Veilo — Invisible Spam Shield

Description

A working plugin scaffold, not a demo. It scores every submission using three signals — a honeypot field, submission speed, and pointer/touch movement — with no CAPTCHA ever shown to the visitor. Spam is blocked (or held for review) automatically.

Free plan protects:

• Native WordPress comments
• Contact Form 7
• WPForms

Pro plan additionally protects:

• Elementor Pro Forms
• Gravity Forms

…and unlocks Veilo → Pro Tools: full Activity Log history (configurable row limit, free is capped at the 10 most recent) and one-click CSV export.

Protecting a custom or hand-coded form

The signal script (public/js/veilo-signals.js) tags every <form> on the page automatically, so the three hidden fields are already present in $_POST for ANY form, built-in or custom. To act on them from your own form handler, call the public helper:

$result = veilo_check( $_POST, 'my-booking-form', $_POST['name'] ?? '' );

if ( 'allowed' !== $result['decision'] ) {
    // stop processing however fits this form — wp_die(), return an
    // error, redirect back with a message, etc.
    wp_die( 'Your submission looks automated and was not sent.' );
}

// otherwise continue processing the form as normal

The second and third arguments are optional and only affect what shows up in Veilo → Activity Log (a source label and a short preview text). This same function is what every built-in integration calls internally, so custom forms get identical scoring to comments, CF7, WPForms, Elementor, and Gravity Forms.