Protect WordPress forms with SilentShield

The official plugin “SilentShield – Captcha & Anti-Spam” adds the script and verifies every submission on your server — no code of your own. This guide lists only what we have tested with the plugin ourselves.

View the plugin in the WordPress directory

Requirements

• WordPress 5.2 or later and PHP 7.4 or later (as stated by the plugin in the WordPress directory).
• Your website runs over https. Without a secure context the browser provides no Web Crypto functions, no nonce is created, and protected forms cannot be submitted.
• A SilentShield account with a key for your domain. Subdomains such as www. or staging. are included.

Which forms can be protected

Tested on 10/7/2026 with plugin 2.15.14 and WordPress 7.1.2: a human gets through and is confirmed on the server, a submission without a browser is rejected.

Installation

1. In WordPress, open “Plugins → Add New” and search for “SilentShield”.
2. Install and activate “SilentShield – Captcha & Anti-Spam for WordPress”.
3. The menu now has an entry “SilentShield”.

Enter the key and switch on forms

1. Create a key for your domain in the SilentShield dashboard and copy it.
2. In WordPress, open “SilentShield → API / SilentShield”, paste the key under “API Key” and click “Validate”.
3. Switch on “Activate API” and click “Save”.
4. Open “SilentShield → Forms” and switch on protection for each form plugin listed as “Works” in the table above.

The plugin uses the site key both in the browser and for the check on your server. No server key is needed for this.

Server key for the f12-security plugin

The f12-security plugin can optionally exchange bot hints with SilentShield: it reports fingerprints of known bots and fetches a signed list for your account. Your server makes these calls, not your visitors' browsers. For this the plugin needs the server key of your domain — not the normal website key that appears in the source of your pages.

1. In the SilentShield dashboard, open "API keys" and the key of your domain.
2. Go to the "Security" page and click "Create server key" in the "Server key" section.
3. Copy the value right away. It is shown only once, and we keep no copy.
4. Enter it in f12-security at the field labelled server key and save.

The server key belongs only in your server's settings, never in a page or a script served to visitors. If you lose it, create a new one in the dashboard; the old one then stops working.

Check that it works

A genuine submission

Open the page with the form in a private window, fill it in by hand and submit it. You see your form's normal confirmation, and the submission appears with its verdict in the SilentShield dashboard.

A rejected submission

Send the same without a browser, for example a comment via curl to a post with open comments. Replace the address and the post ID:

curl -i -X POST https://example.com/wp-comments-post.php \
  -d "comment_post_ID=1&author=Test&[email protected]&comment=Test"

Expect a rejection with the plugin's message, on an English-language site “Captcha not correct: Behavior check”. With Contact Form 7 the form shows “Behavior check”.

Troubleshooting

Nothing happens when clicking “Submit”.

Is the page served over http instead of https? The browser console then shows the warning “[SilentShield] Web Crypto fehlt im Worker …” (the message is in German). Serve the page over https.

Contact Form 7 reports “There was an error trying to send your message”.

The check has passed; what failed is WordPress sending the mail. Check the mail settings (for example SMTP), not the bot protection.

Real visitors get “Behavior check”.

The most common cause is an optimisation plugin that delays or combines JavaScript — see the note below. Also check that the key belongs to the page's domain.

A WPForms form does not submit, or the block checkout rejects every order.

Update the SilentShield plugin to version 2.15.14 or later. We measured both problems with version 2.15.12; with 2.15.14 they no longer occur.

You want to see what the script does.

Append ?silentshield-debug to the page address. The browser console then shows every step of the check.

client.js
behavior-captcha
silentshield

Limits

• Only the form plugins you switch on under “SilentShield → Forms” are protected.
• We list tested versions only. The plugin detects further form plugins; whether they work with SilentShield, we have not tested.
• The plugin brings checks of its own (such as honeypot and timing) and shows its own messages for them, such as “JavaScript check”.
• SilentShield protects forms against bots. It does not replace a web application firewall or DDoS protection.

Operation

• You update the plugin through WordPress like any other. The script in the browser always comes from us in its current version.
• Every submission counts twice towards the quota: once for the report from the browser, once for the check on your server.
• If SilentShield also gives a visitor a challenge, up to 2 more requests are added for it. A submission that the server also checks therefore costs up to 2 requests – up to 4 with a challenge.
• You see verdicts and rejected submissions in the SilentShield dashboard.

See prices and quotas

Without the plugin: your own integration

For your own forms, or without the plugin, add the script yourself and verify every submission on your server. Without that check the script does not protect: it does not stop a request sent directly.

1. Add the Script

Add this code to your theme's functions.php or use a plugin like 'Insert Headers and Footers':

// functions.php
function silentshield_enqueue() {
    wp_enqueue_script(
        'silentshield',
        'https://api.silentshield.io/client.js?k=YOUR_API_KEY',
        array(),
        null,
        true
    );
}
add_action('wp_enqueue_scripts', 'silentshield_enqueue');

2. Server-Side Verification

Add nonce verification to your form handler. For custom forms, add this to your processing function:

function verify_silentshield_nonce() {
    $nonce = sanitize_text_field($_POST['behavior_nonce'] ?? '');
    if (empty($nonce)) {
        wp_die('Missing verification', 'Error', array('response' => 422));
    }

    $response = wp_remote_post('https://api.silentshield.io/api/v1/captcha/verify-nonce', array(
        'headers' => array(
            'Content-Type' => 'application/json',
            'X-Api-Key' => SILENTSHIELD_API_KEY,
        ),
        'body' => wp_json_encode(array('nonce' => $nonce)),
        'timeout' => 5,
    ));

    if (is_wp_error($response)) {
        return; // fail open
    }

    $body = json_decode(wp_remote_retrieve_body($response), true);
    if (($body['ok'] ?? false) !== true || ($body['verdict'] ?? '') !== 'human') {
        wp_die('Bot detected', 'Forbidden', array('response' => 403));
    }
}

// wp-config.php
define('SILENTSHIELD_API_KEY', 'your-api-key-here');

Observe AI Agents

Beyond form protection, WordPress can also record which AI crawlers (GPTBot, ClaudeBot, PerplexityBot, …) read your site — today via a small must-use plugin file; an upcoming plugin update will build this in.

Learn more: Observe AI Agents →