Title: MDL Spam Filter
Author: Monday Digital Lab
Published: <strong>July 22, 2026</strong>
Last modified: July 22, 2026

---

Search plugins

![](https://ps.w.org/mdl-spam-filter/assets/banner-772x250.png?rev=3618008)

![](https://ps.w.org/mdl-spam-filter/assets/icon-256x256.png?rev=3618555)

# MDL Spam Filter

 By [Monday Digital Lab](https://profiles.wordpress.org/mondaydigitallab/)

[Download](https://downloads.wordpress.org/plugin/mdl-spam-filter.1.0.0.zip)

 * [Details](https://wordpress.org/plugins/mdl-spam-filter/#description)
 * [Reviews](https://wordpress.org/plugins/mdl-spam-filter/#reviews)
 *  [Installation](https://wordpress.org/plugins/mdl-spam-filter/#installation)
 * [Development](https://wordpress.org/plugins/mdl-spam-filter/#developers)

 [Support](https://wordpress.org/support/plugin/mdl-spam-filter/)

## Description

**Stop contact form spam before it reaches your inbox.** MDL Spam Filter is a lightweight
anti-spam plugin that protects Contact Form 7, WPForms, Gravity Forms, Elementor
forms, and any other contact form — using keyword filtering, a honeypot, rate limiting,
a language guard, and optional AI spam detection (Anthropic Claude, OpenAI GPT, 
or any OpenAI-compatible provider). No CAPTCHA, no visitor friction, and nothing
is stored or emailed until a submission passes the filter.

MDL Spam Filter scans front-end contact form submissions on the server before any
form handler runs. When a submission is detected as spam, it is blocked: no email
is sent — including the admin notification of a new submission and any autoresponder—
and nothing is written to your form plugin’s entries or email log. You choose whether
blocked submissions are recorded in this plugin’s own private log.

Detection works two ways, used alone or together:

 * **Keywords** — a built-in list of common spam phrases plus your own custom keywords.
 * **AI** — optional classification by Anthropic (Claude), OpenAI, or any custom
   OpenAI-compatible provider using your own API key.

The filter is form-agnostic. It inspects any POST request that carries an email 
address — or that is recognisably from a supported form plugin even without an email
field — so it works with Contact Form 7, WPForms, Gravity Forms, Elementor forms,
raw HTML forms, and most others without per-plugin configuration. AJAX and REST 
submissions (such as Contact Form 7) receive a proper response, so the submit spinner
never hangs.

When AI detection is enabled, the verdict is requested as a strict yes/no decision
and, where the provider supports it, constrained to a structured JSON response —
so a confident block/allow is the only possible answer. If the AI provider is unreachable(
outage, timeout, bad key) the plugin can fall back to a keyword scan instead of 
letting the submission through, and an optional per-visitor rate limit throttles
floods before any AI call is made.

When spam is caught you choose what the sender sees:

 * **Silently discard** — the form shows its normal success message while the submission
   is quietly dropped, giving bots no signal.
 * **Show a blocked message** — the form displays a clear “flagged as spam” notice.

#### Key features

 * Server-side blocking before the submission reaches form handlers or email.
 * Works with AJAX and REST forms (Contact Form 7, WPForms, Gravity Forms, Elementor,
   and more) without hanging the submit spinner.
 * Silent discard that mimics a successful send, or a visible blocked message.
 * Keyword detection with 200+ built-in keywords organised into collapsible categories(
   pharma, SEO outreach, scams, gambling, and more) — each toggleable individually,
   per category, or all at once — plus unlimited custom keywords.
 * Activate, pause, or remove individual keywords without losing them — custom keywords
   use the same chip interface as the built-in list.
 * Regular-expression keywords: wrap a custom term in slashes (/pattern/) for advanced
   matching — invalid patterns are skipped safely.
 * Per-keyword hit counters show how many submissions each keyword has blocked, 
   so dead keywords are easy to prune.
 * Review-queue feedback loop: one-click Allow sender / Block sender on held items,
   plus an inline “add keyword” box that turns a held spam’s telltale phrase into
   a blocking keyword.
 * Optional AI detection via Anthropic, OpenAI, or a custom OpenAI-compatible provider(
   bring your own API key).
 * AI verdicts constrained to a structured yes/no response (json_schema / json_object)
   where the provider supports it, so the result can’t be ambiguous free text.
 * Custom AI detection rules: keep the built-in rules, write your own, or combine
   both — with a “Generate rules with AI” assistant and ready-made templates that
   draft rules from a plain-language description of your business.
 * Keyword fallback when the AI provider is unavailable, so an API outage does not
   silently let spam through (AI-only mode; on by default).
 * Optional per-visitor submission rate limit to throttle floods before any AI call
   is made.
 * Honeypot field and minimum-submit-time check that stop obvious bots before any
   keyword or AI work (no cost, no false success signal).
 * Optional language guard: block the languages and alphabets you choose (Cyrillic,
   Chinese, Arabic, and more) or allow only the ones you choose — plus an always-
   on trap for words mixing Latin with look-alike Cyrillic letters, a common keyword-
   filter evasion trick. Accented Latin languages are never affected.
 * Allow list (never block) and deny list (always block) by email address, domain,
   or IP — with a one-click “Block sender” action on every Filter Log and Review
   row.
 * Form targeting: scan all forms, or only selected forms identified by their id,
   class, or name.
 * Outgoing-email safety net: when a submission is spam, every email it triggers
   is suppressed — including the admin “new submission” notification and any autoresponder.
 * Review queue (on by default): hold keyword/AI-flagged submissions for manual 
   review — the submission is stopped before anything is recorded or emailed. View
   the fields, then Accept to email it to the site admin (kept out of the filter
   log) or Block to drop it (recorded in the filter log). Optionally get an email
   notification when a submission is held.
 * Optional email alert to an admin when the plugin hits a provider error — invalid
   or expired API key, exhausted credit or quota, or a provider outage — throttled
   to one email per distinct error every 10 minutes.
 * Private, opt-in log of blocked submissions in a dedicated database table.
 * Automatic retention cleanup: filter-log and review-queue entries older than a
   configurable number of days (default 90, 0 = keep forever) are pruned daily, 
   so a spam flood cannot grow the database forever.
 * Optional weekly email digest: blocked totals, detection-method breakdown, top
   blocked senders, and the review-queue backlog — skipped automatically when there
   is nothing to report.
 * A dedicated Notifications settings section: one central notification email address
   for every alert (review holds, provider errors, weekly digest), an on/off toggle
   and optional override address per notification, a tag-style picker for adding
   multiple recipients to any field (plain comma-separated input still works), and
   a send-test button that resolves the recipient exactly like the real notification;
   everything falls back to the site admin email.
 * “Spam blocked” counter in the WordPress dashboard At a Glance widget.
 * Analytics dashboard with a 7/30/90-day period picker: daily blocked-submission
   chart, trend deltas against the previous period, busiest-day and awaiting-review
   tiles, detection-method breakdown, and top blocked senders and targeted pages—
   every bar, method, sender, and page clicks through to the pre-filtered Filter
   Log.
 * System-health card on the dashboard: protection state, detection engine and API-
   key source, AI-provider status (from the circuit breaker — no live call), review-
   queue backlog, scheduled maintenance (with your retention period), and weekly-
   digest status, each with a fix-it link when something needs attention. The cron
   rows diagnose real scheduling problems: an overdue event (WP-Cron not firing 
   on a quiet site) or a stale queue entry gets an amber warning with the fix.
 * Dismissable setup checklist on the dashboard that tracks protection, detection,
   notifications, and the first test email — each step deep-links to the right screen.
 * Dashboard aggregates are cached for five minutes so the overview never runs heavy
   queries on every load.
 * Enterprise-grade admin polish: every screen opens with a one-line purpose statement
   and a primary action, a persistent banner warns on every screen when protection
   is off, the Filter Log, Review, and Activity lists all sort by date, table headers
   stay visible while scrolling long lists, and the whole UI follows your chosen
   WordPress admin color scheme.
 * Accessible by design: keyboard-visible focus on every custom control (toggles,
   keyword chips, recipient pickers, chart bars), screen-reader table behind the
   dashboard chart, WCAG AA contrast on badges and status colors, and reduced-motion
   support.
 * Contextual help on every screen: the WordPress Help flyout carries the screen’s
   purpose and the FAQ entries relevant to that page.
 * One-click dashboard report export (CSV): totals, daily counts, method breakdown,
   and top senders/pages for the selected period.
 * Filter Log excerpts expand in place, so long submissions can be read without 
   leaving the list.
 * Searchable, filterable log with date range and method filters, sortable dates,
   bulk delete, and CSV export.
 * Settings import/export as JSON for moving configuration between sites (API keys
   are never exported).
 * Keywords-only import/export for sharing keyword lists between sites without touching
   other settings.
 * Activity audit log: who changed settings and keywords, imports/exports, log purges,
   AI connection tests, and AI provider outages — with automatic 90-day retention.
 * Stores submitter IP as a one-way hash for privacy.
 * WooCommerce-style navigation: a dedicated top-level MDL Spam Filter menu with
   Dashboard, Settings, Keywords, Review, Filter Log, Activity Log, Help, and Import/
   Export pages. The Settings page is organised into sections (Protection, Detection
   engine, AI engine, Advanced protection, Form targeting, Email & logging, Notifications)
   and the Help page into Getting started / FAQ / About — each with its own section
   links.

### External Services

This plugin connects to third-party AI services **only when AI detection is enabled**,
or when an admin uses the optional “Generate rules with AI” assistant on the settings
page. Keyword-only mode with the assistant unused contacts no external service.

**Anthropic (Claude API)**
 Used to classify submission text as spam or genuine 
when the AI provider is set to Anthropic, and to draft custom detection rules when
an admin uses the “Generate rules with AI” assistant. What is sent: the text content
of the contact form submission and your API key, sent to the endpoint at the time
a submission is scanned; and, only when an admin clicks “Generate rules with AI”,
the business description that admin types into the assistant. Endpoint: https://
api.anthropic.com/v1/messages Terms of Service: https://www.anthropic.com/legal/
commercial-terms Privacy Policy: https://www.anthropic.com/legal/privacy

**OpenAI (Chat Completions API)**
 Used to classify submission text as spam or genuine
when the AI provider is set to OpenAI, and to draft custom detection rules when 
an admin uses the “Generate rules with AI” assistant. What is sent: the text content
of the contact form submission and your API key, sent to the endpoint at the time
a submission is scanned; and, only when an admin clicks “Generate rules with AI”,
the business description that admin types into the assistant. Endpoint: https://
api.openai.com/v1/chat/completions Terms of Use: https://openai.com/policies/terms-
of-use Privacy Policy: https://openai.com/policies/privacy-policy

**Custom provider (optional)**
 If you set the AI provider to “Custom”, submission
text and your API key are sent to the OpenAI-compatible endpoint URL you enter in
the settings — and, only when an admin clicks “Generate rules with AI”, the business
description that admin types into the assistant. The endpoint must be an https://
URL that is not a private or loopback address (an http:// endpoint can be enabled
with the `mdlsf_allow_insecure_custom_endpoint` filter for a trusted local model).
No request is made unless you configure this. Because the endpoint is supplied by
you, review the terms and privacy policy of whichever provider you point it at (
for example OpenRouter, Groq, Together AI, or a self-hosted model).

## Screenshots

[⌊Dashboard with the setup checklist, period picker (7/30/90 days), trend deltas,
blocked-submission chart, and system-health card.⌉⌊Dashboard with the setup checklist,
period picker (7/30/90 days), trend deltas, blocked-submission chart, and system-
health card.⌉[

Dashboard with the setup checklist, period picker (7/30/90 days), trend deltas, 
blocked-submission chart, and system-health card.

[⌊Settings page with WooCommerce-style sections, detection mode, and AI provider
options.⌉⌊Settings page with WooCommerce-style sections, detection mode, and AI 
provider options.⌉[

Settings page with WooCommerce-style sections, detection mode, and AI provider options.

[⌊Notifications section: one central address, per-notification toggles and overrides
with a tag-style multi-email picker, and a send-test button.⌉⌊Notifications section:
one central address, per-notification toggles and overrides with a tag-style multi-
email picker, and a send-test button.⌉[

Notifications section: one central address, per-notification toggles and overrides
with a tag-style multi-email picker, and a send-test button.

[⌊Keywords page: built-in keywords grouped by category, with search and per-group
toggles, plus your own custom keywords.⌉⌊Keywords page: built-in keywords grouped
by category, with search and per-group toggles, plus your own custom keywords.⌉[

Keywords page: built-in keywords grouped by category, with search and per-group 
toggles, plus your own custom keywords.

[⌊Filter Log page with search, filters, date sorting, expandable excerpts, bulk 
delete, and CSV export.⌉⌊Filter Log page with search, filters, date sorting, expandable
excerpts, bulk delete, and CSV export.⌉[

Filter Log page with search, filters, date sorting, expandable excerpts, bulk delete,
and CSV export.

[⌊Review queue: flagged submissions held before anything is stored or emailed — 
accept, block, or turn a phrase into a keyword.⌉⌊Review queue: flagged submissions
held before anything is stored or emailed — accept, block, or turn a phrase into
a keyword.⌉[

Review queue: flagged submissions held before anything is stored or emailed — accept,
block, or turn a phrase into a keyword.

## Installation

 1. Upload the `mdl-spam-filter` folder to `/wp-content/plugins/`, or install through
    the Plugins screen.
 2. Activate the plugin through the Plugins screen.
 3. Go to the MDL Spam Filter menu in the admin sidebar, then open Settings to configure
    detection.
 4. If using AI detection, choose a provider (Anthropic, OpenAI, or a custom OpenAI-
    compatible endpoint) and enter your API key.
 5. Optionally, under Form targeting, limit scanning to specific forms by id, class,
    or name.

## FAQ

### Does this work with my contact form plugin?

It scans any POST submission that contains an email address — or that carries a 
recognised form plugin’s identifier (Contact Form 7, WPForms, Gravity Forms, Ninja
Forms, and similar) even without an email field — so it works with most form plugins
and plain HTML forms without extra setup. AJAX and REST forms such as Contact Form
7 get a proper response, so the submit spinner does not hang.

### What does the visitor see when a submission is blocked?

Your choice, under Settings  Protection. “Silently discard” shows the form’s normal
success message while the submission is dropped, so bots get no clue. “Show a blocked
message” displays a clear notice that the message was flagged as spam.

### Is an API key required?

No. Keyword detection works with no external service. An API key is only needed 
if you enable AI detection.

### The Keywords page says keywords are not in use. Why?

Detection mode is set to “AI only” and the AI-unavailable keyword fallback is turned
off, so keywords play no part. Switch to “Keywords only” or “Keywords, then AI”,
or turn the fallback back on in Settings  AI engine, to manage and use keywords.
With the fallback on, keywords are still editable and are used only when the AI 
provider is unreachable.

### What happens if my AI provider is down?

By default, when detection mode is “AI only” and the provider cannot be reached (
outage, timeout, rate limit, or a bad key), the plugin falls back to a keyword scan
so spam is not silently let through. You can turn this off in Settings  AI engine.
In “Keywords, then AI” mode the keyword scan always runs first, so an outage never
opens the gate. A blocked submission caught this way is logged with the reason “
Matched keyword (AI unavailable)”.

You can also be told about provider problems as they happen: turn on the AI Engine
provider-error notification in Settings  Notifications and the plugin emails you
when it hits a provider error — an invalid or expired API key, exhausted credit 
or quota, or an outage. Alerts are throttled to one email per distinct error every
10 minutes.

### Can I customise what the AI treats as spam?

Yes. Under Settings  AI engine, “Detection rules” offers three modes: the built-
in default rules, your own custom rules, or both combined. Custom rules are plain-
language lines such as “Treat requests for electrical or roofing work as spam — 
we only do plumbing.” If you’d rather not write them yourself, the “Generate rules
with AI” assistant drafts rules from a short description of your business (ready-
made templates included) — review the draft, adjust it, and save.

### Can I rate-limit submissions?

Yes. Under Settings  Protection set “Submission rate limit” to the maximum number
of submissions allowed per minute from one visitor. Submissions beyond that are 
blocked without an AI call, which throttles bursts and caps API cost. It defaults
to 20 per minute; set it to 0 to disable.

### What are the honeypot and minimum submit time?

Two zero-cost bot traps under Settings  Advanced protection. The honeypot adds an
invisible form field that humans never see; any submission that fills it is blocked.
The minimum submit time blocks forms submitted faster than a human could plausibly
fill them (bots typically submit instantly). Both checks fail open: a visitor without
JavaScript or on a cached page is never blocked by them.

### Can I block submissions written in a foreign language?

Yes. Turn on the language guard under Settings  Advanced protection and pick a mode.**
Block selected languages & alphabets** blocks submissions written mostly in any 
language or alphabet you tick (the default selection is everything except Latin).**
Allow only selected languages & alphabets** inverts it: anything written mostly 
in a language or alphabet you did not tick is blocked, including ones not listed.
Either way the guard also blocks words that mix Latin with look-alike Cyrillic letters—
a common trick to sneak terms like “vіаgra” past keyword filters. Accented Latin
languages such as French, German, or Spanish always count as Latin, and a foreign
name or city in an otherwise fine message does not trip it. The check is deterministic
and costs nothing — it runs before any keyword or AI work and fails open on content
it cannot judge.

The guard detects the alphabet, not the exact language — it cannot tell apart languages
that share an alphabet, such as Russian vs Ukrainian or English vs Indonesian. For
per-language policy, use AI detection instead: add a custom rule under Settings  
AI engine  Detection rules such as “We only serve English-speaking customers — treat
submissions written entirely in another language as spam.” The AI reads every language,
so it classifies foreign-language spam on meaning either way.

### Can I always allow or always block specific senders?

Yes. Under Settings  Advanced protection, add email addresses, domains, or IP addresses
to the allow list (matching submissions skip every check, including AI) or the deny
list (matching submissions are blocked immediately, without an AI call).

You can also manage senders in one click: every Filter Log and Review row with a
valid email shows a “Block sender” action that adds that address to the deny list,
and Review rows additionally show an “Allow sender” action that adds it to the allow
list (rows whose sender is already listed show “On deny list” or “On allow list”
instead). Each change is recorded in the Activity Log, and both lists stay editable
under Settings  Advanced protection.

### What is the Review queue?

A hold-for-review step for submissions flagged by keywords or AI, on by default —
turn it off with “Hold flagged mail for review” under Settings  Email & logging.
When on, a flagged submission is captured and the request is stopped before any 
form handler runs — so nothing is stored in your form plugin and no email is sent
until you decide. The visitor still sees the form’s normal success message. You 
can also have the plugin email you when a submission is held: turn on the review
notification under Settings  Notifications. It goes to the central notification 
email address, or a review-specific override address if you set one; either falls
back to the site admin email. For each held submission you can:

 * **View** — see all submitted fields, the sender, source, and reason. The detail
   view also includes a quick “add keyword” box: paste a telltale phrase from the
   spam and it is added to your custom keyword list immediately, so future submissions
   containing it are caught without an AI call.
 * **Accept** — email the submitted fields to the site administrator (goes out through
   wp_mail like any other mail). Not added to the filter log.
 * **Block** — discard the submission (never delivered) and record it in the filter
   log.
 * **Allow sender / Block sender** — add the sender to the allow or deny list in
   one click, so their future submissions are always let through or always blocked.

This applies only to keyword/AI verdicts. Deterministic bot blocks (rate limit, 
deny list, honeypot, minimum submit time, language guard) are always blocked immediately
and never enter the queue.

Because the submission is held before the form plugin processes it, the accepted
email is a notification the plugin composes from the submitted fields — it is not
the form plugin’s own templated email, and no form-plugin entry is created. Note:
forms that submit over admin-ajax (for example WPForms) are processed too early 
for this pre-handler capture; their flagged mail is blocked and logged rather than
queued.

### What does the Activity Log page show?

A plugin-level audit trail, separate from the Filter Log: settings and keyword changes(
with which settings changed — never their values), imports and exports (settings
and keywords), log purges and deletions, automatic retention pruning, review-queue
decisions, senders blocked or allowed from the Filter Log or Review pages, keywords
added from the review queue, weekly digests sent, AI connection tests, notification
test emails, plugin activation, and AI provider errors (throttled, so an outage 
produces one entry per window). Entries record the acting user and are pruned automatically
after 90 days. Setting values and API keys are never stored in the activity log.

### Can I export the log or my settings?

Yes. The Filter Log page has a CSV export that honours your current search and filters.
The Import/Export page has a JSON settings export/import for moving configuration
between sites — API keys are never included in the export — plus a separate keywords-
only export/import for sharing keyword lists without touching other settings.

### Can I limit which forms are scanned?

Yes. Under Settings  Form targeting choose “Selected forms” and add each form by
its id, class, or name (for example #contact-form or .wpcf7-form). A lightweight
front-end script tags each form with its id, class, and name so only the forms you
list are scanned.

### Does the site admin still get a notification email for spam?

No. When a submission is flagged as spam, every email it would send is suppressed,
including the admin “new submission” notification and any autoresponder to the visitor.
This applies to forms that send through both standard page submits and AJAX. The
outgoing-email safety net (Settings  Email & logging) must be enabled, which it 
is by default.

### Where are blocked submissions stored?

Only in this plugin’s own database table, and only if you enable logging. They are
never written to your form plugin’s entries or email log.

Entries do not pile up forever: filter-log and review-queue rows older than the 
retention period (Settings  Email & logging, default 90 days) are removed automatically
once a day. Set the retention to 0 to keep entries indefinitely.

### Why does System health say the daily cleanup is overdue?

WordPress cron is not a real cron — it only fires when someone visits the site. 
On a quiet, staging, or local site, scheduled events sit in the queue past their
due time, and the dashboard’s System health card flags them as overdue rather than
pretending all is well. Visit the front end once (the overdue job runs and reschedules
itself), or for a reliable setup add `define( 'DISABLE_WP_CRON', true );` to wp-
config.php and point a real system cron at wp-cron.php every few minutes. If the
card instead reports the cron entry as stale (a daily event scheduled more than 
a day out), deactivating and reactivating the plugin rebuilds the schedule.

### Is submission data sent anywhere?

Only when AI detection is enabled, or when an admin uses the “Generate rules with
AI” assistant. With AI detection on, the submission text is sent to the AI provider
you select (Anthropic, OpenAI, or a custom OpenAI-compatible endpoint you configure)
for classification. The rule assistant additionally sends the business description
an admin types into it, so the provider can draft custom detection rules. See External
Services below. Fields whose name indicates a secret or payment detail (passwords,
API tokens, card numbers, CVV, account/routing numbers, and similar) are excluded
from both the text sent to the provider and the stored log excerpt.

### Where do the plugin’s notification emails go?

Set one central address under Settings  Notifications and every alert the plugin
sends — review-queue holds, AI provider errors, and the weekly digest — goes there.
Leave it blank to use the site admin email. Each notification also has its own on/
off toggle and an optional override field, so you can send, say, the digest to a
different mailbox. Every field accepts several addresses through a tag-style picker—
press Enter or type a comma after each — and anything that is not a valid email 
address is flagged when you save instead of being dropped silently. A “Send test
email” button on the same section delivers a test message to whoever would receive
the selected notification, so you can confirm delivery before a real alert depends
on it.

### Can I get a summary email instead of checking the dashboard?

Yes. Turn on the weekly digest under Settings  Notifications. Once a week the plugin
emails a summary — how many submissions were blocked in the last 7 days, the detection-
method breakdown, the top blocked senders, and how many items are waiting in the
review queue — to the address you set there (the central notification email address,
or a digest-specific override; defaults to the site admin email). Weeks with nothing
to report send no email.

### Can I use regular expressions in keywords?

Yes. Wrap a custom keyword in forward slashes to have it matched as a regular expression,
for example /\bcheap +rolex\b/. Patterns are always case-insensitive, and an invalid
pattern is skipped safely rather than blocking anything. Each keyword — plain or
regex — also shows a hit counter on the Keywords page telling you how many submissions
it has blocked, so ineffective keywords are easy to spot and prune.

### How are my API keys stored?

Your provider API keys are never included in a settings export. For maximum safety
you can keep them out of the database entirely by defining them in wp-config.php:

    ```
    define( 'MDLSF_ANTHROPIC_API_KEY', '...' ); (or `MDLSF_OPENAI_API_KEY` / `MDLSF_CUSTOM_API_KEY`).
    ```

When a constant is defined it overrides and hides the stored option, and the matching
field shows a read-only note instead of an input.

### Can developers customise it?

Yes. These hooks are available:

 * `mdlsf_predefined_keywords` (filter) — modify the built-in keyword list.
 * `mdlsf_excluded_requests` (filter) — mark additional requests (by your own logic)
   as non-contact-form so they are never scanned.
 * `mdlsf_log_max_rows` / `mdlsf_quarantine_max` (filters) — adjust the filter-log
   row cap and review-queue size cap.
 * `mdlsf_allow_insecure_custom_endpoint` (filter) — permit an http:// custom AI
   endpoint (e.g. a trusted local model).
 * `mdlsf_sensitive_field_keys` (filter) — modify the list of field-name substrings
   excluded from scanning, AI, and logging (passwords, tokens, card numbers, etc.).
 * `mdlsf_language_guard_threshold` (filter) — adjust the ratio of offending-script
   letters (0–1, default 0.3) above which the language guard blocks.
 * `mdlsf_submission_blocked` (action) — fires when a submission is blocked, passing
   the submitter email and the detector verdict.
 * `mdlsf_submission_quarantined` (action) — fires when a flagged submission is 
   held in the review queue, passing the submitter email and the detector verdict.

## Reviews

There are no reviews for this plugin.

## Contributors & Developers

“MDL Spam Filter” is open source software. The following people have contributed
to this plugin.

Contributors

 *   [ Monday Digital Lab ](https://profiles.wordpress.org/mondaydigitallab/)

[Translate “MDL Spam Filter” into your language.](https://translate.wordpress.org/projects/wp-plugins/mdl-spam-filter)

### Interested in development?

[Browse the code](https://plugins.trac.wordpress.org/browser/mdl-spam-filter/), 
check out the [SVN repository](https://plugins.svn.wordpress.org/mdl-spam-filter/),
or subscribe to the [development log](https://plugins.trac.wordpress.org/log/mdl-spam-filter/)
by [RSS](https://plugins.trac.wordpress.org/log/mdl-spam-filter/?limit=100&mode=stop_on_copy&format=rss).

## Changelog

#### 1.0.0

 * Initial release.

## Meta

 *  Version **1.0.0**
 *  Last updated **23 hours ago**
 *  Active installations **Fewer than 10**
 *  WordPress version ** 6.2 or higher **
 *  Tested up to **7.0.2**
 *  PHP version ** 7.4 or higher **
 * Tags
 * [AI](https://wordpress.org/plugins/tags/ai/)[anti-spam](https://wordpress.org/plugins/tags/anti-spam/)
   [contact form](https://wordpress.org/plugins/tags/contact-form/)[spam](https://wordpress.org/plugins/tags/spam/)
   [spam filter](https://wordpress.org/plugins/tags/spam-filter/)
 *  [Advanced View](https://wordpress.org/plugins/mdl-spam-filter/advanced/)

## Ratings

No reviews have been submitted yet.

[Your review](https://wordpress.org/support/plugin/mdl-spam-filter/reviews/#new-post)

[See all reviews](https://wordpress.org/support/plugin/mdl-spam-filter/reviews/)

## Contributors

 *   [ Monday Digital Lab ](https://profiles.wordpress.org/mondaydigitallab/)

## Support

Got something to say? Need help?

 [View support forum](https://wordpress.org/support/plugin/mdl-spam-filter/)