Description
Spambargo puts automated spam under embargo across Contact Form 7, Elementor Pro Forms, Ninja Forms, JetFormBuilder, WooCommerce registration and checkout, WooCommerce Checkout Blocks, WordPress comments, and eligible generic lead forms.
Spambargo uses a layered, local-first architecture designed to reduce automated spam while minimizing false positives:
- Native integrations validate once at the server, avoiding duplicate checks and duplicate rate-limit increments.
- All administration and visitor-facing strings use the WordPress translation API. WordPress.org language packs select translations from the active locale.
- The dashboard and the most useful protection settings share one simple screen. Technical controls remain available under Advanced settings.
- Simple recommendation buttons add optional starting values without removing existing administrator entries.
- Generic lead forms use a best-effort browser/AJAX pre-check only when no native integration exists; direct server POST requests require a native or custom server-side integration.
- Signed, stateful behavior tokens measure elapsed time on the server instead of trusting browser-provided time fields.
- Signed tokens and correct challenges allow a small bounded retry window so unrelated field validation errors do not lock out real users.
- The optional math challenge is rendered, bound to the form/client context, expires, and limits failed attempts.
- Rate limiting uses atomic database counters, fixed minute/hour windows, and configurable IPv6 prefix grouping (default /64).
- Forwarded IP headers are ignored unless the direct peer is listed as a trusted proxy.
- IPv4 and IPv6 CIDR lists are supported.
- Optional browser correlation uses coarse attributes plus a random per-session identifier, a signed token and sessionStorage. Canvas and WebGL fingerprinting are not used.
- Log cleanup runs daily. CSV export streams in batches and neutralizes spreadsheet formulas.
- Email/webhook alerts are batched asynchronously. Webhooks use safe HTTP requests, require a 2xx response and can be HMAC-signed.
Supported integrations
- Contact Form 7 (native spam filter)
- Elementor Pro Forms (native validation)
- Ninja Forms
- JetFormBuilder (before form actions)
- WooCommerce classic registration and checkout
- WooCommerce Checkout Blocks (server-side Store API checks; behavior token and math challenge are not applied to Blocks)
- WordPress comments
- Generic browser-submitted lead forms containing email, phone or textarea fields (client-side AJAX pre-check only)
Forms can be explicitly protected with data-wpas-protect="1" or excluded with data-wpas-ignore="1".
Privacy
Spambargo does not send data to a service operated by the plugin author. All checks run on the site server by default.
When a submission is blocked, the plugin may store the IP address, email address, form identifier, block reason, optional content snippet and optional verified fingerprint hash. The content snippet can be disabled and logs are cleaned according to the configured retention period.
Optional browser correlation collects coarse screen-size buckets, timezone, language, platform, CPU-core count and touch capability. The server combines them with a random per-session identifier and returns a signed hash token stored in browser sessionStorage for up to eight hours. Raw attributes are not written to the spam log. Administrators should update their privacy notice as required by applicable law. Spambargo integrates with WordPress personal-data export and erasure tools and adds suggested text to the Privacy Policy Guide.
When a webhook URL is configured, batched blocked-submission data is sent to that administrator-selected endpoint. This is the only optional external data transfer performed by the plugin.
Installation
- Upload the
spambargofolder to/wp-content/plugins/. - Activate the plugin.
- Open Spambargo. The dashboard and the main protection settings appear together on the first screen.
- Test every important form in a staging environment before enabling strict signed-token mode, the math challenge, phone validation or browser correlation.
- If the site is behind a reverse proxy or CDN, add only the actual proxy IPs/CIDRs to Trusted Proxies before relying on forwarded client IPs.
FAQ
-
Does the plugin intercept every form?
-
No. Native integrations are never pre-validated by the universal AJAX checker. Generic interception targets likely lead forms and can be controlled with CSS selectors or data attributes. This generic mode is a browser-side, best-effort pre-check and cannot stop a bot that posts directly to a custom form handler; server-enforced protection requires one of the listed native integrations or custom server-side validation.
-
Can visitors without JavaScript submit?
-
By default, yes. The honeypot and server checks continue to work, while a missing behavior token is allowed. Administrators can enable strict token mode, which is stronger but requires JavaScript.
-
Does Checkout Blocks support the math challenge?
-
Not in this release. Checkout Blocks receive server-side identity, blacklist, content, phone and rate checks. Behavioral tokens and the visual math challenge are deliberately skipped because Blocks require a dedicated client-side extension-data integration.
-
How are blocked words and phrases matched?
-
Each line is a separate literal rule. A single-word line blocks that complete word, not a longer word that merely contains it. A multi-word rule blocks only when all of its words appear in the same order, although other words or punctuation may appear between them. Matching is not case-sensitive. Regular expressions are not executed. One matching line is enough to block a submission.
-
It adds an optional, intentionally strict list of common English spam terms covering gambling, pharmaceuticals, crypto, SEO outreach, adult content and similar messages. It is especially suitable for sites whose legitimate enquiries are mainly written in Hebrew. The list is never added automatically, does not replace existing entries and can be edited before saving.
-
Are logs deleted automatically?
-
Yes. A daily WordPress cron event removes entries older than the configured retention period and clears expired rate-limit counters.
-
What happens on uninstall?
-
Data is preserved by default. Enable “Delete all data when plugin is uninstalled” before deleting the plugin to remove its tables and settings.
Reviews
There are no reviews for this plugin.
Contributors & Developers
“Spambargo – Anti-Spam for Forms & Comments” is open source software. The following people have contributed to this plugin.
Contributors
Translate “Spambargo – Anti-Spam for Forms & Comments” into your language.
Interested in development?
Browse the code, check out the SVN repository, or subscribe to the development log by RSS.
Changelog
2.4.8
- Removed bundled PO and MO files so translations are delivered through translate.wordpress.org language packs.
- Converted built-in visitor messages to the standard WordPress gettext API.
- Registered every setting with an explicit type and sanitization callback.
- Added a dedicated webhook-secret validator that preserves printable HMAC secrets exactly without exposing them in the interface.
2.4.7
- Removed an unnecessary fclose() call from the streamed CSV export so the package passes WordPress Coding Standards.
- The php://output stream remains managed automatically by PHP at the end of the request.
2.4.6
- Replaced the optional English recommendation preset with a strict, editable set of common gambling, pharmaceutical, financial, SEO outreach and adult-spam rules.
- Kept every recommended rule opt-in and stopped adding blocked-content rules automatically on new installations.
- Clarified that each line is an independent literal rule, matching complete words or ordered multi-word phrases without case sensitivity.
- Removed administrator-supplied regular-expression execution and bounded the text allowed between phrase terms.
- Fixed the zero-link setting so it blocks every message containing a link.
- Prepared signed fields for native integrations even when their forms contain password fields.
- Restricted webhook delivery to validated HTTPS endpoints.
- Localized the honeypot label, sanitized custom visitor messages defensively and refreshed the Hebrew translation files.
2.4.5
- Removed dynamically interpolated SQL fragments from spam-log filtering and sorting queries.
- Prepared every log query with an explicit placeholder list and fixed replacement counts.
- Escaped WooCommerce Store API exception messages directly at the exception sink for static-analysis compatibility.
2.4.4
- Resolved Plugin Check errors for prepared database queries, output handling and translator comments.
- Sanitized request inputs and removed discouraged runtime configuration and translation-loading calls.
- Added a conservative starter list of common spam phrases while preserving customized lists.
2.4.1
- Clarified how blocked words and phrases are matched in the settings screen.
- Multi-word rules now require every word in the same order while allowing extra words between them.
- Expanded the safe local recommendation set without adding broad one-word rules.
2.4.0
- Combined the dashboard and main protection settings on one screen.
- Moved technical controls into an accessible Advanced settings panel that is closed by default.
- Reordered the settings so blocked phrases, link limits, temporary email domains and automatic limits appear first.
- Rewrote field labels and explanations in clear English and Hebrew.
- Changed the recommended minimum submission time to 2 seconds and clarified that only faster submissions are blocked.
- Kept Spam Log and Tools as separate menu pages.