Bot Lockout vs Crovly – Proof of Work Captcha & Spam Protection

Bot Lockout is a security plugin that implements a lightweight cryptographic challenge system to distinguish between real browsers and automated bots. Unlike traditional CAPTCHA systems, it uses JavaScript-based cryptographic operations that are easy for humans but difficult for most bots to solve. Key Features Lightweight Protection: Uses minimal resources and doesn’t impact site performance Cryptographic Challenges: SHA-256 hashing with date and user agent binding Smart Whitelisting: Allow trusted bots (Google, Bing, etc.) and IP addresses Flexible Configuration: Exclude specific pages and customize block messages Comprehensive Logging: Track blocked attempts for analysis Custom Styling: Add custom CSS to match your site’s design Daily Token Expiration: Prevents long-term bypass attempts How It Works Initial Request: When a visitor accesses your site, the plugin checks for a valid challenge token JavaScript Challenge: If no token exists, a cryptographic challenge is presented Token Generation: The challenge combines the current date with the user agent string and creates a SHA-256 hash Secure Storage: The hash is base64 encoded, truncated, and stored as a secure cookie Validation: Subsequent requests are validated against the stored token Security Features Cryptographically Secure: Uses SHA-256 hashing algorithm Time-Bound: Tokens expire daily to prevent long-term bypass Browser-Specific: User agent binding prevents token sharing Secure Cookies: Implements proper cookie security settings Whitelist Support: Allow trusted services and IP addresses Multi-Site Support Bot Lockout supports WordPress Multi-Site installations with both network-wide and site-specific configurations: Network Activation: Apply settings to all sites in the network Site-Specific Activation: Independent settings for each site Mixed Configuration: Network-wide defaults with site-specific overrides Security Advisory Bot Lockout is one layer in a broader security strategy, not a silver bullet. While Bot Lockout is designed to deter automated bots and AI scrapers through cryptographic JavaScript challenges, no single solution can offer complete protection. Web scraping technologies continue to evolve, and determined actors may find ways to bypass front-end defenses. This plugin should be used as part of a multi-layered approach to website security. For best results, we recommend combining Bot Lockout with additional tools such as server-level firewalls, rate limiting, CAPTCHA systems, behavior-based threat detection, and CDN-level bot mitigation. Kognetiks makes no guarantee that this plugin will block all unwanted bot traffic. It is intended as a proactive, lightweight defense mechanism—not a comprehensive security system. Users are responsible for evaluating their own threat model and deploying appropriate complementary protections. Support For support, please visit the WordPress.org support forums or check the plugin documentation. Credits Developer: Kognetiks This plugin is licensed under the GPL v3 or later.

Crovly is a privacy-first captcha service powered by Proof of Work. Unlike traditional captchas that rely on image puzzles (easily solved by AI) or invasive tracking, Crovly makes the visitor’s browser do computational work to prove it’s not a bot. How it works: Your visitor’s browser solves a small cryptographic puzzle (Proof of Work) Browser fingerprint and environment signals are collected (as a hash — no personal data stored) Behavioral analysis detects automated patterns (mouse, keyboard, scroll) A composite score determines if the visitor is human Key features: Privacy-friendly — No cookies, no cross-site tracking No image puzzles — Invisible to legitimate users Resistant to AI vision attacks — Proof of Work cannot be solved by image recognition IP binding — Tokens are bound to the solver’s IP address Adaptive difficulty — Suspicious visitors receive harder challenges 22+ integrations — Works with major WordPress form plugins Lightweight — Widget is under 25KB gzipped, zero dependencies, 42 languages Supported integrations: WordPress login, registration, lost password, comments WooCommerce (checkout, login, register, lost password, pay for order) Contact Form 7 WPForms Gravity Forms Elementor Pro Forms Ninja Forms Fluent Forms Formidable Forms Forminator Jetpack Contact Form Divi (contact form, login) BuddyPress (registration, activity) bbPress (topics, replies) Ultimate Member (login, register, password reset) MemberPress (checkout, login) Paid Memberships Pro Easy Digital Downloads Mailchimp for WordPress GiveWP wpDiscuz wpForo WordPress Multisite signup Shortcode & PHP support: Use [crovly] shortcode in any page or post, or call crovly_render() and crovly_verify() in your theme templates. External services This plugin relies on the Crovly captcha service to function. It connects to two external endpoints: 1. Crovly Widget CDN (get.crovly.com) The plugin loads the JavaScript widget from https://get.crovly.com/widget.js on any page that contains a protected form. The widget runs Proof of Work in the visitor’s browser and collects a hashed browser fingerprint. When: Loaded on frontend pages that display a protected form (login, register, comment, checkout, etc.) What is sent: Standard HTTP request headers (IP address, user agent). No personal data. Terms of Service: https://crovly.com/terms Privacy Policy: https://crovly.com/privacy 2. Crovly Verification API (api.crovly.com) When a visitor submits a protected form, the plugin sends the generated captcha token to https://api.crovly.com/verify-token for server-side verification. When: On form submission of any form protected by Crovly. What is sent: The captcha token (opaque string), the visitor’s IP address (for IP binding), and your Secret Key (for authentication). What is received: A success/failure response indicating whether the token is valid. Terms of Service: https://crovly.com/terms Privacy Policy: https://crovly.com/privacy Both services are operated by Crovly. No data is shared with third parties. The plugin does not set cookies or track visitors across sites.