XC Shield
Product Details
Description
Stop spam without selling out your visitors' privacy
Most spam-protection plugins make your visitors solve puzzles, or quietly ship their data off to Google. XC Shield does neither. It connects your WordPress site to the Xania Shield API — a privacy-first spam-detection engine that analyses submissions using local statistical methods, not Big Tech surveillance. No CAPTCHAs. No data sold or shared. No cookies, no tracking, no compromise.
⚙️ How it works
When someone submits a form, XC Shield sends a minimal, privacy-respecting fingerprint to the Xania Shield API, which scores it against 14 cumulative detection rules — honeypot traps, disposable-email detection, behavioural signals, datacenter-IP checks, content analysis, and proof-of-work, among others. No single signal blocks a visitor; the engine weighs them together, so legitimate users sail through while bots get stopped. You get a clear verdict — allow, challenge, or block — in under 100 milliseconds.
🧩 Works with the forms you already use
Eleven integrations, one toggle each.
- 🔒 Minimal by design — only a privacy-respecting fingerprint is ever sent, never your full form
- 🚫 No Google, no reCAPTCHA, no Akismet — zero Big Tech dependencies
- ✅ GDPR-compliant by design — send a full email, domain only, or an irreversible SHA-256 hash
- 🍪 No cookies, no tracking — no fingerprinting of your users
- 🔑 Encrypted key storage — AES-256-GCM authenticated encryption, never plaintext
🎛️ Built for control, not guesswork
- Three modes — Protect (block spam), Monitor (log only), and Off
- Adjustable thresholds — set your own challenge and block sensitivity per site
- Fail-open by design — if the API is ever unreachable, your forms keep working
- Trusted-proxy aware — correct visitor IP behind Cloudflare or custom proxies, with spoofing protection
- Developer-friendly — a clean
xc_shield_check()API for any custom form
Free, forever
The XC Shield plugin is completely free. Protection is powered by the Xania Shield API — start on the free tier and upgrade only if your traffic grows. No license keys, no activation, no nag screens.
Privacy-first. No Big Tech. That's the difference.
Changelog
This release quadruples XC Shield's form-builder coverage with native integrations for four of the most popular form plugins in the WordPress ecosystem. Each one layers Shield's cloud scoring on top of the builder's own anti-spam — nothing you already rely on gets replaced.
Gravity Forms
- Native integration through the dedicated gform_entry_is_spam anti-spam filter
- Blocked entries land in the Gravity Forms Spam folder for one-click review and restore
- Existing verdicts from the GF honeypot and the Akismet add-on are respected before any API call
Elementor Pro Forms
- Server-side validation through the elementor_pro/forms/validation extension point
- Clear, filterable block message shown under the form on spam verdicts
- Form name forwarded with each analysis for per-form log filtering
Ninja Forms
- Submission screening through the ninja_forms_submit_data filter
- Spam halted before the entry is stored and before any action (email, webhook) runs
Fluent Forms
- Validation integration for Fluent Forms 5.x with automatic fallback for 4.x installs
- Per-request guard prevents duplicate analyses where legacy hooks are still mapped
Across All Four Integrations
- Each integration toggles independently in XC Shield → Form Integrations
- Builder-native anti-spam runs first; Shield's cloud scoring layers on top
- Logged-in moderators are always exempt, so admins can safely test their own forms
- --------------------
First public release of XC Shield. This version delivers complete privacy-first spam protection for WordPress forms, powered by the EU-hosted Xania Shield API with no CAPTCHAs and no Big Tech dependencies.
Core Protection Engine
- Cumulative scoring engine returning allow, challenge, or block verdicts
- Adjustable block and challenge thresholds per site
- Protect, Monitor, and Off operating modes
- Fail-open design so forms keep working if the API is unreachable
Form Integrations
- WordPress comments protection
- User registration protection
- Contact Form 7 integration
- WPForms integration
- SureForms integration
- WooCommerce checkout protection (Store API and HPOS-aware)
- Contact Form Pro integration
Bot Detection
- Dual honeypot fields using two independent hiding techniques
- HMAC-signed timing token to detect instant bot submissions
- Behavioural interaction signals to flag headless automation
Privacy Controls
- Email transmission modes: full address, domain only, or SHA-256 hash
- Optional sending of form fields and referrer
- EU-hosted processing with no third-party AI and no cross-site tracking
Security
- API key stored with AES-256-GCM authenticated encryption
- Visitor IP detection defaulting to the connecting address only
- Cloudflare and custom reverse-proxy modes with spoofing protection
- Anti-SSRF request handling with strict SSL verification
Developer Tools
- xc_shield_check() function to protect any custom form
- Fail-safe behaviour that never breaks a form on internal error
Administration
- Settings page with grouped Display, Behaviour, and Privacy options
- Self-hosted automatic updates through the standard Plugins screen
- Clean multisite-aware uninstall removing all stored data
Reviews
No reviews yet. Be the first to review this product!
XC Shield
Product Details
Related Products
XC Image Optimizer
Premium self-hosted image compression, WebP/AVIF conversion, and bulk optimization for WordPress. No external API. No data leaves your server.
XC Tiered Pricing
A complete rule engine for WooCommerce quantity discounts, B2B pricing tiers, and scheduled promotions. Live preview, role-based targeting, and a frontend that inherits your theme — no subscriptions, no SaaS dependency.
PWA Push Notifications
Turn your WordPress site into an installable PWA that re-engages visitors with rich push notifications — even after the browser is closed. No third-party push service required.
Message sent!
Ask about this product
Have a question about ? Send us a message and we'll reply within 24 hours.