Catch WordPress bots without a CAPTCHA: a local-first WebDecoy rollout

Spam comments. Fake accounts. A checkout full of failed card attempts. Those are three different places to investigate, but none should require putting an image puzzle in front of every customer.

We built WebDecoy, a free WordPress.org plugin that combines server-side checks, browser signals and hidden decoys. Local detection works without a WebDecoy account or API key. Here is how to start using it on a site you manage.

Install and observe

In wp-admin, open Plugins → Add New, search for WebDecoy, install it and activate it. Or use WP-CLI:

wp plugin install webdecoy --activate
wp webdecoy config set mode monitor
wp webdecoy status

Monitor mode is the default. It records detections without blocking requests, so you can inspect the signals before enabling enforcement. Check the local detection log and statistics rather than assuming that activation means traffic is being blocked.

Match the protection to the problem

For comment spam and fake registrations, the plugin adds invisible honeypot fields to core WordPress forms and evaluates submission signals. Login protection also includes rate limiting for brute-force activity.

For WooCommerce card testing, it checks checkout velocity and patterns such as rapid attempts and repeated declines across multiple cards. Checkout limits are configurable, and the plugin supports both classic checkout and WooCommerce Blocks. A hidden decoy coupon adds another signal when automation discovers and applies it.

For scanners and scrapers, hidden paths, decoy links, fake-file responses with canary credentials and WordPress-specific traps give automated clients opportunities to reveal their behavior. Browser detection adds automation and behavioral signals when JavaScript executes.

These mechanisms serve different purposes. A browser signal and a server-side tripwire do not have the same coverage. Review the specific signal behind a detection before choosing your response.

Test the flows real visitors need

While monitoring, exercise the routes your site actually uses: a normal comment, a registration if enabled, a login, and a test checkout through your payment provider’s supported testing process. Include the devices, privacy tools and accessibility flows your customers use.

Review the detections alongside those actions. Adjust your settings and allowlist where appropriate, then enable enforcement when the behavior fits your site. Monitor-mode findings are observations, not a measured claim that attacks were blocked.

Useful for agencies, too

You can inspect available settings and status through WP-CLI:

wp webdecoy config list
wp webdecoy status

The plugin also supports deployment constants for a forced default mode, hiding its admin UI, limiting log retention and an emergency disable switch. That lets you keep the configuration in your deployment process instead of repeating every click across client sites.

Local plugin, optional cloud

Detection logs and statistics work in WordPress. The plugin’s listing documents no external connections until you deliberately connect WebDecoy Cloud. Cloud connection is optional and adds centralized reporting, reputation enrichment and integrations; review its data-sharing details before connecting.

The plugin runs within WordPress. If you need filtering before requests reach PHP, that requires a separately configured edge or firewall integration.

Start free

Install WebDecoy from WordPress.org.

Open your site’s plugin installer from our WordPress page.

Read the setup documentation.

I’m on the WebDecoy team. If you try it, tell us which signal helps explain the noise on your site: form submissions, scanner traps or checkout activity.