DamaSoft Antispam

Description

DamaSoft Antispam gives every incoming comment a suspicion score, built from several independent signals. Only the total decides what happens. Everything runs on your own server: no comment data is ever sent anywhere.

Four layers of defence

Form checks stop automated bots, which are the vast majority of spam. An invisible honeypot field that people cannot see but bots fill in, a token only a real browser can produce, a minimum writing time, keyboard or mouse interaction, and a referer check. All of them are designed to work with page caching, and none of them shows a CAPTCHA or asks the visitor for an extra click.

Content heuristics catch spam written by hand: number of links, link BBCode, URLs in the author name, disposable email domains, high risk domain extensions, scripts foreign to the site language, text in capital letters, user agents from automated scripts, text identical to spam already blocked, and a rate limit per IP address.

A self-learning filter improves over time on your own site. Every time you mark a comment as spam or approve one, it updates its statistics on words, domains, email addresses and IP ranges. It also learns from comments that WordPress or another plugin files as spam. Legitimate examples are weighted twice as heavily as spam ones, because losing a real review is worse than letting one spam comment through.

Trust signals lower the score instead of raising it: a registered user, an author with an already approved comment, and, specific to WooCommerce, a verified purchase of the product being reviewed.

What happens to a comment

Below the moderation threshold the comment goes through as usual. Above it, it is held for moderation. Above the spam threshold the chosen action applies: mark as spam, hold for moderation, or reject without saving. An optional hard block rejects extreme cases before they are ever written to the database.

Observation mode

Before letting the plugin block anything, you can run it in observation mode: it analyses every comment and records in the log what it would have done, including clean comments and their scores, without blocking a thing. It is the safe way to tune the thresholds on real traffic.

What you get in the admin

A dashboard with live counters, a 14 day chart, the most recurring reasons, the most active sources and the state of the learning filter. A tab listing blocked spam, post comments and product reviews together, which WordPress on its own does not do, where you can restore, delete or empty everything. A full decision log with score and reasons, plus a log of the operations performed on the plugin. A system status page with environment details and a copy and paste summary for support. And a dashboard widget.

Privacy

No data leaves your server. The plugin makes no external HTTP requests of any kind. The log stores the name, email and IP address of suspicious comments only, for a configurable period, after which they are deleted automatically. The plugin integrates with the WordPress Privacy tools: it suggests text for your privacy policy and answers personal data export and erasure requests.

Languages

The plugin is fully internationalized. Translations are delivered through the WordPress.org language-pack system, so the installable package does not bundle .po or .mo files.