Official WordPress.org release with multi-layer honeypot traps, registration velocity verification, username entropy analysis, disposable email defense, and retrospective database scanner.<\/p>"},"ratings":[],"assets_icons":{"icon-128x128.png":{"filename":"icon-128x128.png","revision":3698567,"resolution":"128x128","location":"assets","locale":"","width":128,"height":128},"icon-256x256.png":{"filename":"icon-256x256.png","revision":3698567,"resolution":"256x256","location":"assets","locale":"","width":256,"height":256}},"assets_banners":{"banner-1544x500.png":{"filename":"banner-1544x500.png","revision":3698567,"resolution":"1544x500","location":"assets","locale":"","width":1544,"height":500},"banner-772x250.png":{"filename":"banner-772x250.png","revision":3698567,"resolution":"772x250","location":"assets","locale":"","width":772,"height":250}},"assets_blueprints":{},"all_blocks":[],"tagged_versions":["1.4.19"],"block_files":[],"assets_screenshots":[],"screenshots":{"1":"Security Overview Dashboard \u2014 Real-time registration metrics, threat detection status, and quick setup checklist.","2":"User Review & Triage Screen \u2014 Flagged bot accounts with detailed risk factor breakdowns, single-click safelisting, and bulk cleanup tools.","3":"Security Protection Console \u2014 Registration honeypot, form timer, IP blocking firewall, and brute-force defense toggles.","4":"Registration Burst Cohort Analysis \u2014 Time-windowed analysis to identify and quarantine coordinated bot registration attacks.","5":"Trusted Safelist Manager \u2014 Custom exclusion list ensuring trusted accounts and automated services are never restricted."}},"plugin_section":[262246],"plugin_tags":[2656,166108,598,603,600],"plugin_category":[54,58],"plugin_contributors":[276962,276961],"plugin_business_model":[],"class_list":["post-363356","plugin","type-plugin","status-publish","hentry","plugin_section-dashboard-widgets","plugin_tags-anti-spam","plugin_tags-bot-protection","plugin_tags-honeypot","plugin_tags-registration","plugin_tags-security","plugin_category-security-and-spam-protection","plugin_category-user-management","plugin_contributors-celsiusanderson","plugin_contributors-nasruleam","plugin_committers-celsiusanderson"],"banners":{"banner":"https:\/\/ps.w.org\/lc-anti-spam-registration\/assets\/banner-772x250.png?rev=3698567","banner_2x":"https:\/\/ps.w.org\/lc-anti-spam-registration\/assets\/banner-1544x500.png?rev=3698567","banner_rtl":false,"banner_2x_rtl":false},"icons":{"svg":false,"icon":"https:\/\/ps.w.org\/lc-anti-spam-registration\/assets\/icon-128x128.png?rev=3698567","icon_2x":"https:\/\/ps.w.org\/lc-anti-spam-registration\/assets\/icon-256x256.png?rev=3698567","generated":false},"screenshots":[],"raw_content":"\n
LC Anti-Spam Registration<\/strong> provides comprehensive, multi-layer registration security and automated bot defense for WordPress. It prevents fake user accounts, spam registrations, and credential-stuffing bots from ever polluting your database \u2014 without frustrating real human visitors with annoying CAPTCHAs.<\/p>\n\n Whether you run a WooCommerce store, membership site, LMS portal, online community, or standard WordPress blog, automated bot registrations clog your database, skew conversion analytics, trigger unwanted transactional emails, and introduce severe security vulnerabilities.<\/p>\n\n LC Anti-Spam Registration operates at the gate: it evaluates registration requests in real time using lightweight behavioral honeypots, human timing algorithms, disposable email detection, and intelligent username pattern heuristics.<\/p>\n\n\n\n No. LC Anti-Spam Registration runs entirely in memory with lightweight algorithmic checks and microsecond execution times. There are zero external API calls or third-party DNS dependencies, so registrations and form submissions experience zero noticeable latency.<\/p><\/dd>\n Yes. The plugin hooks into standard WordPress user registration flows ( Navigate to the LC Anti-Spam<\/strong> menu in your WordPress admin dashboard. The Live Overview displays real-time statistics of protected accounts, blocked bots, and flagged accounts ready for review.<\/p><\/dd>\n Yes. You can adjust the spam score threshold (Low, Medium, High), rate limiting windows, and brute-force retry counts under the Protection<\/strong> and Spam Scan<\/strong> tabs.<\/p><\/dd>\n\n<\/dl>\n\n\n\ud83d\udee1\ufe0f Core Defensive Capabilities<\/h3>\n\n
\n
wp-login.php<\/code> and registration endpoints.<\/li>\n\n
lc-anti-spam-registration<\/code> folder to the \/wp-content\/plugins\/<\/code> directory, or install the plugin directly through the WordPress plugins screen.<\/li>\n\n
Will it slow down my website?<\/h3><\/dt>\n
Does this work with WooCommerce, BuddyPress, and custom registration forms?<\/h3><\/dt>\n
registration_errors<\/code>, register_form<\/code>, user_register<\/code>, wp_login<\/code>), providing automatic defense for WooCommerce, membership portals, and LMS platforms.<\/p><\/dd>\nHow do I monitor blocked bots and flagged accounts?<\/h3><\/dt>\n
Can I customize the spam score sensitivity?<\/h3><\/dt>\n
1.4.19 (September 14, 2026)<\/h4>\n\n
\n
Email missing<\/code>) when accounts have no registered email address in WordPress or metadata (e.g. legacy social\/Facebook registrations without email scopes), eliminating confusing blank table cells.<\/li>\nbilling_email<\/code> in usermeta with a dedicated billing<\/code> source badge, preventing legitimate store customers from being mischaracterized as email-less accounts.<\/li>\nmailto:<\/code> links with dashicons and made user display names clickable directly to \/wp-admin\/user-edit.php<\/code> for instant forensic inspection.<\/li>\nEnrolled (N courses)<\/code>, Social Login<\/code>) directly into the review tags, protecting active students and social login members from accidental deletion.<\/li>\ncheck_existing_user()<\/code> to exempt active Sensei LMS students and use effective billing emails during scans, eliminating false-positive flags on legitimate members.<\/li>\n<\/ul>\n\n1.4.18 (September 14, 2026)<\/h4>\n\n
\n
lcasr_prime_user_caches()<\/code> cache priming helper, safely delegating to core _prime_user_caches()<\/code> or falling back to cache_users()<\/code> and update_meta_cache()<\/code>. Resolves unhandled fatal error on live WordPress sites during full user directory scans.<\/li>\nscan_all_users()<\/code> with bounded chunking (100 users per batch) and per-record runtime memory eviction via clean_user_cache()<\/code>, eliminating memory exhaustion crashes across high-capacity user directories.<\/li>\nhandle_manual_scan()<\/code> and handle_manual_cleanup()<\/code> in try \/ catch (\\Throwable)<\/code> blocks to return structured JSON error payloads, preventing raw HTTP 500 crashes and providing actionable admin notifications.<\/li>\n<\/ul>\n\n1.4.17 (September 13, 2026)<\/h4>\n\n
\n
handle_failed_login()<\/code> where brute-force login attacks against administrator accounts were erroneously bypassed from failure counters. Untrusted IPs targeting administrator or regular accounts are now strictly tracked and blocked once the failure threshold is met.<\/li>\nhandle_successful_login()<\/code> hook on wp_login<\/code> to immediately purge transient failed-login attempts upon valid password entry, eliminating false-positive lockouts from previous typographical errors.<\/li>\ncheck_request()<\/code> to immediately halt execution with HTTP 429 Too Many Requests status when the rate limit is exceeded, preventing abusive traffic from consuming server CPU rendering time.<\/li>\nwp_doing_cron()<\/code> and WP-CLI (WP_CLI<\/code>) from rate-limiting and blocking.<\/li>\nis_ip_blocked()<\/code>, block_ip()<\/code>, and get_client_ip()<\/code> to public APIs; implemented unblock_ip()<\/code> and get_blocked_ips()<\/code> for administrative control and contract test verification.<\/li>\nlcasr_firewall_request_exempt<\/code> and sad_firewall_request_exempt<\/code>, and emit both lcasr_ip_blocked<\/code>\/sad_ip_blocked<\/code> and lcasr_ip_unblocked<\/code>\/sad_ip_unblocked<\/code>.<\/li>\nwp_mail()<\/code> when option lcasr_notify_admin_brute_force<\/code> is active and an attacker is blocked.<\/li>\n<\/ul>\n\n1.4.16 (September 13, 2026)<\/h4>\n\n
\n
calculate_entropy()<\/code> computing information entropy H(X) in bits per character to mathematically distinguish machine-generated pseudo-random identifiers from genuine human choices.<\/li>\nchristopher<\/code>, alexsmith<\/code>, blacksmith<\/code>, manchester<\/code>, birmingham<\/code>, strathmore<\/code>, williamson<\/code>) were erroneously denied registration due to broad consonant cluster boundaries. Refined heuristics with natural English trigraph detection (chr<\/code>, str<\/code>, tch<\/code>, cks<\/code>, mth<\/code>, nch<\/code>, ngh<\/code>, etc.) and tightened vowel scarcity thresholds.<\/li>\nget_disposable_email_domains()<\/code> providing a comprehensive 40+ provider catalog with filter lcasr_disposable_email_domains<\/code> and wildcard subdomain defense (*.mailinator.com<\/code>, etc.).<\/li>\ncheck_registration_limits()<\/code> with lcasr_disposable_email_blocked<\/code> audit action trigger before user records touch the database.<\/li>\nis_suspicious_email_structure()<\/code> with sub-addressing abuse detection (+temp...<\/code>, +987654321<\/code>) and high-risk TLD pattern heuristics with filter lcasr_is_suspicious_email_structure<\/code>.<\/li>\n\\g{1}<\/code> and \\g{2}<\/code> syntax across doubled-vowel detector routines to eliminate string escape ambiguities across PHP versions.<\/li>\n<\/ul>\n\n1.4.15 (September 13, 2026)<\/h4>\n\n
\n
wp_hash('lcasr_time_' . $start_time)<\/code>) alongside registration timestamps to prevent malicious bots from forging past timestamps.<\/li>\nwoocommerce_register_form<\/code>, woocommerce_process_registration_errors<\/code>, and signup_extra_fields<\/code>.<\/li>\n<label><\/code> markup and filterable honeypot field names (lcasr_honeypot_field_name<\/code>) for zero screen reader impact and customizable obfuscation.<\/li>\nscrapy<\/code>, aiohttp<\/code>, headlesschrome<\/code>) with filterable pattern overrides (lcasr_bot_ua_regex<\/code>).<\/li>\nlcasr_honeypot_triggered<\/code>, lcasr_registration_timing_failed<\/code>, and lcasr_bot_ua_blocked<\/code> action triggers for threat logging and Pro telemetry integration.<\/li>\nlcasr_base_plugin_ready<\/code> and sad_base_plugin_ready<\/code> to guarantee instant synchronization with Pro add-ons and legacy integrations.<\/li>\n<\/ul>\n\n1.4.14 (September 13, 2026)<\/h4>\n\n
\n
lcasr_<\/code> \/ LCASR_<\/code>, eliminating the generic 3-character sad_<\/code> prefix.<\/li>\nLCASR_Spam_Detector<\/code>, LCASR_Spam_Cleaner<\/code>, LCASR_Firewall<\/code>, LCASR_Privacy<\/code>, LCASR_Dashboard_Widget<\/code>, and LCASR_Admin_Interface<\/code>.<\/li>\nlcasrAjax<\/code> with lcasr_admin_nonce<\/code>.<\/li>\n1.4.13 (September 8, 2026)<\/h4>\n\n
\n
_prime_user_caches()<\/code>) in get_safelist()<\/code>, eliminating N+1 database queries when loading safelisted accounts in the admin console.<\/li>\nupdate_meta_cache('user', $page_ids)<\/code> across paginated slices in get_flagged_accounts()<\/code>, fetching spam scores, reasons, and marked dates in a single bulk query rather than 60 separate queries per page.<\/li>\nlcasr_user_safelisted<\/code> and lcasr_user_removed_from_safelist<\/code> alongside legacy sad_*<\/code> action hooks for audit trails and activity feeds.<\/li>\nmanage_options<\/code> capability.<\/li>\nLCASR_PLUGIN_DIR<\/code> \/ LCASR_PLUGIN_URL<\/code> with rtrim()<\/code>, eliminating malformed double-slash asset links.<\/li>\n.fail()<\/code> network error recovery handlers to the interactive Quick Setup checklist toggles, preventing controls from getting trapped in busy state during server disruptions.<\/li>\n<\/ul>\n\n1.4.12 (September 8, 2026)<\/h4>\n\n
\n
@set_time_limit(120)<\/code> and wp_raise_memory_limit('admin')<\/code> to cleanup_spam_accounts()<\/code>, preventing script timeouts and memory exhaustion during automated background cron cleanups on large candidate pools.<\/li>\nlcasr_cleanup_stats<\/code> and legacy sad_cleanup_stats<\/code> on single deletions, batch purges, and manual scans.<\/li>\nlcasr_spam_user_deleted<\/code> and sad_spam_user_deleted<\/code> notification actions to allow audit loggers and Pro add-on hooks to record user removals.<\/li>\nlcasr_can_delete_user<\/code> and lcasr_protected_roles<\/code> filter bridges alongside legacy sad_*<\/code> hooks in the cleanup candidate pipeline.<\/li>\nlcasr_cleanup_spam_accounts<\/code> and legacy sad_cleanup_spam_accounts<\/code>.<\/li>\n<\/ul>\n\n1.4.11 (September 8, 2026)<\/h4>\n\n
\n
handle_failed_login()<\/code> with is_email()<\/code> check and email-based user resolution, preventing false-positive IP bans when administrators or staff log in using their email address.<\/li>\ncheck_request()<\/code> to evaluate both modern lcasr_firewall_request_exempt<\/code> and legacy sad_firewall_request_exempt<\/code> filter hooks.<\/li>\nlcasr_ip_blocked<\/code> and sad_ip_blocked<\/code> action triggers upon dynamic IP blocks for integration with live threat analytics.<\/li>\n0.0.0.0<\/code> addresses, preventing transient bloat and false blocks during local development and CLI testing.<\/li>\nblock_ip()<\/code> to prune legacy entries without timestamps, maintaining full parity with is_ip_blocked()<\/code>.<\/li>\n<\/ul>\n\n1.4.10 (September 8, 2026)<\/h4>\n\n
\n
aria-hidden=\"true\"<\/code> and multi-technique CSS concealment (