Title: AIS FormGuard Author: AI Stream Co. Ltd. Published: November 9, 2026 Last modified: November 9, 2026 --- Search plugins ![](https://ps.w.org/ais-formguard/assets/banner-772x250.png?rev=3791741) ![](https://ps.w.org/ais-formguard/assets/icon-256x256.png?rev=3791741) # AIS FormGuard By [AI Stream Co. Ltd.](https://profiles.wordpress.org/aistreamjp/) [Download](https://downloads.wordpress.org/plugin/ais-formguard.1.0.1.zip) * [Details](https://wordpress.org/plugins/ais-formguard/#description) * [Reviews](https://wordpress.org/plugins/ais-formguard/#reviews) * [Installation](https://wordpress.org/plugins/ais-formguard/#installation) * [Development](https://wordpress.org/plugins/ais-formguard/#developers) [Support](https://wordpress.org/support/plugin/ais-formguard/) ## Description The administration screens are available in Japanese only. Paid cloud sales-email detection is intended for Japanese-language inquiries only; local protection works regardless of language. AIS FormGuard protects your Contact Form 7 forms from bot spam, and is designed for site owners who do not have an engineer on staff. A three-step setup wizard checks your environment, lets you choose a protection level, and verifies that everything works. It starts in **monitor mode**, which only records what it would have blocked, so you can confirm that no real inquiry is affected before you switch to **defense mode**. **What makes AIS FormGuard different** * **It tags, it does not block, anything that could be a real inquiry.** Many spam plugins discard whatever they dislike. If you turn on the optional external service, messages that look like sales solicitations are delivered with a tag in the subject line (and, if you wish, to a different recipient), so a genuine inquiry that is misjudged is never lost. Only clear bot signals are blocked. * **See before you block.** It starts in monitor mode, which records what it would have blocked without blocking anything. You switch to defense mode only after you have checked the results. * **Several independent signals, on your own server, with nothing to register or buy.** Honeypot, signed token, minimum submission time, rate limit, link counter and duplicate detection all run locally and are free. Only the optional sales- email detection needs an API key from a paid plan. There is no CAPTCHA, the plugin adds no JavaScript or stylesheet to your pages, and it contacts an external server only when the site administrator enters an API key and turns on the optional integration. * **Repeat offenders are blocked automatically.** Sources that keep triggering strong bot signals are blocked temporarily. While blocked, their submissions are treated as spam by Contact Form 7 and no email is sent. Similar events are grouped into one log line, and a safety check keeps the feature off when the site is behind a proxy it cannot identify. * **Built for people without an engineer.** A three-step wizard, plain-language reasons for each detection, a weekly summary email, and a diagnostic summary that never contains message content. **Protection that runs entirely on your own site** * Hidden honeypot field. * Signed timestamp token that detects forged forms and submissions made too quickly after the form was displayed. * Per-IP rate limit. * URL count and duplicate-message checks. * Automatic temporary blocking of sources that keep triggering strong bot signals( see below). **Automatic blocking of attack sources (defense mode only)** When the same source repeatedly triggers a strong bot signal (a filled honeypot field or a missing token) within a short time, it is blocked for a limited time. While a source is blocked, its form submissions are treated as spam by Contact Form 7, so no email is sent, and the other checks are skipped. The dashboard lists blocked sources, lets you unblock them, and gives you a copy-and-paste list that you can add to your firewall or CDN. To avoid blocking all visitors by mistake, automatic blocking is disabled when the site appears to be behind a proxy or CDN (such as Cloudflare) and you have not told the plugin which proxies to trust. **Dashboard for non-engineers** * Seven-day totals and a day-by-day graph. * Reasons for each detection, shown in plain language. * Similar events are grouped into one line with a counter, so a large attack does not flood your database. * Weekly summary email. * One-click return to monitor mode, and a diagnostic summary you can send to support( it contains no message content). **Optional: sales-email detection with an external service** With an API key from a paid plan, the plugin can ask the AIS FormGuard judgement service whether a message that passed the local checks looks like a sales solicitation. Messages judged to be sales solicitations are **not blocked**. They are delivered with a tag in the subject line (for example “【営業の可能性】”), optionally to a different recipient, so that a genuine inquiry that is misjudged is never lost. This feature is **off by default**. See “External services” below for exactly what is sent. **Fail-open by design** If anything goes wrong (for example, the optional service is unreachable or slow), the message is allowed through instead of being blocked. **What it does not do** * It is not a CAPTCHA. It can be used alongside Cloudflare Turnstile, Akismet or reCAPTCHA. * By itself, the plugin does not read the wording of messages. Judging whether a message is a sales solicitation is done only by the optional external service. * It works with Contact Form 7 only. **Language** The administration screens are currently available in Japanese only. Paid sales- email detection is intended for Japanese-language inquiries only. ### Privacy **Data stored on your site** * A log table (`{prefix}aisfg_log`) that records the time, form ID, decision, reason codes, a hit counter, and the visitor’s IP address with its last part masked ( the last octet for IPv4, the lower 80 bits for IPv6). **The content of messages is never stored.** Log entries are deleted after 30 days by default. * A table of blocked sources (`{prefix}aisfg_ban`) that records the full IP address of each blocked source, the reason, counters, and timestamps. Entries are deleted 7 days after the block expires, or when you unblock the source. * Short-lived counters (WordPress transients) keyed by a hash of the IP address. * Plugin settings. If you use the optional service, the API key you enter is stored in the WordPress options table. IP addresses can be personal data under some privacy laws. We recommend mentioning the use of this plugin in your site’s privacy policy. **Data sent to external services** Only if you enable the optional sales-email detection. See “External services”. AI judgement uses Amazon Bedrock (AWS Tokyo region); see External services. ### External services This plugin can optionally connect to the AIS FormGuard judgement service, operated by AIStream Corporation (https://www.aistream.co.jp/), to check whether an enquiry looks like a sales or solicitation email. **This feature is off by default.** The plugin connects only after a site administrator enters an API key and turns on “ Use sales-email detection”. * Service endpoint: `https://vtrsplxud8.execute-api.ap-northeast-1.amazonaws.com/ prod` (operated by AIStream Corporation on Amazon Web Services, Tokyo region). * When a Contact Form 7 form is submitted, the plugin sends the site URL, form ID, the visitor’s IP address with the last part masked, simple submission signals( such as time to submit and message length), and the submitted field values with email addresses and phone numbers replaced by placeholders. The message text may be processed by Amazon Bedrock (AWS, Tokyo region) for AI judgement. The message text is not stored on the server. * When the integration is turned on, and when the settings screen is opened or saved (and at most once per hour during submissions), the plugin sends the site URL, plugin version and WordPress version to check the plan and bind the API key to the site. * The API key is sent in an HTTP header with every request. * The purchase button only opens our purchase page (`https://d3a2ozkjmvji3q.cloudfront. net/buy.html`) in the administrator’s browser; the plugin itself does not request it. Payment is handled by Stripe Checkout. Nothing is sent unless the optional integration is turned on. WordPress user accounts and passwords are never sent. * AIS FormGuard Terms of Use: https://www.aistream.co.jp/ais-form-guard-tou/ * AIStream Corporation Privacy Policy: https://www.aistream.co.jp/privacy-policy/ * AWS: https://aws.amazon.com/service-terms/ , https://aws.amazon.com/privacy/ * Stripe: https://stripe.com/legal/ssa , https://stripe.com/privacy This plugin does not contact Cloudflare. Cloudflare Turnstile, if used, is configured in Contact Form 7. ## Screenshots [⌊Setup wizard: environment check.⌉⌊Setup wizard: environment check.⌉[ Setup wizard: environment check. [⌊Dashboard: status, seven-day totals, daily graph, and recent detections.⌉⌊Dashboard: status, seven-day totals, daily graph, and recent detections.⌉[ Dashboard: status, seven-day totals, daily graph, and recent detections. [⌊Automatic blocking of attack sources: settings, blocked sources, and the copy- and-paste list.⌉⌊Automatic blocking of attack sources: settings, blocked sources, and the copy-and-paste list.⌉[ Automatic blocking of attack sources: settings, blocked sources, and the copy-and- paste list. [⌊Optional sales-email detection settings.⌉⌊Optional sales-email detection settings .⌉[ Optional sales-email detection settings. ## Installation 1. Install and activate Contact Form 7 (version 5.4 or later). 2. Upload the `ais-formguard` folder to the `/wp-content/plugins/` directory, or install the plugin through the WordPress plugins screen. 3. Activate the plugin through the “Plugins” screen. 4. Open AIS FormGuard from the admin menu and follow the three steps (environment check, protection level, verification). The plugin starts in monitor mode. 5. After a week or so, review the “Recent detections” list on the dashboard. If no genuine inquiry was flagged, switch to defense mode. If your site is behind Cloudflare or another proxy/CDN, also read the FAQ entry about trusted proxies, and exclude the page that contains your form from page caching. ## FAQ ### Do I need Contact Form 7? Yes. AIS FormGuard works only with Contact Form 7 (5.4 or later). ### Does the plugin send any data to an external server by default? No. All of the protection described above runs on your own site. The plugin contacts an external server only when the site administrator enters an API key and turns on the optional integration. ### Can it block genuine visitors? It starts in monitor mode, which blocks nothing, so you can check first. In defense mode, a message is blocked only when it shows signs of automation, such as a filled hidden field, a forged token, a submission that is far too fast, repeated messages, or an unusual number of links. Messages that look like sales solicitations are never blocked; they are delivered with a tag in the subject line. If a visitor is blocked by mistake, you can unblock them from the dashboard, and you can add addresses that must never be blocked. ### How is this different from other spam plugins for Contact Form 7? Most plugins decide only between “accept” and “block”. AIS FormGuard adds a third outcome: a message that might be a sales solicitation, but might also be a real inquiry, is delivered with a tag in the subject line instead of being discarded. It also offers a monitor mode that blocks nothing while you check the results, runs its checks on your own site without registering or buying anything (only the optional sales-email detection needs an API key from a paid plan), and temporarily blocks sources that keep sending obvious bot traffic. Other plugins may suit you better if you want to block sales messages outright or want a different approach; AIS FormGuard is designed to avoid losing a genuine inquiry. ### How does this compare with Cloudflare Turnstile? They are complementary. Turnstile (a feature of Contact Form 7) checks in the visitor’s browser that the visitor is likely to be a real browser. AIS FormGuard looks at how a submission behaves and, optionally, at its content. Contact Form 7 runs its Turnstile check before AIS FormGuard does, so submissions rejected by Turnstile are not seen by this plugin. ### My site is behind Cloudflare or another proxy. What do I need to do? Enter the IP ranges of your proxy in “Trusted proxies” (Dashboard, “Automatic blocking of attack sources”). Until you do, the plugin cannot tell your visitors apart and, for safety, automatic blocking stays off. Also exclude the page that contains your form from page caching. ### Can it stop all sales emails? No. Automated sales mailers are fairly easy to recognize, but a sales message written by hand in natural language is hard to distinguish from a genuine inquiry. This is why such messages are tagged and delivered rather than blocked. ### What data does the plugin store? See the “Privacy” section below. ### What happens when I uninstall the plugin? The plugin’s settings, scheduled tasks, and database tables are deleted. ## Reviews There are no reviews for this plugin. ## Contributors & Developers “AIS FormGuard” is open source software. The following people have contributed to this plugin. Contributors * [ AI Stream Co. Ltd. ](https://profiles.wordpress.org/aistreamjp/) [Translate “AIS FormGuard” into your language.](https://translate.wordpress.org/projects/wp-plugins/ais-formguard) ### Interested in development? [Browse the code](https://plugins.trac.wordpress.org/browser/ais-formguard/), check out the [SVN repository](https://plugins.svn.wordpress.org/ais-formguard/), or subscribe to the [development log](https://plugins.trac.wordpress.org/log/ais-formguard/) by [RSS](https://plugins.trac.wordpress.org/log/ais-formguard/?limit=100&mode=stop_on_copy&format=rss). ## Changelog #### 1.0.1 * Removed the redirect after activation. * Removed the duplicate purchase button on the paid plan tab. #### 1.0.0 * Initial public release. * Local protection for Contact Form 7: honeypot, signed timestamp token, minimum submission time, per-IP rate limit, URL count and duplicate-message checks. * Setup wizard, monitor and defense modes, dashboard, and weekly summary email. * Automatic temporary blocking of sources that repeatedly trigger strong bot signals( defense mode only), with a safety check for untrusted proxies or CDNs. * Optional sales-email detection with an external service (off by default). Messages judged to be sales solicitations are tagged, not blocked. ## Meta * Version **1.0.1** * Last updated **3 hours ago** * Active installations **Fewer than 10** * WordPress version ** 7.1 or higher ** * Tested up to **7.1.4** * PHP version ** 8.1 or higher ** * Tags * [anti-spam](https://wordpress.org/plugins/tags/anti-spam/)[bot](https://wordpress.org/plugins/tags/bot/) [contact form 7](https://wordpress.org/plugins/tags/contact-form-7/)[honeypot](https://wordpress.org/plugins/tags/honeypot/) [spam](https://wordpress.org/plugins/tags/spam/) * [Advanced View](https://wordpress.org/plugins/ais-formguard/advanced/) ## Ratings No reviews have been submitted yet. [Your review](https://wordpress.org/support/plugin/ais-formguard/reviews/#new-post) [See all reviews](https://wordpress.org/support/plugin/ais-formguard/reviews/) ## Contributors * [ AI Stream Co. Ltd. ](https://profiles.wordpress.org/aistreamjp/) ## Support Got something to say? Need help? [View support forum](https://wordpress.org/support/plugin/ais-formguard/)