WordPress Integration

Protect your WordPress forms with SilentShield. Works with Contact Form 7, WPForms, Gravity Forms, and any custom forms.

1. Add the Script

Add this code to your theme's functions.php or use a plugin like 'Insert Headers and Footers':

functions.phpphp

// functions.php
function silentshield_enqueue() {
    wp_enqueue_script(
        'silentshield',
        'https://api.silentshield.io/client.js?k=YOUR_API_KEY',
        array(),
        null,
        true
    );
}
add_action('wp_enqueue_scripts', 'silentshield_enqueue');

2. Server-Side Verification

Add nonce verification to your form handler. For custom forms, add this to your processing function:

PHPphp

function verify_silentshield_nonce() {
    $nonce = sanitize_text_field($_POST['behavior_nonce'] ?? '');
    if (empty($nonce)) {
        wp_die('Missing verification', 'Error', array('response' => 422));
    }

    $response = wp_remote_post('https://api.silentshield.io/api/v1/captcha/verify-nonce', array(
        'headers' => array(
            'Content-Type' => 'application/json',
            'X-Api-Key' => SILENTSHIELD_API_KEY,
        ),
        'body' => wp_json_encode(array('nonce' => $nonce)),
        'timeout' => 5,
    ));

    if (is_wp_error($response)) {
        return; // fail open
    }

    $body = json_decode(wp_remote_retrieve_body($response), true);
    if (($body['verdict'] ?? '') === 'bot') {
        wp_die('Bot detected', 'Forbidden', array('response' => 403));
    }
}

Contact Form 7

The widget automatically detects Contact Form 7 forms. No additional configuration needed — just add the script and the widget will protect all CF7 forms on the page.

WPForms / Gravity Forms

SilentShield automatically detects forms from WPForms, Gravity Forms, and other popular form plugins. The widget injects the nonce into any form it finds on the page.

Observe AI Agents

Beyond form protection, WordPress can also record which AI crawlers (GPTBot, ClaudeBot, PerplexityBot, …) read your site — today via a small must-use plugin file; an upcoming plugin update will build this in.

Learn more: Observe AI Agents →

Exclude SilentShield from JavaScript optimisers

Caching and speed plugins (WP Rocket, Perfmatters, LiteSpeed, Autoptimize and others) can delay JavaScript until the visitor's first interaction, and combine files into one bundle. Both break SilentShield: the widget then only starts once someone clicks, so the behaviour signals from page load — mouse movement, typing rhythm, timing — are missing, and protection runs on a fraction of what it needs. Form scans do not run at all. Add these patterns to your optimiser's exclusion lists for BOTH "delay JavaScript" and "combine JavaScript":

Exclusion patternstext

client.js
behavior-captcha
silentshield

To check: open a page with a form and run performance.getEntriesByType("resource").map(r=>r.name).filter(n=>n.includes("client.js")).join() in the browser console WITHOUT clicking anything. An empty result means SilentShield has not loaded yet — then an exclusion is missing.

Storing the API Key

Add your API key to wp-config.php for security:

wp-config.phpphp

// wp-config.php
define('SILENTSHIELD_API_KEY', 'your-api-key-here');