Nullis Shield

Nullis Shield is a lightweight micro-firewall designed to stop automated bots and spam registrations at the perimeter. It does not perform heavy file scans or maintain large database tables.

Instead, it deploys a honeypot matrix and transient-based IP lockouts to keep your registration endpoint clean.

Key Features:

• Lightweight Architecture: Stores lockouts using native WordPress Transients. On sites with an object cache (Redis, Memcached), no database writes occur per block. On standard installations, lockouts are written to wp_options.
• Cloudflare-Aware IP Resolution: When a request arrives via a verified Cloudflare IP range, the plugin reads HTTP_CF_CONNECTING_IP to identify the real attacker. Proxy headers from unverified origins are ignored to prevent IP spoofing.
• Ghost Purge Review Queue: Optionally flags subscriber accounts older than 7 days that have no display name, no associated orders, and a registration IP the bouncer has already caught elsewhere. This feature is disabled by default, and flagged accounts are never deleted automatically — you review the queue in the dashboard and approve or dismiss each one.

Real-World Results

An earlier internal build of this plugin has been running in production on a live client site. Per that installation’s own Perimeter dashboard, it has logged over 6,000 blocked bot registration attempts to date. This is a single-site field result, not a benchmark or guarantee — actual numbers will vary by site traffic and how heavily your registration endpoint is targeted.

Privacy Policy

Nullis Shield does not collect, transmit, or share any personal data. No telemetry, analytics, or external network calls are made by this plugin. All lockout logs and statistics stay in your site’s own database.