by Rajan Vijayan 1 (0 reviews)

ShieldCraft – Invisible Spam Protection

Name: ShieldCraft – Invisible Spam Protection
Author: Rajan Vijayan

Stops spam in comments, registration, WooCommerce and contact forms. No CAPTCHA, no external services. Formerly WP Spam Protecter. Free.

ShieldCraft ranks #70,456 among WordPress.org plugins with 1+ active installations, is #2,219 of 2,958 in the Discussion & Community category, a 1/5 rating from 0 reviews, and was last updated Oct 24, 2026. Data from WordPress.org, refreshed twice daily — see methodology.

Compatible with WP 7.1

v2.0.0 Current Version v2.0.0

Updated 2 weeks ago Last Update on 24 Oct, 2026

Refreshed 1 week ago Last Refreshed on

#2,219 of 2,958 in Discussion & Community Downloads -79.5% this week Actively maintained

View on WordPress.org

Rank

#70,456

— No change

Active Installs

-66.7%

KW Avg Position

N/A

— No change

Downloads

1.1K

+2 today

Support Resolved

— No change

Rating

20%

Review 1 out of 5

1 (0 reviews)

Next Milestone 10

Total Progress 10%

0+ 10+

57,519

Ranks to Climb

Growth Needed

8,000,000

Active Installs

Pro

Unlock Exact Install Count

See the precise estimated active installs for this plugin, calculated from real-time ranking data.

Exact install estimates within tiers
Track install growth over time
Milestone progress predictions

Upgrade to Pro

Need 9 more installs to reach 10+

Rank Changes

Current #70,456

Change

Best #

Upgrade to Pro

Unlock 30-day and 90-day rank history charts with a Pro subscription.

Upgrade Now

Active Installs Growth

Upgrade to Pro

Active Installs 0,000,000+

Growth +0.0%

Peak 0,000,000

Downloads Growth

Downloads

Growth

Peak

Upgrade to Pro

Unlock 30-day, 90-day, and yearly download history charts with a Pro subscription.

Upgrade Now

Reviews & Ratings

1.0

0 reviews

Overall 20%

0 (0%)

Track This Plugin

Get detailed analytics, keyword tracking, and position alerts delivered to your inbox.

Start Tracking Free

Plugin Details

Version: 2.0.0
Last Updated: Oct 24, 2026
Requires WP: 6.5+
Tested Up To: 7.1
PHP Version: 7.4 or higher
Author: Rajan Vijayan

Support & Rating

Rating: ★ ☆ ☆ ☆ ☆ 1
Reviews: 0
Support Threads: 0
Resolved: 0%

Keywords

anti-spam comments contact form honeypot spam

Upgrade to Pro

Unlock keyword rankings, search positions, and detailed analytics with a Pro subscription.

Upgrade Now

Similar Plugins

Adminify – White Label, Admin Menu Editor, Login Customizer

6K+ installs

#2,757

Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits

30K+ installs

#1,015

Akismet Anti-spam: Spam Protection

5M+ installs

WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More

5M+ installs

Jetpack – AI Agents & MCP, Security, Backup & Analytics

WP-Optimize – Cache, Compress images, Minify & Clean database to boost page speed & performance

View all Discussion-and-community plugins

Frequently Asked Questions

Common questions about ShieldCraft – Invisible Spam Protection

Version 1.0 marked every comment by a logged-in user as spam, and its hidden field rarely caught bots. ShieldCraft replaces it completely. 1.0 stored no data, so there is nothing to move. Comments sent from old cached pages are held for moderation, not lost.

No. The checks are invisible. People who browse without JavaScript can still comment (their comments are held for you to approve) and still log in.

Open Settings → ShieldCraft → Log and choose Not spam. A held or spam comment is approved, and that sender's email address passes from now on (IP addresses are often shared, so they are not trusted). The log shows why each message was stopped, so you can adjust the rule.

Login protection is off by default. When it is on, administrators and editors are always let in, a login is never refused just for missing JavaScript, and XML-RPC, the REST API and application passwords are not affected. A custom login form must print the login_form action or use wp_login_form(). In an emergency, add define( 'SHIELDCRAFT_DISABLE', true ); to wp-config.php to switch every check off.

Yes. The script fetches a fresh token from the REST API (never cached) when the page opens. My site is behind Cloudflare or a proxy. Choose the header that holds the visitor's address under Settings → ShieldCraft → Allowlist and privacy. The page shows what each header holds for your own visit. Only change it if your proxy really sends that header; otherwise visitors could fake their address.

Print the fields inside the form and check the submission where you handle it: <?php shieldcraft_fields( 'api' ); ?> if ( shieldcraft_is_spam( 'api', array( 'email' => $email, 'message' => $message ) ) ) { /* refuse it */ } shieldcraft_check() returns the verdict and the reasons. Add your own context with the `shieldcraft_contexts` filter. Headless front ends can get a token from `GET /wp-json/shieldcraft/v1/token?context=api` and ask `POST /wp-json/shieldcraft/v1/check` from the server that accepts the form.

Yes: shieldcraft_checks adds checks, shieldcraft_verdict changes a verdict, shieldcraft_blocked fires for every stopped submission, shieldcraft_min_seconds changes the time trap per form, shieldcraft_client_ip changes the visitor's address and shieldcraft_blocked_message changes the error message.