tlloancy Behavioral Ultimate Finisher

tlloancy Behavioral Ultimate Finisher looks at how a form was filled, not only at what was sent. It scores each submission from a few behavioral signals and lets you decide what happens to the ones that look automated. No CAPTCHA, no cookies, no external service. A companion for your anti-spam plugin Honeypots, nonces and form timers are good against simple bots, but a bot that runs JavaScript can satisfy them. Behavioral Ultimate Finisher adds the missing angle: a bot that loads the page, fills the form in a fraction of a second and never touches the mouse or the keyboard gives itself away by how it behaved. It uses standard WordPress hooks and its own field names, so it is designed to sit next to plugins such as La Sentinelle antispam, Antispam Bee or Akismet. Each plugin runs its own check, and a submission is stopped if either one flags it. This plugin is independent and is not affiliated with those projects. What it catches

• Bots that run JavaScript but do not behave like a person: submitting within a fraction of a second, no mouse, keyboard, touch or scroll, scripted keystrokes, headless-browser windows.
• Raw bots that post straight to the form without a browser, through the honeypot or through the missing token and missing counters added together.

What it does not catch Bots that drive a real browser with genuine input events, and human spammers, can look like a normal visitor. Keep a content-based anti-spam plugin for those. Signals (each with an editable score)

• Honeypot field filled in
• No valid token (direct POST without a browser, forged or expired token)
• No behavior counters at all (the script did not run, or the form was posted directly)
• Form submitted faster than a minimum fill time
• No human interaction before the submission (mouse, keyboard, touch, scroll, focus)
• Browser reports automation (navigator.webdriver)
• Browser window reports a size of 0 x 0, typical of headless browsers
• Many keystrokes or clicks fired by a script instead of the browser (simulated typing)
• The same token reused by many submissions (a bot replaying one token)

Scores add up. A submission is flagged when its total reaches your threshold, so one weak signal never blocks a real visitor on its own. The log shows the real sum of the scores, even above 100. Signal radar The settings page draws the weight of each signal on a radar chart, with the flag threshold as a dashed ring. It updates as you edit the scores. The helmet in the middle shows how strict your settings are: it glows teal when the filter is calm and turns amber, then red, as it gets stricter, while the crest on its forehead lowers its arms from a Y to a cross. Three modes

• Reject (default): every flagged submission is rejected.
• Mark as spam: flagged comments go to the spam queue, other forms reject the submission.
• Observe: scores are logged, nothing is blocked. Useful to check the log and calibrate your thresholds on your own traffic.

Protected forms

• WordPress comments (including WooCommerce reviews)
• User registration (WordPress and WooCommerce)
• Contact Form 7
• Login
• Lost password (a separate page: ticking Login does not cover it)

For developers $result = tlbuf_evaluate( 'my-plugin' ); returns score (0-100), total (real sum), signals and flagged for the current submission. Use the tlbuf_behavior_score filter to adjust the score. Privacy No cookies, no IP address stored, no data sent to any third-party service. The log only keeps the date, form type, score, decision, triggered signals and a short line of event counters (numbers only), and is purged automatically. The score and signals of an accepted comment or new user are also kept as comment and user metadata, so you can see why a message got through. The content log is off by default. When you enable it, the text of flagged or rejected comments (name, URL and message, never the e-mail address or IP) and Contact Form 7 messages is also kept, cut short, for the retention period you set. This is personal data: mention it in your privacy policy. A suggested text is added to Settings > Privacy. Login, lost password and registration are never kept, nor any field that looks like a password, card or token. Locked out? Add define( 'TLBUF_DISABLED', true ); to wp-config.php to turn off every check and the tracker. Remove it once you have fixed the settings.

1.2.0

• New: lost password form protection (separate setting).
• New: login and lost password are protected by default on new installs. Existing sites keep their settings.
• New: the log shows the real total score instead of capping it at 100.
• New: "token replayed" signal, for a token reused by more than 5 submissions.
• New: score and signals saved on comments and users, with a Behavior column on the Comments and Users screens.
• New: optional content log of flagged or rejected comments and Contact Form 7 messages, off by default, with suggested privacy policy text.
• New: Site Health test for the token endpoint.
• New: TLBUF_DISABLED constant to switch the plugin off from wp-config.php.
• Changed: the log label "Passed" is now "Passed this filter", since a registration is logged before WordPress creates the account.
• Updated the French translation.

1.1.0

• New: a "no behavior counters" score. Added to a missing token, it reaches the default threshold, so a direct post is rejected. Visitors without JavaScript are rejected too: lower this score if they must pass.
• New: a signal radar on the settings page. The helmet shows how strict the filter is.

1.0.0

• First release.