. Activate the plugin through the ‘Plugins’ menu in WordPress. 3. Navigate to Settings TrustSig. Protection is active immediately with no further configuration. 4. (Optional) Enter your Site Key and Secret Key to link a TrustSig dashboard account for analytics and higher limits. ## FAQ ### Do I need an account or API keys? No. The plugin protects your forms immediately on activation using the anonymous free tier. An account is only needed for analytics and higher limits. ### What data leaves my site? A browser verification token, your site host name (or your secret key if you connect an account), and standard HTTPS request metadata are sent to the TrustSig Edge service. See the “External services” section above for the full disclosure, including links to the Terms of Service and Privacy Policy. ### Will this block real visitors? In Challenge mode (the default) a visitor whose token is missing sees a brief “ please wait” page that re-verifies the browser and then continues the original request automatically. Monitor mode never blocks. Enforce mode is the strictest and can block visitors with JavaScript disabled. ### Does it work with caching plugins? Yes. Forms are signed with a server-issued nonce and the SDK fills the token client- side, so cached pages are still protected. ### How do I temporarily bypass protection if I lock myself out? Settings TrustSig Tools shows a private recovery URL that bypasses all checks once. You can also add your IP to the whitelist. ### Is the plugin GPL? Yes, it is licensed GPLv2 or later. ## Reviews There are no reviews for this plugin. ## Contributors & Developers “TrustSig Security” is open source software. The following people have contributed to this plugin. Contributors * [ trustsig ](https://profiles.wordpress.org/robertvahhi/) [Translate “TrustSig Security” into your language.](https://translate.wordpress.org/projects/wp-plugins/trustsig-security) ### Interested in development? [Browse the code](https://plugins.trac.wordpress.org/browser/trustsig-security/), check out the [SVN repository](https://plugins.svn.wordpress.org/trustsig-security/), or subscribe to the [development log](https://plugins.trac.wordpress.org/log/trustsig-security/) by [RSS](https://plugins.trac.wordpress.org/log/trustsig-security/?limit=100&mode=stop_on_copy&format=rss). ## Changelog #### 1.2.8 * Listing rewrite republished: screenshots now show at the top of the description, feature bullets prominent. No behaviour change. #### 1.2.7 * Rewrote the wordpress.org listing: tighter marketing copy, feature bullets, and a 3-shot screenshot carousel (dashboard overview, per-form coverage, settings). * Added a 256×256 plugin icon and 128×128 search-results icon. * No behaviour change. #### 1.2.6 * All front-end and admin scripts/styles are now registered and enqueued via wp_enqueue_script/ wp_enqueue_style with configuration passed through wp_localize_script; no inline script/style is printed in the normal page pipeline. * Fixed the Terms of Service link in the readme. #### 1.2.5 * Added the verified-session layer: after a passing scan the browser is trusted via a signed cookie with no further edge calls, protecting AJAX/REST globally. * Added a rate-limited grace window for non-auth APIs during SDK bootstrap. * Hardened cookie handling (HMAC-signed, user-agent anomaly downgrade, revocation). * Added the developer verify API and opt-in admin-ajax / REST protection. #### 1.2.0 * Enforcement overhaul. Removed the universal fail-open on a missing token. * Added an HMAC-signed per-site form nonce (auto-generated, works on the free tier). * Added the interstitial challenge: re-verify and transparently resubmit, or block. * Added Monitor / Challenge / Enforce policy and configurable edge-down behaviour. * Decoupled brute-force counting from the token path. * Safe migration: existing installs upgrade into Monitor with an admin notice. #### 1.0.0 * Initial release. ## Meta * Version **1.2.8** * Last updated **10 hours ago** * Active installations **Fewer than 10** * WordPress version ** 5.0 or higher ** * Tested up to **6.9.4** * PHP version ** 7.2 or higher ** * Tags * [bot protection](https://wordpress.org/plugins/tags/bot-protection/)[Brute Force](https://wordpress.org/plugins/tags/brute-force/) [security](https://wordpress.org/plugins/tags/security/)[spam](https://wordpress.org/plugins/tags/spam/) [woocommerce](https://wordpress.org/plugins/tags/woocommerce/) * [Advanced View](https://wordpress.org/plugins/trustsig-security/advanced/) ## Ratings No reviews have been submitted yet. [Your review](https://wordpress.org/support/plugin/trustsig-security/reviews/#new-post) [See all reviews](https://wordpress.org/support/plugin/trustsig-security/reviews/) ## Contributors * [ trustsig ](https://profiles.wordpress.org/robertvahhi/) ## Support Got something to say? Need help? [View support forum](https://wordpress.org/support/plugin/trustsig-security/)