{"id":345630,"date":"2026-08-13T08:01:13","date_gmt":"2026-08-13T08:01:13","guid":{"rendered":"https:\/\/wordpress.org\/plugins\/silent-sentinel\/"},"modified":"2026-08-13T07:45:50","modified_gmt":"2026-08-13T07:45:50","slug":"nullis-shield","status":"publish","type":"plugin","link":"https:\/\/nl.wordpress.org\/plugins\/nullis-shield\/","author":15529162,"comment_status":"closed","ping_status":"closed","template":"","meta":{"version":"1.3.0","stable_tag":"trunk","tested":"7.0.4","requires":"6.0","requires_php":"8.0","requires_plugins":null,"header_name":"Nullis Shield","header_author":"The WP Plugin Architect","header_description":"Prevention-first security engine. Stops threats before they hit your database.","assets_banners_color":"","last_updated":"2026-08-13 07:45:50","external_support_url":"","external_repository_url":"","donate_link":"","header_plugin_uri":"","header_author_uri":"https:\/\/enigmaking.online","rating":0,"author_block_rating":0,"active_installs":0,"downloads":22,"num_ratings":0,"support_threads":0,"support_threads_resolved":0,"author_block_count":0,"sections":["description","installation","faq","changelog"],"tags":[],"upgrade_notice":{"1.2.0":"<p>This release contains significant security and privacy improvements. Updating is strongly recommended. If you had the Ghost Purge review-flagging feature enabled, review the updated behaviour \u2014 the review window is now 7 days (previously 1 day) and WooCommerce orders are now protected.<\/p>"},"ratings":[],"assets_icons":[],"assets_banners":[],"assets_blueprints":{},"all_blocks":[],"tagged_versions":[],"block_files":[],"assets_screenshots":[],"screenshots":{"1":"The Nullis Shield dashboard showing the blocked threat counter and settings."}},"plugin_section":[],"plugin_tags":[2656,13859,1174,598,600],"plugin_category":[54],"plugin_contributors":[275472],"plugin_business_model":[],"class_list":["post-345630","plugin","type-plugin","status-publish","hentry","plugin_tags-anti-spam","plugin_tags-bot-blocker","plugin_tags-firewall","plugin_tags-honeypot","plugin_tags-security","plugin_category-security-and-spam-protection","plugin_contributors-countteddy","plugin_committers-countteddy"],"banners":[],"icons":{"svg":false,"icon":"https:\/\/s.w.org\/plugins\/geopattern-icon\/nullis-shield.svg","icon_2x":false,"generated":true},"screenshots":[],"raw_content":"<!--section=description-->\n<p>Nullis Shield is a lightweight micro-firewall designed to stop automated bots and spam registrations at the perimeter. It does not perform heavy file scans or maintain large database tables.<\/p>\n\n<p>Instead, it deploys a honeypot matrix and transient-based IP lockouts to keep your registration endpoint clean.<\/p>\n\n<p><strong>Key Features:<\/strong><\/p>\n\n<ul>\n<li><strong>Lightweight Architecture:<\/strong> Stores lockouts using native WordPress Transients. On sites with an object cache (Redis, Memcached), no database writes occur per block. On standard installations, lockouts are written to <code>wp_options<\/code>.<\/li>\n<li><strong>Cloudflare-Aware IP Resolution:<\/strong> When a request arrives via a verified Cloudflare IP range, the plugin reads <code>HTTP_CF_CONNECTING_IP<\/code> to identify the real attacker. Proxy headers from unverified origins are ignored to prevent IP spoofing.<\/li>\n<li><strong>Ghost Purge Review Queue:<\/strong> Optionally flags subscriber accounts older than 7 days that have no display name, no associated orders, and a registration IP the bouncer has already caught elsewhere. <strong>This feature is disabled by default, and flagged accounts are never deleted automatically<\/strong> \u2014 you review the queue in the dashboard and approve or dismiss each one.<\/li>\n<\/ul>\n\n<h3>Real-World Results<\/h3>\n\n<p>An earlier internal build of this plugin has been running in production on a live client site. Per that installation's own Perimeter dashboard, it has logged over 6,000 blocked bot registration attempts to date. This is a single-site field result, not a benchmark or guarantee \u2014 actual numbers will vary by site traffic and how heavily your registration endpoint is targeted.<\/p>\n\n<h3>Privacy Policy<\/h3>\n\n<p>Nullis Shield does not collect, transmit, or share any personal data. No telemetry, analytics, or external network calls are made by this plugin. All lockout logs and statistics stay in your site's own database.<\/p>\n\n<!--section=installation-->\n<ol>\n<li>Upload the <code>nullis-shield<\/code> folder to the <code>\/wp-content\/plugins\/<\/code> directory, or install directly through the WordPress plugins screen.<\/li>\n<li>Activate the plugin through the 'Plugins' screen in WordPress.<\/li>\n<li>Navigate to <strong>Settings \u2192 Nullis Shield<\/strong> in your dashboard to view blocked threat counts and configure settings.<\/li>\n<li>The Ghost Purge review-flagging feature is <strong>off by default<\/strong>. Enable it only after confirming it is safe for your user registration flow.<\/li>\n<\/ol>\n\n<!--section=faq-->\n<dl>\n<dt id=\"does%20this%20conflict%20with%20wordfence%20or%20solid%20security%3F\"><h3>Does this conflict with Wordfence or Solid Security?<\/h3><\/dt>\n<dd><p>No. Nullis Shield targets registration-layer bot traffic. It can run alongside deeper file-scanning plugins without conflict, though it will often stop threats before they reach those layers.<\/p><\/dd>\n<dt id=\"will%20this%20ban%20cloudflare%3F\"><h3>Will this ban Cloudflare?<\/h3><\/dt>\n<dd><p>No. IP resolution first verifies that the incoming connection originates from a genuine Cloudflare IP range before trusting the <code>HTTP_CF_CONNECTING_IP<\/code> header. Traffic not arriving from a verified Cloudflare range will use <code>REMOTE_ADDR<\/code> or <code>HTTP_X_FORWARDED_FOR<\/code> instead.<\/p><\/dd>\n<dt id=\"is%20the%20ghost%20purge%20review%20queue%20safe%20for%20woocommerce%20sites%3F\"><h3>Is the Ghost Purge review queue safe for WooCommerce sites?<\/h3><\/dt>\n<dd><p>The scan includes a WooCommerce order guard \u2014 it will never flag or delete any subscriber account that has at least one associated order. However, you should review your registration flow before enabling this feature, especially if users commonly register without a first or last name.<\/p><\/dd>\n<dt id=\"does%20this%20work%20on%20wordpress%20multisite%3F\"><h3>Does this work on WordPress Multisite?<\/h3><\/dt>\n<dd><p>Banning and lockout transients operate per-site. On uninstall, the plugin cleans up all data across every site in the network.<\/p><\/dd>\n\n<\/dl>\n\n<!--section=changelog-->\n<h4>1.3.0<\/h4>\n\n<ul>\n<li>Security: Cloudflare IP resolution now supports IPv6 ranges in addition to IPv4.<\/li>\n<li>Security: Repeat offenders now receive escalating lockouts (1h \u2192 6h \u2192 24h \u2192 48h across a 30-day strike window) instead of a flat 48-hour ban.<\/li>\n<li>Reliability: Block counter now uses <code>INSERT ... ON DUPLICATE KEY UPDATE<\/code>, fixing a race condition where the counter could silently fail to increment if the option row didn't already exist.<\/li>\n<li>Reliability: Lockout responses now include a <code>Retry-After<\/code> header, computed from the stored ban expiry rather than reading transient internals \u2014 correct whether or not an object cache (Redis\/Memcached) is active.<\/li>\n<li>Behaviour change: Ghost Purge no longer deletes accounts automatically. It now flags likely-spam accounts (no name, no orders, and a registration IP the bouncer has already caught) into a review queue; deletion requires explicit admin approval from the dashboard.<\/li>\n<li>Removed: The optional telemetry toggle has been removed from this release. No network calls are made by this plugin.<\/li>\n<li>Security: <code>X-Forwarded-For<\/code> is no longer trusted by default \u2014 it was previously accepted unconditionally, letting an attacker spoof it to evade bans or frame another IP. It's now only trusted if the site owner explicitly declares a reverse-proxy range via the new <code>nullis_shield_trusted_proxies<\/code> filter.<\/li>\n<li>Extensibility: Added <code>nullis_shield_ban_duration<\/code>, <code>nullis_shield_min_human_time<\/code>, <code>nullis_shield_max_token_age<\/code>, <code>nullis_shield_log_ip_format<\/code>, and <code>nullis_shield_trusted_proxies<\/code> filter hooks.<\/li>\n<\/ul>\n\n<h4>1.2.0<\/h4>\n\n<ul>\n<li>Security: IP resolution now validates that <code>HTTP_CF_CONNECTING_IP<\/code> originates from a genuine Cloudflare IP range before trusting it. Spoofed proxy headers are ignored.<\/li>\n<li>Security: Registration timestamp is now server-signed via WordPress nonce, preventing forgery by bots.<\/li>\n<li>Security: IP lockout keys now use SHA-256 instead of MD5.<\/li>\n<li>Security: <code>register_setting()<\/code> now enforces strict <code>yes\/no<\/code> sanitization callbacks.<\/li>\n<li>Security: Dashboard <code>render()<\/code> callback now re-verifies <code>manage_options<\/code> capability.<\/li>\n<li>Security: All <code>target=\"_blank\"<\/code> links now include <code>rel=\"noopener noreferrer\"<\/code>.<\/li>\n<li>Reliability: Block counter now uses an atomic SQL increment to prevent race conditions.<\/li>\n<li>Reliability: Deactivation hook now correctly clears the scheduled cron event.<\/li>\n<li>Reliability: Uninstall is now multisite-aware and cache-layer aware.<\/li>\n<li>Reliability: Ghost Purge window extended to 7 days; WooCommerce order guard added; batch cap of 200 users per run prevents timeouts.<\/li>\n<li>UX: All inline styles moved to <code>admin.css<\/code>; CSS custom properties introduced for brand colour.<\/li>\n<li>Accessibility: <code>:focus-visible<\/code> ring added to all dashboard links; WCAG AA compliant.<\/li>\n<\/ul>\n\n<h4>1.1.2<\/h4>\n\n<ul>\n<li>Added 48-hour IP lockout.<\/li>\n<li>Added Spam User Sniper (Ghost Purge) \u2014 internal staging release.<\/li>\n<\/ul>\n\n<h4>1.0.0<\/h4>\n\n<ul>\n<li>Initial release.<\/li>\n<\/ul>","raw_excerpt":"A Prevention-First security engine that eliminates bots before they hit your database. Lightweight, zero-bloat, and incredibly fast.","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/nl.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin\/345630","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/nl.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin"}],"about":[{"href":"https:\/\/nl.wordpress.org\/plugins\/wp-json\/wp\/v2\/types\/plugin"}],"replies":[{"embeddable":true,"href":"https:\/\/nl.wordpress.org\/plugins\/wp-json\/wp\/v2\/comments?post=345630"}],"author":[{"embeddable":true,"href":"https:\/\/nl.wordpress.org\/plugins\/wp-json\/wporg\/v1\/users\/countteddy"}],"wp:attachment":[{"href":"https:\/\/nl.wordpress.org\/plugins\/wp-json\/wp\/v2\/media?parent=345630"}],"wp:term":[{"taxonomy":"plugin_section","embeddable":true,"href":"https:\/\/nl.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_section?post=345630"},{"taxonomy":"plugin_tags","embeddable":true,"href":"https:\/\/nl.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_tags?post=345630"},{"taxonomy":"plugin_category","embeddable":true,"href":"https:\/\/nl.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_category?post=345630"},{"taxonomy":"plugin_contributors","embeddable":true,"href":"https:\/\/nl.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_contributors?post=345630"},{"taxonomy":"plugin_business_model","embeddable":true,"href":"https:\/\/nl.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_business_model?post=345630"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}