ProofShield Documentation
ProofShield documentation for installation, setup, operation and troubleshooting of the WordPress bot protection plugin.
What is ProofShield?
ProofShield protects critical WordPress actions from automated bot requests. Instead of making normal page views heavier, it secures risky points such as login, comments, custom forms and optional integrations.
Before submission, the browser creates a local proof-of-work token. Bots without a valid proof are rejected while real visitors should barely notice the protection.
Installation
Open ProofShield through the official checkout or customer area and download the plugin there.
Install the package in WordPress via Plugins -> Add New -> Upload Plugin, activate it and open the ProofShield menu in the WordPress admin.
Quick start
Keep login protection enabled, start with Balanced mode and test the login in a second browser window.
If comments or custom forms are used, enable the matching protection areas and watch the statistics after a few days.
Settings
The main protection areas are login, comments and generic forms. Generic forms are connected with CSS selectors.
Relaxed is more comfortable, Balanced is the recommended default and Strict is useful under higher attack pressure.
| Field | Description | Recommendation |
|---|---|---|
| Protect login | Enables proof-of-work for the WordPress login. | Keep enabled. This is the most important free protection area. |
| Login lockout: failed attempts | Defines how many failed logins trigger a temporary lockout. | Start moderately and lower the threshold under active attack. |
| Login lockout: duration in minutes | Controls how long an IP remains blocked after too many failed attempts. | Short enough for real users, long enough to slow brute force. |
| Protect comments | Adds proof-of-work to comment forms. | Enable when public comments are allowed. |
| Protect contact forms (Pro) | Protects supported contact form plugins. | Enable for public contact forms. |
| Protect WooCommerce login (Pro) | Extends login protection to WooCommerce account and checkout contexts. | Useful for shops with customer accounts. |
| Generic forms | Connects custom forms through CSS selectors. | Configure selectively and test afterwards. |
| Mode | Controls proof-of-work difficulty: Relaxed, Balanced or Strict. | Use Balanced by default, Strict under high bot pressure. |
| Automatic protection level (Pro) | Adjusts difficulty based on observed activity. | Helpful for production sites with changing traffic patterns. |
| Token lifetime (Pro) | Defines how long a generated proof remains valid. | Do not set longer than needed. |
| Logging | Stores protection events for statistics and troubleshooting. | Enable when statistics or debugging are needed. |
| Weekly statistics report (Pro) | Sends a regular summary of protection activity. | Useful for operators who do not check the dashboard daily. |
| Progressive login lockout | Increases lockout periods after repeated failed attempts. | Enable when brute-force attempts are visible. |
| Secure+ (Pro) | Adds additional checks for more demanding protection scenarios. | For heavily attacked sites or login-heavy projects. |
| Location statistics | Stores anonymized origin information for reporting. | Enable only when documented in your privacy policy. |
| Show world map | Visualizes detected countries in the statistics area. | Optional; not required for operation. |
| Trusted IPs | Excludes known own or administrative IPs from protection. | Only add stable and truly trusted IPs. |
| AJAX/REST protection (Pro/Beta) | Protects selected AJAX actions and REST routes. | Enable carefully and test every protected route. |
| Auto-protect for AJAX/REST (Pro/Beta) | Automatically detects endpoints that may need protection. | Validate in a staging environment first. |
| AJAX actions, REST routes and exceptions (Pro/Beta) | Explicitly defines protected or excluded endpoints. | Configure precisely to avoid blocking integrations. |
Reading statistics
The statistics show allowed and blocked requests, block reasons, context distribution and optional anonymized location data.
After setup, pay attention to the block rate, median solve time and the context where attacks occur.
Frontend behavior
Visitors should ideally notice the protection only as a short status message or not at all. The proof is generated in the browser and attached before submission.
If JavaScript is missing or blocked, ProofShield shows a clear warning so real users understand why the form cannot be submitted.
Privacy and GDPR
The core check runs locally on the WordPress site. Location statistics and world map are optional.
Document whether ProofShield statistics, anonymized location analysis, Freemius opt-in or external geo services are used in the privacy policy.
Troubleshooting
If a form does not submit, check JavaScript, cache/minify plugins and the configured form selector.
If users are unexpectedly blocked, test Balanced or Relaxed, review login thresholds and add known administrative IP ranges as trusted.
Support checklist
Have your WordPress version, PHP version, ProofShield version, active theme and relevant form, cache or security plugins ready.
Screenshots, the test time and excerpts from debug.log or hosting error logs filtered for ProofShield are also helpful.