Char O’Day – AntiSpam Wizard

FAQ

Does the plugin send my data to external servers?

No. All spam detection runs entirely on your own server — there are no external API calls, no accounts, no API keys, and nothing leaves your site. This also means the plugin keeps working offline and adds no third-party dependency to your privacy policy.

What personal data does it store?

When a submission is flagged as spam, whether by a check or by your own moderation decision, the plugin stores a short text fragment, a SHA-256 hash of the IP address, and — for Contact Form 7 submissions — a salted SHA-256 hash of the email address. Raw IPs and emails are never stored. If the spam filter is trained on a comment — from the Spam Log, or by any Spam / Not Spam moderation decision — the full text of that comment is also stored as a training sample, keyed by the comment ID and by a salted SHA-256 hash of the commenter’s email address. All of it is exportable and erasable via the built-in WordPress Privacy tools, and removed completely on uninstall.

Does it work with contact forms?

Yes — with Contact Form 7. When CF7 is active, all enabled checks (including the honeypot and submit-time bot checks) run on form submissions and flagged ones are blocked through CF7’s native spam handling. No configuration is needed beyond a single toggle; without CF7 the plugin simply protects comments as usual.

Does it require JavaScript?

No. All checks, including the bot checks, work with JavaScript disabled, and the bot checks are designed to fail open: a cached page or a stripped form field can never cause a legitimate visitor to be flagged.

The honeypot and submit-time checks are fail-open heuristics intended to filter unsophisticated automated submissions. Missing or stale fields never cause blocking, so a cached page or a stripped form field cannot flag a legitimate visitor; a bot written for your specific site can bypass these two checks and is then evaluated by the remaining content-based checks, which, like any heuristic filter, catch most but not all targeted spam.

Will it slow down my site?

No. On regular page views the plugin only renders two hidden form fields and enqueues one small stylesheet; for a visitor who has commented before, it adds one condition to the comment query WordPress already runs, so their own flagged comments show as held — no detection runs, no extra query is made, and nothing from the training data is loaded. The full check pipeline runs only when a comment or form is actually submitted, and in the normal case only the models for the writing system that comment is actually written in are loaded: a Cyrillic comment loads the Cyrillic models and none of the other nine. On a warm cache that is a few milliseconds and a few megabytes; the first submission after the cache is cleared rebuilds that one writing system’s models, which takes a few tens of milliseconds for most writing systems and up to about a fifth of a second for Chinese, Japanese, Korean and Thai. Two cases fall back to the larger all-scripts model instead, which costs a fraction of a second to rebuild: a submission with no identifiable writing system — a bare phone number, say — and one written in a script that has too little training data of its own. When your site runs a persistent object cache, the models are stored compressed there, which is what keeps them small enough for it to hold; that costs a little extra on a rebuild and a little on each warm read, and buys far more than it costs. Without such a cache they are kept in the database instead, uncompressed, where there is no size limit to fit under. Models are cached for a day and rebuilt when that writing system’s training data changes, or when you edit the Excluded Tokens list, which changes how every model is built. They stay under the 1 MB per-item limit that persistent object caches such as Memcached impose — including as your own moderating adds to them, because the similarity model keeps the most recently learned spam within a fixed budget and, before a model is stored, it is weighed and the rarest words are dropped from its vocabulary until it fits — so such a cache stores it rather than refusing it, however long your site has been learning. Because everything runs locally, there is also no blocking round-trip to an external API on every comment, unlike cloud-based services.

Can it learn from my site’s spam?

Yes, and it learns from the moderating you already do. Every Spam / Not Spam decision made anywhere in WordPress trains the classifier — the Spam / Not Spam row action on the Comments screen, a bulk action, a decision made by another antispam plugin, or the Spam / Ham pills in the plugin’s own Spam Log. Administrators also get a “Mark as spam” link under each comment on the site itself, so a comment that slipped through can be removed and learned from in one click, from the page where you saw it. Each comment is learned from once per category, so the same decision made twice stores one sample, and changing your mind replaces the sample rather than keeping both. It ships with a seed corpus across 10 writing systems (Latin, Cyrillic, CJK, Arabic, and more) that covers the common comment-spam genres — classified ads with a phone number, “great post, visit my site”, loans, casino, crypto, dating, pharmacy — so non-English sites have a working starting point. Phone-number-like digit sequences are recognised as one signal regardless of the digits. The corpus is a starting point, not a spam database: the classifier gets good at your site’s spam from the comments you mark.

Why does a commenter still see a comment you flagged?

So that a real visitor caught by mistake does not post it again. When the plugin flags a comment, the person who wrote it still sees it in its place in the thread, marked “Your comment is awaiting moderation.” — exactly as WordPress shows any comment held for moderation — instead of watching it vanish. Only the author sees it: other visitors, feeds and comment counts show nothing, and in the admin the comment stays in your spam queue. The only thing stored for this is one number in your site’s options: the ID of the first comment flagged after you installed this version, so that older flags are left alone. Once you approve a flagged comment, it no longer counts as flagged: if you later mark it as spam yourself, its author does not see it, like any other comment you mark as spam. Comments flagged before you installed this version are never shown, because the plugin cannot tell which of them you already reviewed. The author is recognised the way WordPress recognises them for held comments: by their login, by the comment cookie their browser saved when they ticked the “Save my name, email” box, or, for ten minutes after posting, by the link WordPress sends them back to, even if they did not tick the box. As with WordPress’s own held comments, anyone given that link during those ten minutes sees the same view. You can turn it off with “Show flagged comments to their author” on the General tab.

Does it block all spam?

No. No spam filter catches everything, and no filter is free of false positives. AntiSpam Wizard is provided as is, without warranty of any kind, under the GPL-2.0-or-later licence — use it at your own risk and keep an eye on your Spam Log and moderation queue.