Honeypot field (invisible bot trap)

Feature Honeypot field — Adds a hidden field to supported forms; bots that fill it get a heavy score increase. How it works Real users don’t see the field, but many bots autofill all inputs. A filled honeypot is a high-confidence signal and should heavily influence scoring. How to access / enable WP Admin → AegisSpamGuard → Settings Challenges/Forms section (varies by build) Toggle honeypot ON/OFF. Recommended setting Recommended: ON for all forms. It’s low friction, high signal, and rarely impacts real users. Why you need this Admins want strong spam reduction without user-visible challenges—honeypots deliver that. Additional information

Velocity window + limit (burst submissions control)

Feature Velocity controls — Detects burst submissions from the same fingerprint (IP/session/user agent + payload patterns). How it works AegisSpamGuard tracks how many submissions happen within a rolling window. If the limit is exceeded, it adds points and may trigger Challenge/Hold/Block depending on your thresholds. How to access / enable WP Admin → AegisSpamGuard → Settings Set “Velocity window (seconds)” and “Velocity limit (submissions per window)”. Save changes. Recommended setting Recommended: Window 600 seconds and limit 5 to start. This catches spam floods without punishing normal users; tune down only if you see heavy bot bursts. Why you need this Admins need burst controls to stop rapid spam waves and protect performance. Additional information

Min seconds to submit (fast-submit bot signal)

Feature Min seconds to submit — Adds score if a form submits too quickly after page load, which is a common bot pattern. How it works AegisSpamGuard tracks a timestamp/token on supported forms and compares it to submission time. Faster-than-human submits get a score bump. How to access / enable WP Admin → AegisSpamGuard → Settings Site-wide protection / Behavior section (varies by build) Set “Min seconds to submit”. Recommended setting Recommended: 3 seconds default; use 5+ for longer forms. Longer forms take time; raising this reduces false positives on multi-field forms. Why you need this Admins use this to catch automated submissions that bypass simple honeypots. Additional information

Policy thresholds (Allow / Challenge / Hold / Block bands)

Feature Policy thresholds — Defines how a score (0–100) maps to actions: Allow, Challenge, Hold, or Block. How it works AegisSpamGuard produces a risk score from signals and applies your thresholds to decide enforcement. This keeps decisions consistent and easy to tune. How to access / enable WP Admin → AegisSpamGuard → Settings Open “Policy thresholds” Set Allow/Challenge/Hold max scores and save. Recommended setting Recommended defaults: Allow 29, Challenge 59, Hold 79. These are balanced defaults that reduce false positives while still giving strong protection via Hold/Challenge bands. Why you need this Admins need predictable policy bands to match business risk tolerance. Additional information

Allow/Deny by phrases and URLs

Feature Phrase/URL rules — Allow or block content that matches specific phrases or URL patterns commonly used in spam. How it works Phrase rules are checked against normalized message content. URL rules help you block known spam destinations or suspicious shorteners. How to access / enable WP Admin → AegisSpamGuard → Allow/Deny Add a phrase or URL rule Choose Allow or Deny and save. Recommended setting Recommended: Start with Deny rules for repeated spam campaigns you see in the log. Targeted phrase/URL rules stop waves immediately with low false positive risk. Why you need this Admins often see repeating spam templates—phrase/URL rules shut them down fast. Additional information

Allow/Deny by email hash / domain

Feature Email/domain rules — Allow or block submissions by email domain or hashed email identity. How it works AegisSpamGuard can hash email values (privacy-safe). Domain rules are useful for blocking disposable domains or allowing trusted corporate domains. How to access / enable WP Admin → AegisSpamGuard → Allow/Deny Add a rule for an email domain (e.g., example.com) or email identity Choose Allow or Deny and save. Recommended setting Recommended: Block known disposable domains; allow your own business/customer domains. Domain rules are high-signal and low maintenance. Why you need this Admins reduce spam registrations and fake leads by controlling email quality. Additional information

Allow/Deny by IP and CIDR ranges

Feature IP / CIDR rules — Allow or block specific IP addresses or CIDR ranges (e.g., 203.0.113.0/24). How it works CIDR support lets you handle office networks, known providers, or abusive subnets efficiently while keeping the rules list short. How to access / enable WP Admin → AegisSpamGuard → Allow/Deny Add a rule for an IP or CIDR range Choose Allow or Deny and save. Recommended setting Recommended: Allowlist trusted office/VPN IPs; deny only when you have repeated confirmed abuse. Over-blocking IP ranges can affect legitimate users (mobile carriers and shared networks). Why you need this Admins use IP rules to quickly stop persistent offenders and protect internal workflows. Additional information

Allow/Deny lists overview

Feature Allow/Deny lists — Create rules that always allow trusted sources or always block known spam sources. How it works Rules are applied during scoring and (where applicable) during firewall checks. This gives you deterministic control over outcomes regardless of signal noise. How to access / enable WP Admin → AegisSpamGuard → Allow/Deny Recommended setting Recommended: Add allow rules for your team/testing IPs and block repeat offenders. Lists provide immediate control and reduce reliance on heuristic scoring alone. Why you need this Admins need deterministic overrides—especially on business-critical forms and checkout. Additional information

Firewall velocity threshold (10-minute burst control)

Feature Firewall velocity threshold — Limits rapid repeat hits from the same fingerprint within a rolling time window at the firewall layer. How it works If a visitor or bot hits too many pages quickly, AegisSpamGuard can challenge or block before WordPress performs heavier work. How to access / enable WP Admin → AegisSpamGuard → Settings Firewall section Set the “Firewall velocity threshold (10m)” value. Recommended setting Recommended: Start conservative (higher number), then tighten. You don’t want to block legitimate users browsing quickly; tune after watching the Firewall log. Why you need this Admins use this to stop aggressive crawlers, scrapers, and flood behavior. Additional information

Firewall ‘blank page’ response (bot-unfriendly block)

Feature Firewall returns blank page — When blocking at the firewall layer, return a simple blank/fast response instead of a friendly error page. How it works Bots learn from rich error pages; a minimal response is faster and reveals less information while still stopping abusive traffic. How to access / enable WP Admin → AegisSpamGuard → Settings Firewall section Toggle “Firewall returns blank page” ON/OFF. Recommended setting Recommended: ON for public sites. It’s faster and less informative to bots while still being safe for humans (humans rarely see firewall blocks). Why you need this Admins who care about performance and reducing bot feedback loops benefit from this. Additional information

Archives: FAQs | Aegisify - WordPress Tools, Security…

Categories: AegisSpam
Honeypot field (invisible bot trap)
read more
Categories: AegisSpam
Velocity window + limit (burst submissions control)
read more
Categories: AegisSpam
Min seconds to submit (fast-submit bot signal)
read more
Categories: AegisSpam
Policy thresholds (Allow / Challenge / Hold / Block bands)
read more
Categories: AegisSpam
Allow/Deny by phrases and URLs
read more
Categories: AegisSpam
Allow/Deny by email hash / domain
read more
Categories: AegisSpam
Allow/Deny by IP and CIDR ranges
read more
Categories: AegisSpam
Allow/Deny lists overview
read more
Categories: AegisSpam
Firewall velocity threshold (10-minute burst control)
read more
Categories: AegisSpam
Firewall ‘blank page’ response (bot-unfriendly block)
read more

What’s New At Aegisify