=== Mimic Guard ===
Contributors: aoto0328
Tags: spam, honeypot, security, contact-form, comments
Requires at least: 5.8
Tested up to: 7.0
Stable tag: 1.4.0
Requires PHP: 7.4
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Block spam submissions with honeypot fields and submission timing checks.

== Description ==

Mimic Guard is an anti-spam plugin for WordPress mail and contact forms. It uses dynamic honeypots, submission time monitoring, and integration with major form plugins to reduce automated bot submissions.

* **Honeypot** — Detects bots that fill hidden form fields
* **Time check** — Flags submissions that are unrealistically fast after the form is shown
* **Form integration** — Works with WPForms, Contact Form 7, comments, and more
* **Page caching** — Optional AJAX honeypot injection when HTML is cached
* **URL filter** — Optional blocking when the message body contains http(s) URLs
* **Restricted fields** — Blocks URL, www, mailto, and @ patterns in name-like fields (not the message body or email inputs)
* **Privacy** — Optional IP anonymization when logging events
* **Interaction check** — Optional minimum focus/keyboard activity before submit
* **Origin check** — Optional blocking when Origin/Referer does not match your site
* **Rate limit fingerprint** — Optional per-browser counting when rate limiting is on

Configure minimum submission time, token lifetime, log list size, and more from the admin screens.

== Installation ==

1. Upload the plugin folder to `/wp-content/plugins/mimicguard/` or install from the ZIP file.
2. Activate Mimic Guard on the Plugins screen in WordPress.
3. Open the Mimic Guard menu to review settings and logs.

== Frequently Asked Questions ==

= I use a full-page caching plugin =

Enable “Insert honeypot via AJAX (cache-friendly)” so honeypots can still be loaded even when HTML is cached.

= Legitimate submissions are being blocked =

Try increasing the minimum submission time slightly, or disable “Require time-check token” if you do not need it.

= Where are logs stored? =

In a dedicated database table. You can run cleanup from the admin area based on retention settings.

== Screenshots ==

1. Dashboard (statistics and log list)
2. Settings screen

== Changelog ==

= 1.4.0 =
Optional interaction check, Origin/Referer validation, and browser fingerprint support for rate limiting (all off by default).

= 1.3.5 =
Block URL and email-like patterns in non-message form fields (for example name or phone fields). Message body and email fields are excluded; optional message-body URL blocking is unchanged.

= 1.3.4 =
Added optional blocking when the message body contains an http:// or https:// URL. Confirmed compatibility with WordPress 7.0.

= 1.3.3 =
Reduced honeypot false positives from browser/password manager autofill by hardening honeypot field attributes and narrowing dynamic prefix checks; also improved detailed block reason logging and frontend guard checks.

= 1.3.0 =
Internal improvements, security, and code quality updates.
