Title: Data443 Anti-Spam Author: Data443 Risk Mitigation, Inc. Published: August 17, 2026 Last modified: August 18, 2026 --- Search plugins ![](https://ps.w.org/data443-anti-spam/assets/banner-772x250.png?rev=3651679) ![](https://ps.w.org/data443-anti-spam/assets/icon.svg?rev=3651679) # Data443 Anti-Spam By [Data443 Risk Mitigation, Inc.](https://profiles.wordpress.org/data443/) [Download](https://downloads.wordpress.org/plugin/data443-anti-spam.1.0.2.zip) * [Details](https://wordpress.org/plugins/data443-anti-spam/#description) * [Reviews](https://wordpress.org/plugins/data443-anti-spam/#reviews) * [Installation](https://wordpress.org/plugins/data443-anti-spam/#installation) * [Development](https://wordpress.org/plugins/data443-anti-spam/#developers) [Support](https://wordpress.org/support/plugin/data443-anti-spam/) ## Description Data443 Anti-Spam extracts every URL from a comment and classifies it against the Data443 classification API. A comment linking to malware, phishing, or another flagged category is held for moderation or sent straight to spam — your choice. The verdict comes from live URL classification, so there are no keyword rules to maintain and no local list of bad words. **What it does** * Checks comments as they are submitted, before WordPress saves them — and catches comments added directly by importers, WP-CLI, or other plugins, which never pass through a comment form at all. * Checks **Contact Form 7** submissions when that plugin is active. A flagged submission is marked as spam, with the reason recorded in Contact Form 7’s own spam log. * Records the verdict, the matched categories and a timestamp on each comment, shown in an “Anti-Spam Status” column. Opening a comment shows every link that was classified and what the API said about it. * Adds **Comments Anti-Spam Stats**: totals, the last 30 days as a chart, and the comments where your moderation disagreed with the plugin. Readable by anyone who can moderate comments. * Sweeps existing comments on demand, and includes a Test URLs tool for checking links by hand. * Has a **Check Connection** button that tests each step between your site and the API in order and names the first one that fails. * Holds a comment for moderation if the API cannot be reached and retries it in the background, rather than publishing something nothing has checked. * Reports misconfiguration instead of failing quietly, with each notice linking to the fix and shown only to users who can apply it — plus one master switch that turns everything off. **Requirements** The Data443 classification API is a paid service with a free 30-day trial. A card is required to start the trial, but nothing is charged during it: cancel before the 30 days are up and you are charged nothing at all, and after that you can cancel any time. The endpoint comes filled in and subscribing is two clicks — the credentials install themselves, with nothing to copy or paste. Until the site is subscribed nothing is evaluated and WordPress moderates comments exactly as before. **Multisite** Runs per site. Each site has its own endpoint, subscription, settings and results, and one subscription covers one site. There is no network settings screen and nothing for a network administrator to do. ### External Services #### Data443 classification and subscription API The plugin sends the URLs found in comments and Contact Form 7 submissions to `https:// websecjd-rest.data443.io/` to have them classified, and uses the same service to set up and manage this site’s subscription. The classification is what decides whether a comment is spam, so the plugin cannot do its job without it. Clearing the **API Endpoint** setting stops every request below. What is sent, and when: * **Complete URLs, including their paths and query strings**, with an access token— whenever a comment or Contact Form 7 submission containing a link is checked, when an administrator runs the bulk sweep or the Test URLs tool, and when a comment held by an earlier failure is retried in the background. A URL can itself contain personal information in its path or query. Comment text, author names and email fields are not sent. * `https://example.com/`, as a probe — when an administrator clicks **Check Connection**. * **A random site identifier generated by this plugin, and a one-time claim token**— when an administrator starts a subscription, so that the credentials issued at checkout can be collected by this site afterwards. * **The client ID and secret Data443 issued to this site**, exchanged for a short- lived access token at Data443’s identity provider, `https://keycloak.data443. io/` — whenever the cached token expires. * No other content is added by the plugin, though WordPress attaches its standard user-agent header, which includes your site’s address. This service is provided by Data443 Risk Mitigation, Inc.: [terms of service / EULA](https://data443.com/end-user-license-agreement/), [terms for support and maintenance services](https://data443.com/terms-for-support-and-maintenance-services/), [privacy policy](https://data443.com/privacy-policy/). #### Stripe Subscribing and managing billing open Stripe-hosted pages in the administrator’s browser, and Stripe reports the resulting subscription status back to Data443. The purchaser gives Stripe an email address, card details and whatever billing information Stripe requires; the plugin neither sees nor stores any of it. Nothing reaches Stripe unless an administrator opens one of those pages. This service is provided by Stripe, Inc.: [consumer terms of service](https://stripe.com/legal/consumer), [Stripe services agreement](https://stripe.com/legal/ssa), [privacy policy](https://stripe.com/privacy). ## Installation 1. Upload the plugin to `/wp-content/plugins/data443-anti-spam/` and activate it. 2. Go to **Settings Data443 Anti-Spam**. A checklist at the top shows what is still needed and disappears once the plugin is working. 3. The **API Endpoint** is already filled in. It must start with `https://`, and only needs changing if Data443 gave you a different address. 4. Click **Subscribe** and check out on Stripe’s page. There is no account to create and no credential to look after. 5. Come back to the settings page. The credentials arrive on their own, usually within seconds. If you closed the tab first, the page offers an **I already subscribed— check again** button. 6. On the **Tools** tab, click **Check Connection**. Optionally run **Evaluate All Comments** there to check comments that predate the plugin. ## FAQ ### Does it send my visitors’ comments to a third party? Only the complete URLs found in the comment body, including their paths and query strings, are sent for classification. The comment text, author name and email field stay on your site — although a URL can itself contain personal information in its path or query. See **External Services** above. ### What about a comment with no links? It is recorded as clean, with no API request made. ### What happens if the API cannot be reached? The comment is held for moderation rather than published, and retried about twenty minutes later. If that attempt succeeds the comment is handled normally — approved if your own discussion settings would have approved it, or sent to spam if it turns out to be spam. The moderation email is held back until there is a real verdict, so an outage does not produce one message per comment. Comments still waiting after fifteen days stop being retried. ### Does it check Contact Form 7 submissions? Yes, automatically whenever Contact Form 7 is active — there is nothing to configure and no field to add. Sender email addresses are stripped before the links are read, so your visitors’ mail providers are never classified. A flagged submission is marked as spam by Contact Form 7, so no mail is sent, and the reason appears in its spam log. If the API cannot be reached a form submission is **delivered** rather than rejected: a comment can be held and rechecked later, a contact-form message cannot, so rejecting it would lose it. To reject anything that could not be checked instead: ``` add_filter( 'data443_form_reject_on_error', '__return_true' ); ``` ### Do I need to create an account or enter a licence key? No. Click **Subscribe** and check out on Stripe’s page; this site then sets up its own access, server to server. The credential never passes through your browser, and is exchanged for a short-lived token on each request. ### Is there a free trial, and when am I charged? Every subscription starts with a **free 30-day trial**. A card is required to start it — that is what stops the same trial being taken repeatedly — but **nothing is charged during those 30 days**, and cancelling before they are up costs nothing at all. Billing begins at the end of the trial, and after that a **Cancel subscription** button on the settings screen stops the next payment. Comments carry on being checked to the end of the period you have paid for, and your settings are left alone. ### Why is my http:// endpoint refused? Every request carries a credential — your client secret, or a bearer token — which anyone on the network could read over plain HTTP, so a non-HTTPS address is refused rather than used. Comments are held for moderation while it is misconfigured; none are published unchecked. Addresses on your own machine (`localhost`, `127.0.0.1`, and `.local`, `.test` or `.localhost` names) are exempt. If an internal endpoint genuinely cannot use HTTPS, add to `wp-config.php`: ``` define( 'DATA443_ANTI_SPAM_ALLOW_INSECURE_TRANSPORT', true ); ``` ### Can I send spam straight to the spam folder, or stop checking altogether? Untick **Flag for Approval** and comments identified as spam skip the moderation queue for the spam folder. Untick **Enable Evaluation** and nothing is evaluated at all — not submissions, not the bulk sweep, not the tools — without deactivating the plugin. ### Does it work on multisite? Yes, per site, whether activated on one site or across the network. Each site keeps its own settings, subscription and results, so nothing another site does affects yours. A subscription covers one site, so each site that wants its comments checked subscribes for itself; there is no network settings screen and nothing for the network administrator to configure. ### What is removed when I delete the plugin? Every option it stored, including your credentials and the cached access token, and the evaluation results and timestamps on all comments. On a network the cleanup visits every site. ## Reviews There are no reviews for this plugin. ## Contributors & Developers “Data443 Anti-Spam” is open source software. The following people have contributed to this plugin. Contributors * [ Data443 Risk Mitigation, Inc. ](https://profiles.wordpress.org/data443/) [Translate “Data443 Anti-Spam” into your language.](https://translate.wordpress.org/projects/wp-plugins/data443-anti-spam) ### Interested in development? [Browse the code](https://plugins.trac.wordpress.org/browser/data443-anti-spam/), check out the [SVN repository](https://plugins.svn.wordpress.org/data443-anti-spam/), or subscribe to the [development log](https://plugins.trac.wordpress.org/log/data443-anti-spam/) by [RSS](https://plugins.trac.wordpress.org/log/data443-anti-spam/?limit=100&mode=stop_on_copy&format=rss). ## Changelog #### 1.0.2 Aug 18, 2026 * Fix issues with Stripe payment processing #### 1.0.1 Aug 17, 2026 * Add information about external services to this readme. #### 1.0.0 Aug 14, 2026 * First release: URL classification at submission time and in a bulk sweep, client- credentials authentication, the Anti-Spam Status column, and the Test URLs tool. ## Meta * Version **1.0.2** * Last updated **17 hours ago** * Active installations **Fewer than 10** * WordPress version ** 4.9 or higher ** * Tested up to **7.0.4** * PHP version ** 7.2 or higher ** * Tags * [antispam](https://wordpress.org/plugins/tags/antispam/)[comments](https://wordpress.org/plugins/tags/comments/) [moderation](https://wordpress.org/plugins/tags/moderation/)[security](https://wordpress.org/plugins/tags/security/) [spam](https://wordpress.org/plugins/tags/spam/) * [Advanced View](https://wordpress.org/plugins/data443-anti-spam/advanced/) ## Ratings No reviews have been submitted yet. [Your review](https://wordpress.org/support/plugin/data443-anti-spam/reviews/#new-post) [See all reviews](https://wordpress.org/support/plugin/data443-anti-spam/reviews/) ## Contributors * [ Data443 Risk Mitigation, Inc. ](https://profiles.wordpress.org/data443/) ## Support Got something to say? Need help? [View support forum](https://wordpress.org/support/plugin/data443-anti-spam/)