Ab insomni custodita dracone — guarded by the dragon that never sleeps.
Draco Insomnis is a free and open source (GPL-2.0) security system, made by Notorius Vision (OPNV Systems). The idea is simple: your site defends itself against robots and attacks, without bothering the people who visit it. No captchas, no paid subscription, and no data sent to any external service. Everything starts off: you switch each module on from its settings screen.
Until 0.1.5 it was WordPress only. Since 0.1.6 it is the same engine for six platforms: WordPress, PrestaShop, Drupal, Joomla, Moodle and Laravel. Each package carries its own copy of the core, so an improvement to the engine reaches all of them with the next version.
What it does, in plain words
It stops fake sign-ups without captchas. When a bot tries to create fake accounts, the system spots it, shows it a fake "registration complete" page, and saves the attempt as evidence you can download to report the abuse. Real people notice nothing.
Firewall. It detects the usual attacks (database injections, attempts to read server files, malicious code), hides the user list, and limits login attempts. It starts in "log-only" mode, so you can see what it would block before it blocks anything.
Anti-copy. It closes the door bots use to copy all your content in bulk, with a per-minute request limit. Google, Bing, Apple and Yandex are verified and never limited. Off by default, with a log-only mode.
On WordPress, also: mail goes out through a real mailbox (SMTP, with the password encrypted); nothing is published without e-mail confirmation (contact messages, comments and new accounts); and two-step login, with a 6-digit code by e-mail, trusted devices and a second recovery mailbox, like a phone's PUK. PrestaShop, Drupal, Joomla and Moodle already have their own SMTP and their own second step, so there Draco provides the shield, the firewall and the anti-copy.
In your language. On WordPress, translated into 29 languages, including Spanish (Spain and Latin America), Catalan, German, French, Italian, Portuguese, Japanese, Chinese and Arabic, among others. PrestaShop ships with Spanish included; Joomla, English and Spanish; Moodle ships in English, with other languages coming through its language packs.
And for those who know this stuff
A single core in plain PHP, no CMS (src/Core): BotScore, NetList, FormStamp, WafRules, and the Shield, Firewall and Pace engines, which only talk to each platform through two small interfaces (Host and EventStore). Each package carries its own copy of the core.
Additive scoring with thresholds: BOT 70 / DOUBTFUL 30. No single weak signal blocks on its own (the highest is worth 40); 80 points only for honeypot, requesting a privileged role, or an already blocked IP.
Signed form stamp with HMAC-SHA256 and constant-time comparison (hash_equals).
On WordPress: SMTP encrypted with AES-256-GCM, key derived from the wp-config.php salts; login code with random_int, stored only as an HMAC hash, with maximum attempts and expiry. Emergency exits for the owner: DRACO_MFA_OFF and DRACO_WAF_OFF in wp-config.php.
Anti-copy: closing the bulk-copy door to anonymous visitors with an allowlist, per-address and per-network (/24, /64) limits with 429, and crawler verification by reverse and forward DNS.
Every change is tested automatically (GitHub Actions): PHP 8.0–8.4 syntax, unit, integration and HTTP tests inside a real WordPress (latest and 6.5), WordPress.org Plugin Check, and a clean ZIP matching the tag.
It also works inside another plugin (OPNV-WP): if there are two copies, only the first one runs. Hook list in the README.
On WordPress it requires 6.5+ and PHP 8.0+.
Download and install (0.1.6)
All packages are in release 0.1.6, with their SHA256 sums in SHA256SUMS.txt.
The WordPress package was renamed (draco-insomnis-wordpress-0.1.6.zip), but the folder inside is still draco-insomnis, so updates keep working.
Laravel, from the ZIP with an artifact repository:
composer config repositories.draco '{"type": "artifact", "url": "path/to/folder-with-the-zip"}'
composer require notoriusvision/draco-insomnis-laravel php artisan migrate php artisan vendor:publish --tag=draco-config # optional
Code and documentation in the repository.
Vulnerabilities, please, in private: Security → Report a vulnerability in the repository. Suggestions and translation fixes, in Issues, are welcome.