TrustSig Security vs WindCodex ScraperBlock – Block AI Scrapers & Bots from WordPress & WooCommerce

TrustSig Security stops scripted bots and brute-force attacks on WordPress forms and API endpoints. There are no puzzles to solve and no “I am not a robot” checkboxes to tick, and you do not have to sign up for anything before it starts working. What exactly gets checked depends on the protection mode you pick, described below. Why TrustSig Covers the forms that matter out of the box: login, registration, comments, password reset, WooCommerce checkout, BuddyPress signup, Easy Digital Downloads, Elementor Pro forms, WPForms (including the Mesmerize and Materialis contact form), Contact Form 7, SureForms, plus any custom form via a shortcode. Locks out brute-force login attempts after repeated failures. Real visitors never notice it. The browser check runs on its own and finishes in about a second, with no images to click. Three protection modes: Monitor logs and never blocks, Challenge (the default) shows a short interstitial and retries, Enforce blocks outright. Nothing to configure. Activate the plugin and protection is live. The anonymous free tier needs no account. Works with caching plugins, WPML, multisite and most themes, because forms are signed server-side with a per-site secret. A developer API: the PHP helper trustsig_verify(), the REST endpoint /wp-json/trustsig/v1/verify, and filters and actions for custom forms. An optional guard for admin-ajax and the REST API on sites that need it. An optional scan-on-submit mode that runs the browser check only when a visitor actually uses a form, not on every page view. GPLv2, fully open source. How it works TrustSig loads a small browser SDK, signs every rendered form with a per-site secret, and checks submissions against the TrustSig Edge service. A real visitor passes the check in about a second without doing anything. A scripted client that never runs JavaScript produces no token and gets stopped. When a request arrives without a valid token, the plugin does not quietly wave it through. Depending on the mode, it either serves a short “please wait” page that re-verifies the browser and then continues the original request, or blocks it. No account and no API keys are needed; the anonymous free tier is the default. Connecting a TrustSig dashboard account is optional and only adds analytics and higher limits. Protection modes Monitor: verify and log only, never block. Good for a safe rollout. Upgrades also pin existing sites here, so behaviour never changes silently on update. Challenge (default for new installs): a missing or invalid token triggers the interstitial, which then continues or blocks. Enforce: a missing or invalid token is blocked immediately. What it protects Browser forms are covered automatically, no code needed: WordPress core: login, registration, comments, lost and reset password WooCommerce: login, registration, checkout, pay order, lost password BuddyPress: registration Easy Digital Downloads: login, registration Elementor Pro forms WPForms: contact and other forms, on by default (this also covers the Mesmerize and Materialis contact section) Contact Form 7: feedback submissions, on by default, guarded on the REST endpoint CF7 submits to SureForms: form submissions, on by default, guarded on the REST submit-form endpoint Anything else via the site-wide “protect all forms” option, the [trustsig_form] shortcode, or a hidden trustsig-response input On top of that there is an optional brute-force lockout for repeated failed logins, an opt-in guard for admin-ajax and the REST API, and a verification API for developers. For developers PHP: trustsig_verify( array( ‘token’ => $t, ‘action’ => ‘my_form’ ) ) returns pass, fail or challenge. Filters: trustsig_pre_verify, trustsig_result. Action: trustsig_blocked. REST: POST /wp-json/trustsig/v1/verify with { “token”: “…” }. Known limitations XML-RPC (xmlrpc.php) is deliberately out of scope and is not verified. If your site does not use XML-RPC, disable it separately. admin-ajax and the REST API are only guarded when you enable that in Settings. This is on purpose, so third-party integrations do not break the moment you install the plugin. File uploads and AJAX submissions cannot show the interstitial. In Challenge or Enforce mode a missing token on those is blocked. It is never silently allowed. External services This plugin relies on the TrustSig Edge service to decide whether a request comes from a human or an automated client. That verdict cannot be produced locally, so the service is required for the plugin to do its job. Service provider: TrustSig, https://trustsig.eu Remote script loaded in the browser: https://edge.trustsig.eu/trustsig.js loads on pages that contain a protected form, on the login screen, and on the verification interstitial. It runs the non-interactive browser check and produces a verification token. Data sent from the visitor’s browser or your server to https://edge.trustsig.eu/verify: the TrustSig verification token generated by the SDK in the visitor’s browser; your site’s host name (for example example.com) on the anonymous free tier, or the secret key you entered if you connect a dashboard account; as with any HTTPS request, the visitor’s IP address and standard request metadata such as the user agent are visible to the service. When data is sent: when the SDK loads on a protected page, when a protected form is submitted, and once per browser when the optional verified-session cookie is bootstrapped. Data stored locally on your site: TrustSig writes a verification log to your own WordPress database (custom tables) with visitor IP addresses, the action attempted, and the verdict. This log is not sent to TrustSig, and you can clear it at any time under Settings, TrustSig, Tools. By installing and activating this plugin you, the site administrator, consent to this data being sent to TrustSig so that requests can be verified. Inform your own visitors as your local privacy obligations require. Terms of Service: https://trustsig.eu/terms-of-service/ Privacy Policy: https://trustsig.eu/privacy

WindCodex ScraperBlock is a free WordPress plugin that blocks AI scrapers, content crawlers, and unwanted bots from harvesting your site. Protect blog posts, product pages, and proprietary content from being fed into AI training datasets – without slowing your site down for real visitors. Setup takes under two minutes: install, enable the protections you want, save. Why Your Site Needs Bot Protection AI crawlers – including GPTBot (OpenAI), ClaudeBot (Anthropic), Google-Extended, ByteSpider, CCBot (Common Crawl), and dozens more – continuously scrape WordPress sites for training data. For content creators, WooCommerce store owners, and publishers, this means: Your original content gets harvested and used without permission or attribution. AI training traffic inflates your server load and bandwidth costs. WooCommerce store owners face a specific threat – price bots and competitor scrapers continuously harvest product prices, stock levels, and catalog data to undercut your pricing in real time. Proprietary product descriptions, pricing strategies, and business data are exposed to competitors and AI systems. Scraper traffic can mask real user patterns in your analytics. ScraperBlock gives you practical, layered defences against these threats – all from one settings screen. Free Features Protection Controls * Master protection switch – Enable or disable all ScraperBlock protections with a single toggle. * 50+ default bot signatures – Pre-loaded, categorized list of known AI scrapers, content crawlers, and price bots including GPTBot (OpenAI), ClaudeBot (Anthropic), Google-Extended, ByteSpider (ByteDance), CCBot (Common Crawl), Diffbot, PerplexityBot, and more. Maintained and updated regularly. * Custom user-agent rules – Add your own bot signatures, one per line. Target bots not in the default list. Blocking Methods * Runtime user-agent blocking – Intercepts matching bots at the PHP layer before any content is served. Works on all server types. * robots.txt blocking – Automatically injects Disallow directives for blocked bots into your robots.txt file. Signals crawlers to stay away before they visit. * Apache .htaccess blocking – Adds server-level RewriteRule blocks for matched user-agents. Stops bots before they reach PHP (Apache only). AI Opt-Out Meta Tags * noai and noimageai meta tags – Outputs on your pages. Signals AI training opt-out to crawlers that respect meta directives. * Per-page meta control – Override protection settings on individual posts and pages using a meta box in the editor. Enable, disable, or customize protection per page. Monitoring * Basic block log – Stores the last 50 blocked request events with IP, user-agent, URL path, reason, and timestamp. * Live dashboard count – Shows a basic count of blocked requests from the last 24 hours. See activity at a glance without leaving wp-admin. * Basic rate limiting – Limit request frequency from individual IPs to reduce scraper throughput. Who Needs ScraperBlock? Bloggers and content creators – Protect original articles and creative work from AI training scrapes. WooCommerce store owners – Block competitor price scrapers and AI bots that harvest product prices, descriptions, and stock levels to undercut your pricing or feed your catalog into AI systems. News and media publishers – Opt out of AI content aggregation and training dataset inclusion. Membership and course sites – Prevent paid content from being scraped by bots that bypass login pages via API or sitemap traversal. Agencies – Deploy consistent bot protection across client sites. How It Works Install and activate ScraperBlock. Go to Settings > ScraperBlock. Enable the protection modules you want (runtime blocking, robots.txt, meta tags, per-page control). Save settings. Monitor blocked requests in the Logs panel and Dashboard count widget. 🚀 Pro Version Need content poisoning, honeypot traps, behavioural detection, real-time threat feed, geo-based blocking, IP allowlists, block scheduling, and advanced analytics? ScraperBlock Pro is available at windcodex.com ScraperBlock Pro adds advanced features for high-traffic sites and serious content protection: Content poisoning – Serve subtly corrupted content to detected scrapers, degrading the value of stolen data. Honeypot traps – Invisible links that only bots follow – automatically flag and block crawlers. Behavioural detection – Identify bots by traffic pattern, not just user-agent string. Real-time threat feed – Cloud-updated block list with new bot signatures pushed automatically. Geo-based blocking – Block all traffic from specific countries at the application layer. IP allowlists & blocklists – Block individual IP addresses and CIDR ranges in addition to user-agents. Block scheduling – Define time windows when protection is active or relaxed. Advanced analytics – Full traffic breakdown by bot, country, URL, and time range with CSV export. Requirements WordPress 5.8 or higher PHP 7.4 or higher Apache is required only for .htaccess blocking mode. All other modes work on any server. Privacy ScraperBlock stores technical security data (IP address, user-agent string, URL path, block reason, action, and timestamp) in your WordPress database for local monitoring purposes. The free plugin does not require or contact any third-party API. No data is transmitted off your server.