Login Honeypot
How it works
Login Honeypot is simple method for protecting login form from the bots. It is highly effective because it adds a new field to the login form for email, and expects this field to be present but empty when the login form is submitted. When human fills the form, that is going to happen, because they don’t see the hidden field, that field remains empty and gets submitted empty, and all is OK. But, when bot attempts to login, they might even not go the the actual login form to parse it for fields, they will send automated login request that doesn’t have hidden field and fail, or will analyze the form, find the hidden field and fill it, and again fail.
In the real use of this feature in the past in the GD Security Toolbox Pro plugin, this feature is highly effective, eliminating huge number of bot attempts.
Support login methods
This feature currently supports:
- default WordPress login form (widget and wp-login.php)
- WooCommerce login widget and login form
- bbPress login widget and login form
- BuddyPress login widget and login form
This will be expanded in the future with additional plugins and login forms.
Settings
By default, this feature is not active. After it is activated, it has only two options
- Input Type: This can be
EMAILorTEXTand based on that, hidden field will be built. In some cases, it can be beneficial to have the field set as Text, not Email to avoid triggering the email validation if the value entered is not the valid email. - Input Name and ID: This will be used to set the field name and ID, and identify the field when checking for the honeypot breach. It has to be unique on the page!
IP Ban Conditions
IP Banning for failing honeypot will be triggered via Ban IPs feature if one IP triggers the honeypot 5 times in 24 hours (you can change this in the Ban IPs settings).
Limitations
If you are using some different login method that doesn’t use normal login (where Honeypot can’t add own code and field), but in the same time relies on normal login process from WordPress, Login Honeypot will fail to properly identify valid logins, and in such case, do not use this feature.