TrustSig Security

Protection modes

• Monitor: verify and log only, never block. Good for a safe rollout. Upgrades also pin existing sites here, so behaviour never changes silently on update.
• Challenge (default for new installs): a missing or invalid token triggers the interstitial, which then continues or blocks.
• Enforce: a missing or invalid token is blocked immediately.

What it protects

Browser forms are covered automatically, no code needed:

• WordPress core: login, registration, comments, lost and reset password
• WooCommerce: login, registration, checkout, pay order, lost password
• BuddyPress: registration
• Easy Digital Downloads: login, registration
• Elementor Pro forms
• WPForms: contact and other forms, on by default, both AJAX and non-AJAX submissions (this also covers the Mesmerize and Materialis contact section)
• Contact Form 7: feedback submissions, on by default, guarded on the REST endpoint CF7 submits to and on plain POSTs of the form to a page URL
• SureForms: form submissions, on by default, guarded on the REST submit-form endpoint
• Anything else via the site-wide “protect all forms” option, the [trustsig_form] shortcode, or a hidden trustsig-response input

On top of that there is an optional brute-force lockout for repeated failed logins, an opt-in guard for admin-ajax and the REST API, and a verification API for developers.

For developers

• PHP: trustsig_verify( array( ‘token’ => $t, ‘action’ => ‘my_form’ ) ) returns pass, fail or challenge. Filters: trustsig_pre_verify, trustsig_result. Action: trustsig_blocked.
• REST: POST /wp-json/trustsig/v1/verify with { “token”: “…” }.

Known limitations

• XML-RPC (xmlrpc.php) is deliberately out of scope and is not verified. If your site does not use XML-RPC, disable it separately.
• admin-ajax and the REST API are only guarded when you enable that in Settings. This is on purpose, so third-party integrations do not break the moment you install the plugin.
• File uploads and AJAX submissions cannot show the interstitial. In Challenge or Enforce mode a missing token on those is blocked. It is never silently allowed.

External services

This plugin relies on the TrustSig Edge service to decide whether a request comes from a human or an automated client. That verdict cannot be produced locally, so the service is required for the plugin to do its job.

Service provider: TrustSig, https://trustsig.eu

Remote script loaded in the browser: https://edge.trustsig.eu/trustsig.js loads on pages that contain a protected form, on the login screen, and on the verification interstitial. It runs the non-interactive browser check and produces a verification token.

Data sent from the visitor’s browser or your server to https://edge.trustsig.eu/verify:

• the TrustSig verification token generated by the SDK in the visitor’s browser;
• your site’s host name (for example example.com) on the anonymous free tier, or the secret key you entered if you connect a dashboard account;
• as with any HTTPS request, the visitor’s IP address and standard request metadata such as the user agent are visible to the service.

When data is sent: when the SDK loads on a protected page, when a protected form is submitted, and once per browser when the optional verified-session cookie is bootstrapped.

Data stored locally on your site: TrustSig writes a verification log to your own WordPress database (custom tables) with visitor IP addresses, the action attempted, and the verdict. This log is not sent to TrustSig, and you can clear it at any time under Settings, TrustSig, Tools.

By installing and activating this plugin you, the site administrator, consent to this data being sent to TrustSig so that requests can be verified. Inform your own visitors as your local privacy obligations require.

• Terms of Service: https://trustsig.eu/terms-of-service/
• Privacy Policy: https://trustsig.eu/privacy