{"id":10977,"date":"2026-05-23T21:29:58","date_gmt":"2026-05-23T13:29:58","guid":{"rendered":"https:\/\/aeosub.com\/trustsig-security\/"},"modified":"2026-05-23T21:29:58","modified_gmt":"2026-05-23T13:29:58","slug":"trustsig-security","status":"publish","type":"post","link":"https:\/\/aeosub.com\/zh\/trustsig-security\/","title":{"rendered":"TrustSig Security"},"content":{"rendered":"
\n\n\n\n\n\n\n\n
Developer<\/th>\ntrustsig<\/a><\/td>\n<\/tr>\n
Version<\/th>\nv1.2.8<\/td>\n<\/tr>\n
Active Installs<\/th>\n0 +<\/td>\n<\/tr>\n
Requires \/ Tested<\/th>\n5.0 \/ 6.9.4<\/td>\n<\/tr>\n
Last Updated<\/th>\n2026-05-23 1:26pm GMT<\/td>\n<\/tr>\n
Official Link<\/th>\nView Details \u2192<\/a><\/td>\n<\/tr>\n<\/table><\/div>\n
Stop bots, spam and brute-force attacks on every WordPress form. No CAPTCHA. No account. No keys. Installs and protects in one click.<\/div>\n

TrustSig Security blocks scripted bots before they ever reach your site \u2014 silently, with zero friction for real visitors.<\/strong> No puzzles. No “I am not a robot” checkboxes. No third-party signup required to start.<\/p>\n

<\/a>
\n<\/a>
\n<\/a><\/p>\n

Why TrustSig<\/h4>\n
    \n
  • \ud83d\udee1\ufe0f Protects every important form out of the box<\/strong> \u2014 login, registration, comments, password reset, WooCommerce checkout, BuddyPress signup, Easy Digital Downloads, Elementor Pro forms, and any custom form via shortcode.<\/li>\n
  • \ud83d\udeab Stops brute-force login attempts<\/strong> with built-in lockout after repeated failures.<\/li>\n
  • \ud83d\udc7b Invisible to humans<\/strong> \u2014 real visitors are verified in under a second by a non-interactive browser check. No CAPTCHA, no images to click.<\/li>\n
  • \u2699\ufe0f Three protection modes<\/strong> \u2014 Monitor (log only), Challenge (default, soft block with auto-retry), Enforce (hard block).<\/li>\n
  • \ud83d\udd0c Zero configuration<\/strong> \u2014 activate the plugin and protection is live immediately. Anonymous free tier needs no account.<\/li>\n
  • \ud83e\udde9 Works with caching plugins, WPML, multisite and most themes<\/strong> \u2014 forms are signed server-side with a per-site secret.<\/li>\n
  • \ud83d\udee0\ufe0f Developer-friendly<\/strong> \u2014 PHP helper trustsig_verify()<\/code>, REST endpoint \/wp-json\/trustsig\/v1\/verify<\/code>, filters and actions for custom forms.<\/li>\n
  • \ud83d\udd12 Optional admin-ajax and REST API guard<\/strong> for advanced sites.<\/li>\n
  • \ud83d\udcdc GPLv2<\/strong> \u2014 fully open source.<\/li>\n<\/ul>\n

    How it works<\/h4>\n

    TrustSig injects a lightweight browser SDK, signs every rendered form with a per-site secret, and verifies submissions against the TrustSig Edge service. Real visitors pass an invisible check in about a second; scripted clients that never run JavaScript are stopped.<\/p>\n

    When a request arrives without a valid token, TrustSig does not silently fail
    \nopen. Depending on the mode you choose it serves a lightweight “please wait”
    \ninterstitial that re-verifies the browser and then transparently continues the
    \noriginal request \u2014 or blocks it.<\/p>\n

    The plugin works out of the box with no account and no API keys<\/strong> (anonymous
    \nfree tier). Connecting a TrustSig dashboard account is optional and only adds
    \nanalytics and higher limits.<\/p>\n

    Protection modes<\/h4>\n
      \n
    • Monitor<\/strong> \u2014 verify and log only, never block. Used for safe rollout; the
      \nupgrade path also pins existing sites here so behaviour never changes
      \nsilently on update.<\/li>\n
    • Challenge<\/strong> (default for new installs) \u2014 a missing or invalid token shows
      \nthe interstitial, then continues or blocks.<\/li>\n
    • Enforce<\/strong> \u2014 a missing or invalid token is blocked immediately.<\/li>\n<\/ul>\n

      What it protects<\/h4>\n

      Browser forms are protected automatically with no code:<\/p>\n

        \n
      • WordPress core \u2014 login, registration, comments, lost\/reset password<\/li>\n
      • WooCommerce \u2014 login, registration, checkout, pay order, lost password<\/li>\n
      • BuddyPress \u2014 registration<\/li>\n
      • Easy Digital Downloads \u2014 login, registration<\/li>\n
      • Elementor Pro forms<\/li>\n
      • Any other form (site-wide “protect all forms” option, the [trustsig_form]<\/code>
        \nshortcode, or a hidden trustsig-response<\/code> input)<\/li>\n<\/ul>\n

        It also includes optional brute-force lockout for repeated failed logins, an
        \nopt-in admin-ajax \/ REST API guard, and a developer verification API.<\/p>\n

        For developers<\/h4>\n
          \n
        • PHP: trustsig_verify( array( 'token' => $t, 'action' => 'my_form' ) )<\/code>
          \nreturns pass<\/code> | fail<\/code> | challenge<\/code>. Filters: trustsig_pre_verify<\/code>,
          \n trustsig_result. Action: trustsig_blocked<\/code>.<\/li>\n
        • REST: POST \/wp-json\/trustsig\/v1\/verify<\/code> with { \"token\": \"...\" }<\/code>.<\/li>\n<\/ul>\n

          Known limitations<\/h4>\n
            \n
          • XML-RPC (xmlrpc.php<\/code>) is intentionally out of scope and is not verified.
            \nDisable XML-RPC separately if it is unused on your site.<\/li>\n
          • admin-ajax and the REST API are only protected when explicitly enabled in
            \nSettings, to avoid breaking third-party integrations.<\/li>\n
          • File-upload and AJAX submissions cannot show the interstitial; under
            \nChallenge or Enforce mode a missing token on those is blocked, never
            \nsilently allowed.<\/li>\n<\/ul>\n

            External services<\/h3>\n

            This plugin relies on the TrustSig Edge<\/strong> service to decide whether a request
            \ncomes from a human or an automated client. This bot-detection verdict cannot be
            \nproduced locally, so the service is required for the plugin’s core
            \nfunctionality.<\/p>\n

            Service provider:<\/strong> TrustSig \u2014 https:\/\/trustsig.eu<\/p>\n

            Remote script loaded in the browser:<\/strong>
            \n https:\/\/edge.trustsig.eu\/trustsig.js is loaded on pages that contain a
            \nprotected form, on the login screen, and on the verification interstitial. The
            \nscript runs the non-interactive browser check and produces a verification
            \ntoken.<\/p>\n

            Data sent from the visitor’s browser \/ your server to
            \n https:\/\/edge.trustsig.eu\/verify:<\/strong><\/p>\n

              \n
            • the TrustSig verification token generated by the SDK in the visitor’s browser;<\/li>\n
            • your site’s host name (e.g. example.com<\/code>) on the anonymous free tier, or, if
              \nyou connect a dashboard account, the secret key you entered;<\/li>\n
            • as part of any HTTPS request, the visitor’s IP address and standard request
              \nmetadata (such as the user-agent) are visible to the service.<\/li>\n<\/ul>\n

              When data is sent:<\/strong> when the SDK loads on a protected page, when a protected
              \nform is submitted, and once per browser when the optional verified-session
              \ncookie is bootstrapped.<\/p>\n

              Data stored locally on your site:<\/strong> TrustSig writes a verification log to
              \nyour own WordPress database (custom tables) that includes visitor IP addresses,
              \nthe action attempted, and the verdict. This data is not sent to TrustSig; you
              \ncan clear it at any time from Settings \u2192<\/span> TrustSig \u2192<\/span> Tools.<\/p>\n

              By installing and activating this plugin you (the site administrator) consent to
              \nthis data being sent to TrustSig so that requests can be verified. Inform your
              \nown site’s visitors as required by your local privacy obligations.<\/p>\n

                \n
              • Terms of Service: https:\/\/trustsig.eu\/terms-of-service\/<\/li>\n
              • Privacy Policy: https:\/\/trustsig.eu\/privacy<\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"

                Stop bots, spam and brute-force attacks on every WordPress form. No CAPTCHA. No account. No keys. Installs and protects in one click.<\/p>","protected":false},"author":1,"featured_media":9317,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[252],"tags":[1391,1101,664,1033,569,555],"class_list":["post-10977","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-trends","tag-bot-protection","tag-brute-force","tag-security","tag-spam","tag-woocommerce","tag-wordpress-plugin"],"_links":{"self":[{"href":"https:\/\/aeosub.com\/zh\/wp-json\/wp\/v2\/posts\/10977","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/aeosub.com\/zh\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/aeosub.com\/zh\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/aeosub.com\/zh\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/aeosub.com\/zh\/wp-json\/wp\/v2\/comments?post=10977"}],"version-history":[{"count":0,"href":"https:\/\/aeosub.com\/zh\/wp-json\/wp\/v2\/posts\/10977\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/aeosub.com\/zh\/wp-json\/wp\/v2\/media\/9317"}],"wp:attachment":[{"href":"https:\/\/aeosub.com\/zh\/wp-json\/wp\/v2\/media?parent=10977"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/aeosub.com\/zh\/wp-json\/wp\/v2\/categories?post=10977"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/aeosub.com\/zh\/wp-json\/wp\/v2\/tags?post=10977"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}