Stop spam without selling out your visitors' privacy

Most spam-protection plugins make your visitors solve puzzles, or quietly ship their data off to Google. XC Shield does neither. It connects your WordPress site to the Xania Shield API — a privacy-first, EU-hosted spam-detection engine that analyses submissions using local statistical methods, not Big Tech surveillance. No CAPTCHAs to frustrate real users. No data leaving Europe. No cookies, no tracking, no compromise.

How it works

When someone submits a form, XC Shield sends a minimal, privacy-respecting fingerprint to the Xania Shield API, which scores it against 14 cumulative detection rules — honeypot traps, disposable-email detection, behavioural signals, datacenter-IP checks, content analysis, and proof-of-work, among others. No single signal blocks a visitor; the engine weighs them together, so legitimate users sail through while bots get stopped. You get a clear verdict — allow, challenge, or block — in under 100 milliseconds.

Works with the forms you already use

XC Shield protects, out of the box:

• WordPress comments — stop comment spam at the source
• User registration — block fake sign-ups
• Contact Form 7 — the most popular contact form, protected
• WPForms — full integration
• SureForms — native support
• WooCommerce checkout — stop fraudulent and bot orders (HPOS-aware)
• Contact Form Pro — supported

Enable only the integrations you need, each with a single toggle.

Privacy you can actually verify

• EU-hosted — your visitors' data never leaves Europe
• No Google, no reCAPTCHA, no Akismet — zero Big Tech dependencies
• GDPR-compliant by design — choose exactly what gets sent: full email, domain only, or an irreversible SHA-256 hash
• No cookies, no tracking, no fingerprinting of your users
• Encrypted key storage — your API key is stored with AES-256-GCM authenticated encryption, never in plaintext

Built for control, not guesswork

• Three modes: Protect (block spam), Monitor (log only, block nothing), and Off
• Adjustable thresholds — set your own challenge and block sensitivity per site
• Fail-open by design — if the API is ever unreachable, your forms keep working; spam protection never breaks your site
• Trusted-proxy aware — correct visitor IP detection behind Cloudflare or custom reverse proxies, with spoofing protection
• Developer-friendly — a clean xc_shield_check() API to protect any custom form

Free, forever

The XC Shield plugin is completely free. Protection is powered by the Xania Shield API — start on the free tier and upgrade only if your traffic grows. No license keys, no activation, no nag screens. Install it, add your API key, and you're protected in two minutes.

Privacy-first. EU-hosted. No Big Tech. That's the difference.