Veilo — Invisible Spam Shield
A working plugin scaffold, not a demo. It scores every submission using three signals — a honeypot field, submission speed, and pointer/touch movement — with no CAPTCHA ever shown to the visitor. Spam is blocked (or held for review) automatically.
Free plan protects:
- Native WordPress comments
- Contact Form 7
- WPForms
Pro plan additionally protects:
- Elementor Pro Forms
- Gravity Forms
…and unlocks Veilo → Pro Tools: full Activity Log history (configurable row limit, free is capped at the 10 most recent) and one-click CSV export.
Protecting a custom or hand-coded form
The signal script (public/js/veilo-signals.js) tags every <form> on the page automatically, so the three hidden fields are already present in $_POST for ANY form, built-in or custom. To act on them from your own form handler, call the public helper:
$result = veilo_check( $_POST, 'my-booking-form', $_POST['name'] ?? '' );
if ( 'allowed' !== $result['decision'] ) {
// stop processing however fits this form — wp_die(), return an
// error, redirect back with a message, etc.
wp_die( 'Your submission looks automated and was not sent.' );
}
// otherwise continue processing the form as normal
The second and third arguments are optional and only affect what shows up in Veilo → Activity Log (a source label and a short preview text). This same function is what every built-in integration calls internally, so custom forms get identical scoring to comments, CF7, WPForms, Elementor, and Gravity Forms.