{"id":385523,"date":"2026-10-14T21:17:21","date_gmt":"2026-10-14T21:17:21","guid":{"rendered":"https:\/\/it.wordpress.org\/plugins\/sygy-security-log-anti-bot\/"},"modified":"2026-10-14T21:29:44","modified_gmt":"2026-10-14T21:29:44","slug":"sygy-security-log-anti-bot","status":"publish","type":"plugin","link":"https:\/\/wordpress.org\/plugins\/sygy-security-log-anti-bot\/","author":17906883,"comment_status":"closed","ping_status":"closed","template":"","meta":{"version":"4.4.0","stable_tag":"4.4.0","tested":"7.1.3","requires":"5.7","requires_php":"7.4","requires_plugins":null,"header_name":"SyGy Security Log & Anti-Bot","header_author":"SyGy","header_description":"Ultra-lightweight proactive blind-bot blocker for WordPress Comments, Registrations, WooCommerce, Contact Form 7, WPForms, Elementor Forms, wpForo, bbPress, and BuddyPress with Multisite support and a protected diagnostic log.","assets_banners_color":"50556e","last_updated":"2026-10-14 21:29:44","external_support_url":"","external_repository_url":"","donate_link":"","header_plugin_uri":"https:\/\/www.sygy.it\/plugin-wordpress\/sygy-security-log-anti-bot\/","header_author_uri":"https:\/\/www.sygy.it\/","rating":0,"author_block_rating":0,"active_installs":0,"downloads":67,"num_ratings":0,"support_threads":0,"support_threads_resolved":0,"author_block_count":0,"sections":["installation","faq","changelog","description"],"tags":{"4.4.0":{"tag":"4.4.0","author":"sygy88","date":"2026-10-14 21:29:44","revision":3747178}},"upgrade_notice":[],"ratings":[],"assets_icons":{"icon-256x256.jpeg":{"filename":"icon-256x256.jpeg","revision":3747170,"resolution":"256x256","location":"assets","locale":"","width":256,"height":256}},"assets_banners":{"banner-1544x500.jpeg":{"filename":"banner-1544x500.jpeg","revision":3747170,"resolution":"1544x500","location":"assets","locale":"","width":1514,"height":500},"banner-772x250.jpeg":{"filename":"banner-772x250.jpeg","revision":3747170,"resolution":"772x250","location":"assets","locale":"","width":757,"height":250}},"assets_blueprints":{},"all_blocks":[],"tagged_versions":["4.4.0"],"block_files":[],"assets_screenshots":{"screenshot-1.png":{"filename":"screenshot-1.png","revision":3747170,"resolution":"1","location":"assets","locale":"","width":871,"height":872},"screenshot-2.png":{"filename":"screenshot-2.png","revision":3747170,"resolution":"2","location":"assets","locale":"","width":865,"height":231},"screenshot-3.png":{"filename":"screenshot-3.png","revision":3747170,"resolution":"3","location":"assets","locale":"","width":1449,"height":919}},"screenshots":{"1":"Main dashboard displaying the active HMAC-SHA256 cryptographic shield and real-time protection status for WordPress forms and plugins.","2":"Diagnostic log management panel with real-time file size monitoring, auto-rotation limits, and a one-click log clearing tool.","3":"The lightweight, zero-database flat-file log showing detailed tracking of blocked bot IP addresses and targeted URLs."}},"plugin_section":[],"plugin_tags":[2656,1152,600,286,130711],"plugin_category":[42,45,54],"plugin_contributors":[286826],"plugin_business_model":[],"class_list":["post-385523","plugin","type-plugin","status-publish","hentry","plugin_tags-anti-spam","plugin_tags-contact-form-7","plugin_tags-security","plugin_tags-woocommerce","plugin_tags-wpforms","plugin_category-contact-forms","plugin_category-ecommerce","plugin_category-security-and-spam-protection","plugin_contributors-sygy88","plugin_committers-sygy88"],"banners":{"banner":"https:\/\/ps.w.org\/sygy-security-log-anti-bot\/assets\/banner-772x250.jpeg?rev=3747170","banner_2x":"https:\/\/ps.w.org\/sygy-security-log-anti-bot\/assets\/banner-1544x500.jpeg?rev=3747170","banner_rtl":false,"banner_2x_rtl":false},"icons":{"svg":false,"icon":"https:\/\/ps.w.org\/sygy-security-log-anti-bot\/assets\/icon-256x256.jpeg?rev=3747170","icon_2x":"https:\/\/ps.w.org\/sygy-security-log-anti-bot\/assets\/icon-256x256.jpeg?rev=3747170","generated":false},"screenshots":[{"src":"https:\/\/ps.w.org\/sygy-security-log-anti-bot\/assets\/screenshot-1.png?rev=3747170","caption":"Main dashboard displaying the active HMAC-SHA256 cryptographic shield and real-time protection status for WordPress forms and plugins."},{"src":"https:\/\/ps.w.org\/sygy-security-log-anti-bot\/assets\/screenshot-2.png?rev=3747170","caption":"Diagnostic log management panel with real-time file size monitoring, auto-rotation limits, and a one-click log clearing tool."},{"src":"https:\/\/ps.w.org\/sygy-security-log-anti-bot\/assets\/screenshot-3.png?rev=3747170","caption":"The lightweight, zero-database flat-file log showing detailed tracking of blocked bot IP addresses and targeted URLs."}],"raw_content":"\n
    \n
  1. Upload the sygy-security-log-anti-bot<\/code> folder to \/wp-content\/plugins\/<\/code> or install the .zip<\/code> file via Plugins > Add New<\/strong> in WordPress.<\/li>\n
  2. Activate the plugin through the Plugins<\/strong> menu (or Network Activate<\/strong> on Multisite).<\/li>\n
  3. Anti-Bot protection and logging are immediately active. Open Tools > SyGy Anti-Bot<\/strong> (or click Settings<\/strong> in the Plugins list) to view active ecosystem modules, manage log settings, or view\/clear the security log.<\/li>\n<\/ol>\n\n\n
    \n

    Can spammers bypass this plugin by reading its public source code?<\/h3><\/dt>\n

    No. SyGy Security Log & Anti-Bot computes a unique cryptographic HMAC-SHA256<\/code> token for each individual WordPress installation and assembles it dynamically via JavaScript.<\/p><\/dd>\n

    Will my log file fill up if I have thousands of logged-in users posting on bbPress or wpForo?<\/h3><\/dt>\n

    No. By default, the Smart Log records all blocked bot attacks (BOT BLOCKED<\/code>) and guest submissions (HUMAN ACCEPTED<\/code>), while ignoring routine legitimate posts from already logged-in members. If you ever want to log logged-in users as well (USER ACCEPTED<\/code>), you can toggle that option on in Tools > SyGy Anti-Bot<\/strong>.<\/p><\/dd>\n

    How does logging work on WordPress Multisite?<\/h3><\/dt>\n

    Each subsite can independently enable or pause logging and [USER ACCEPTED]<\/code> tracking. By default, all sites write to a single Centralized Network Log<\/strong> ([Site: domain.com\/subsite]<\/code>). If you prefer total multi-tenant isolation, the Super Admin can enable Split Log Files per Subsite (Multisite)<\/strong> in Tools > SyGy Anti-Bot<\/em> so each subsite manages its own separate log file.<\/p><\/dd>\n

    Can a massive botnet attack fill up my server disk with logs?<\/h3><\/dt>\n

    No. The plugin includes an automatic 10 MB safety cap. If the log file reaches 10 MB during a heavy DDoS spam wave, it automatically rotates the file, keeping the latest 512 KB of events and purging older records.<\/p><\/dd>\n\n<\/dl>\n\n\n

    4.4.0<\/h4>\n\n
      \n
    • Multi-Tenant Multisite Architecture: Made logging toggles independent per subsite and added a Super Admin option to split log files per subsite (Split Log Files per Subsite<\/code>), complete with automatic subsite log cleanup when reverting to centralized mode.<\/li>\n
    • Native Admin Dashboard: Added a zero-overhead control panel under Tools > SyGy Anti-Bot<\/strong> displaying real-time protection status across all 10 supported ecosystems, log size metrics, and log management tools.<\/li>\n
    • Smart 3-Tier Logging: Introduced [USER ACCEPTED]<\/code> status for logged-in members (disabled by default to keep logs lean on busy forums\/communities).<\/li>\n<\/ul>\n\n

      4.2.0<\/h4>\n\n
        \n
      • Enterprise Ecosystem Expansion: Added automatic conditional protection for WordPress User Registration (wp-login.php<\/code> & Multisite wp-signup.php<\/code>), WooCommerce Customer Registration, WPForms, Elementor Pro Forms, bbPress, and Ultimate Member.<\/li>\n<\/ul>\n\n

        4.1.0<\/h4>\n\n
          \n
        • Security Hardening: Replaced static token with a per-site cryptographic HMAC-SHA256<\/code> split token verified via timing-safe hash_equals()<\/code> and 10 MB log auto-rotation.<\/li>\n<\/ul>\n\n

          1.0.0<\/h4>\n\n
            \n
          • Initial release.<\/li>\n<\/ul>\n\n\n

            Proactive Anti-Bot shield for WP Comments, WooCommerce, CF7, WPForms, Elementor, wpForo, bbPress & BuddyPress with GDPR logging.<\/p>\n\n

            Stop Blind Bots at the Gate. Zero CAPTCHAs. Zero Database Bloat. 100% Cache Friendly.<\/h3>\n\n

            Every day, WordPress websites are hammered by thousands of automated spam requests. Most of this traffic does not come from real browsers\u2014it comes from \"Blind Bots\"<\/strong> (headless scripts, cURL botnets, and automated scrapers) that send direct POST<\/code> requests to wp-comments-post.php<\/code>, wp-login.php<\/code>, wp-signup.php<\/code>, contact forms, and forum endpoints, completely bypassing your frontend pages.<\/p>\n\n

            Traditional anti-spam plugins make a critical architectural mistake: they let the bot in first.<\/strong> They process the request, run heavy regular expressions, query external cloud APIs, and save the spam inside your MySQL database. Over time, this bloats your database, slows down queries, and wastes server CPU and RAM. Other plugins force your visitors to solve annoying CAPTCHAs or load heavy third-party JavaScript libraries that destroy your Core Web Vitals and PageSpeed score.<\/p>\n\n

            SyGy Security Log & Anti-Bot<\/strong> flips the paradigm with a Proactive Client-Side Cryptographic Behavioral Shield<\/strong>.<\/p>\n\n

            How It Works: Surgical Precision at Zero Server Cost<\/h3>\n\n

            Instead of analyzing spam after<\/em> it hits your database, SyGy Security Log & Anti-Bot<\/strong> verifies how<\/em> the user interacts with your form:<\/p>\n\n

              \n
            1. Per-Site Cryptographic Split Token (HMAC-SHA256<\/code>):<\/strong> A tiny, dependency-free inline JavaScript snippet dynamically assembles and injects a site-unique HMAC-SHA256<\/code> validation token into your forms upon page load (DOMContentLoaded<\/code>) and real human interaction (focusin<\/code>, pointerdown<\/code>, submit<\/code>).<\/li>\n
            2. Instant HTTP 403 Termination:<\/strong> When a request reaches your server without the behavioral token, the plugin verifies the signature via timing-safe hash_equals()<\/code> and terminates bot execution immediately with an HTTP 403 Forbidden<\/strong> response.<\/li>\n
            3. Untouched Database:<\/strong> MySQL is never queried for spam storage, external APIs are never called, and legitimate human visitors never see a single CAPTCHA puzzle.<\/li>\n<\/ol>\n\n

              All-in-One Ecosystem Protection (10 Auto-Detecting Modules)<\/h3>\n\n

              You don't need five different anti-spam plugins. SyGy Security Log & Anti-Bot<\/strong> uses conditional loading to automatically protect the plugins you already use, with zero overhead<\/strong> for modules you don't have installed:<\/p>\n\n

                \n
              • WordPress Native Comments:<\/strong> Full protection for standard themes and custom templates built with Elementor, Divi, Bricks, WPBakery<\/strong>, and Gutenberg blocks ([WP-COMMENTS]<\/code>).<\/li>\n
              • WordPress Native User Registration:<\/strong> Protects both Single Site (wp-login.php?action=register<\/code>) and Multisite (wp-signup.php<\/code>) against automated fake account creation ([WP-REGISTER]<\/code>).<\/li>\n
              • WooCommerce (Reviews & Customer Registration):<\/strong> Protects product reviews ([WOOCOMMERCE]<\/code>) and My Account registration forms ([WC-REGISTER]<\/code>), plus adds a direct Open Anti-Bot Log<\/strong> shortcut inside Products > Reviews<\/em>.<\/li>\n
              • Contact Form 7 (CF7):<\/strong> Hooks seamlessly into wpcf7_spam<\/code> to silently block automated contact form floods ([CF7]<\/code>).<\/li>\n
              • WPForms:<\/strong> Protects all WPForms Lite and Pro submissions ([WPFORMS]<\/code>).<\/li>\n
              • Elementor Pro Forms:<\/strong> Shields Elementor Pro contact and lead forms before emails are sent or entries are saved ([ELEMENTOR-FORM]<\/code>).<\/li>\n
              • wpForo Forums:<\/strong> Protects both new forum topics ([WPFORO-TOPIC]<\/code>) and thread replies ([WPFORO-REPLY]<\/code>).<\/li>\n
              • bbPress Forums:<\/strong> Protects new forum topics ([BBPRESS-TOPIC]<\/code>) and thread replies ([BBPRESS-REPLY]<\/code>).<\/li>\n
              • BuddyPress & Ultimate Member:<\/strong> Shields community registration pages ([BUDDYPRESS-SIGNUP]<\/code> and [ULTIMATE-MEMBER]<\/code>) from fake bot profiles.<\/li>\n<\/ul>\n\n

                Key Strengths & Enterprise Features<\/h3>\n\n
                  \n
                • Native Control Panel under Tools > SyGy Anti-Bot:<\/strong> Zero external CSS or JS files. View live protection status across all 10 ecosystems, manage logging preferences, and monitor log file size from a clean native dashboard.<\/li>\n
                • Smart 3-Tier Diagnostic Log (BOT BLOCKED<\/code>, HUMAN ACCEPTED<\/code>, USER ACCEPTED<\/code>):<\/strong> By default, the log records blocked bots (BOT BLOCKED<\/code>) and anonymous guest submissions (HUMAN ACCEPTED<\/code>), while skipping legitimate actions from already logged-in members so busy forums and communities never bloat the log file. Need to debug logged-in users? Enable [USER ACCEPTED]<\/code> logging per-site with one click in Tools > SyGy Anti-Bot<\/em>!<\/li>\n
                • Advanced WordPress Multisite Architecture (Centralized or Split-per-Subsite Logs):<\/strong> Each subsite has independent logging toggles. Furthermore, Super Admins can choose between a Single Centralized Network Log<\/strong> (default) or Isolated Per-Subsite Logs<\/strong> (Multi-Tenant mode, where each subsite stores and manages its own encrypted log file independently, with automatic subsite file cleanup if reverted).<\/li>\n
                • Immune to Source-Code Inspection:<\/strong> Every WordPress installation generates its own cryptographic HMAC-SHA256<\/code> token split in JavaScript. Even if an attacker downloads the plugin source code, they cannot craft a universal cURL bypass payload.<\/li>\n
                • 100% Page Cache & \"Delay JS\" Compatible:<\/strong> Works flawlessly with WP Rocket, LiteSpeed Cache, W3 Total Cache, WP Fastest Cache, SiteGround Optimizer, Varnish, and Cloudflare<\/strong>. Automatically flushes major caches upon activation.<\/li>\n
                • Triple-Layer GDPR Log Security:<\/strong> Stored in \/wp-content\/uploads\/sygy-security-logs\/<\/code> and shielded via Apache .htaccess<\/code> (Require all denied<\/code>), index.php<\/code>, and a 16-character cryptographic random filename hash<\/strong> (protecting Nginx servers as well).<\/li>\n
                • 10 MB Auto-Rotation (DDoS Safe) & 512 KB Tail Reader:<\/strong> Automatically rotates the log file at 10 MB to prevent disk exhaustion during massive botnet attacks, and uses fseek()<\/code> to read the last 512 KB without ever exhausting PHP RAM.<\/li>\n<\/ul>","raw_excerpt":"Proactive Anti-Bot shield for WP Comments, WooCommerce, CF7, WPForms, Elementor, wpForo, bbPress & BuddyPress with GDPR logging.","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin\/385523","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin"}],"about":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/types\/plugin"}],"replies":[{"embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/comments?post=385523"}],"author":[{"embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wporg\/v1\/users\/sygy88"}],"wp:attachment":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/media?parent=385523"}],"wp:term":[{"taxonomy":"plugin_section","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_section?post=385523"},{"taxonomy":"plugin_tags","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_tags?post=385523"},{"taxonomy":"plugin_category","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_category?post=385523"},{"taxonomy":"plugin_contributors","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_contributors?post=385523"},{"taxonomy":"plugin_business_model","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_business_model?post=385523"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}