About this product
Signup Guard provides lightweight, privacy-conscious protection for Moodle self-registration. It helps reduce automated account creation using an invisible form trap, secure form-timing checks and privacy-safe rate limiting.
The plugin works immediately after installation with sensible security defaults. It requires no CAPTCHA account, API keys or external service, making it suitable for schools, universities, training organisations and other Moodle sites that need open registration without unnecessary technical configuration.
About the developer
Signup Guard is developed and maintained by Tumusiime Robert, a technology and e-learning professional specializing in WordPress, digital platforms, learning management systems and institutional technology solutions.
Key features
- Protection enabled by default
- Secure recommended settings are applied automatically after installation.
- Invisible bot trap
- Detects automated form-fillers without adding visible challenges for genuine users.
- Form-timing protection
- Blocks unrealistically fast submissions and expired or invalid registration forms.
- Secure signed tokens
- Uses a unique installation-specific cryptographic key and session-bound form tokens.
- Network rate limiting
- Restricts excessive registration attempts while accommodating organisations using shared internet connections.
- Browser-session rate limiting
- Adds another protection layer against repeated submissions from the same session.
- Privacy-conscious operation
- Does not store submitted names, email addresses, honeypot values or raw network addresses in plugin database tables.
- No external service required
- Works without reCAPTCHA, API keys or third-party communication.
- Accessible registration experience
- Genuine users are not required to solve puzzles or complete additional verification fields.
- Configurable safeguards
- Administrators can adjust form timing, attempt limits, expiry periods and optional logging.
- Neutral security messages
- Rejected requests do not reveal which protection was triggered.
- Moodle-standard integration
- Includes installation and upgrade handling, Privacy API support, event integration and administrator settings.
Changelog
### Version 1.0.1 — 28 July 2026
* Corrected Moodle signup-form integration and validation callbacks.
* Added an installation-specific cryptographic signing key.
* Added session-bound tokens to reduce form-token replay.
* Added network and browser-session rate limiting.
* Added secure minimum completion-time and form-expiry checks.
* Added safe boundaries for all configurable security values.
* Added automatic expiration of temporary rate-limit records.
* Removed the predictable signing-key fallback.
* Disabled event logging by default for improved privacy.
* Clarified Moodle logging and data-retention behaviour.
* Added secure installation and upgrade handling.
* Added a responsible security-reporting policy.
* Improved documentation and administrator guidance.
### Version 1.0.0 — 28 July 2026
* Rebuilt the original honeypot proof of concept.
* Added an accessibility-conscious invisible bot trap.
* Added secure default configuration.
* Added signed form-timing validation.
* Added privacy-safe rate limiting.
* Added administrator settings.
* Added neutral public error messages.
* Added optional Moodle event logging.
* Added Moodle Privacy API support.
* Added standard plugin metadata, documentation and GPL licensing.
User reviews
There are no written reviews yet. You can be the first to share one using the review form.
Rate this product
Share an honest rating. Reviews are moderated before publication.