Title: QWeb Spam Shield Author: qwebmaster Published: July 23, 2026 Last modified: July 23, 2026 --- Search plugins ![](https://ps.w.org/qweb-spam-shield/assets/banner-772x250.png?rev=3619777) ![](https://ps.w.org/qweb-spam-shield/assets/icon-256x256.png?rev=3619777) # QWeb Spam Shield By [qwebmaster](https://profiles.wordpress.org/qwebmaster/) [Download](https://downloads.wordpress.org/plugin/qweb-spam-shield.1.0.2.zip) * [Details](https://wordpress.org/plugins/qweb-spam-shield/#description) * [Reviews](https://wordpress.org/plugins/qweb-spam-shield/#reviews) * [Installation](https://wordpress.org/plugins/qweb-spam-shield/#installation) * [Development](https://wordpress.org/plugins/qweb-spam-shield/#developers) [Support](https://wordpress.org/support/plugin/qweb-spam-shield/) ## Description QWeb Spam Shield blocks spam across your entire site, not just your contact form, and it does it without a single CAPTCHA. No puzzles for your real visitors, no account, no API key, and no external service. Everything runs on your own server and nothing ever leaves your site. Most anti-spam plugins only watch comments or a single form. QWeb Spam Shield guards every place spam and abuse actually get in: * Every form: Gravity Forms, Contact Form 7, WPForms, Fluent Forms, Elementor Pro Forms, Ninja Forms and Formidable, plus a universal wp_mail catch-all that automatically covers any other form plugin * WordPress comments and WooCommerce product reviews * User registration, so fake and bot sign-ups are stopped before an account is ever created * WooCommerce checkout, with card-testing (carding) defenses that stop attackers from validating stolen cards on your store with waves of fake orders, and running up your payment processing fees * Your outbound email: the built-in Mail Guard rate-limits the mail your own site sends, so a hacked form or a runaway plugin cannot blast thousands of messages and wreck your domain’s sending reputation No CAPTCHA, ever. Your visitors never see a checkbox, a puzzle, or a “click all the crosswalks” challenge. Detection runs invisibly in the background, so genuine customers sail through and only spam is stopped. How it decides (fast, all local): * Content signals: links in messages, gibberish, non-Latin scripts (French, German, and Spanish accents are allowed), marketing-pitch phrasing, and banned keywords matched on whole words * Identity signals: disposable-email domains (a bundled list of about 7,900), missing MX records with typo tolerance, and role accounts * Behavioral signals: honeypot, submission timing, and per-email or per-IP velocity for repeat offenders Built for site owners: * A grouped spam log. A 1,000-request attack is one counted row, not 1,000, so your day-to-day spam stays visible. It is auto-cleaned by age and a row cap. * Conservative by design. Genuine customer questions are not hard-blocked. Borderline submissions are held for review, never silently lost, and can be re-delivered. * Comments use WordPress moderation (spam folder or moderation queue), so nothing is destroyed. * GDPR friendly: IP anonymization, configurable retention, and support for Tools then Export or Erase Personal Data. Privacy: QWeb Spam Shield makes no external HTTP requests. It does not phone home, and it does not require a license, account, or third-party service. Need even stronger protection? Meet QWeb Spam Shield AI This free plugin is fully functional on its own and always will be. QWeb Spam Shield AI is the premium edition for sites that want the strongest protection possible. It layers a managed AI engine and a cross-site defense network on top of everything above: * Managed AI tiebreaker. A purpose-built AI reviews only the borderline submissions the rules engine is unsure about, so you catch more real spam without ever blocking a genuine customer. There is no API key to buy or configure. It is included with your license. * AI review of held submissions. Every held message is re-checked against your own business context, and real customer inquiries are released automatically. False positives drop close to zero, completely hands-off. * Cross-site pattern network. The instant spam is confirmed on any protected site, every other licensed site is protected from it too, so your site benefits from attacks aimed at everyone else. * Sharper detection that keeps improving, tuned continuously on live spam across the whole network. * Faster, fully automatic updates delivered straight to your dashboard. * Priority support from the team that builds it. Get QWeb Spam Shield AI at https://qwebspamshield.com ### Source code and build tools The plugin ships all of its source. The only compiled asset is the React admin app in admin/build/, generated from the human-readable source included in admin/src/ with the official WordPress build tooling: 1. Run `npm install` in the plugin root (uses package.json, @wordpress/scripts). 2. Run `npm run build`. This regenerates admin/build/index.js and style-index.css. Everything else (PHP, the frontend honeypot script in assets/js/, CSS) is plain, unminified source. The bundled disposable-email-domain list in data/ comes from the public domain disposable-email-domains project (github.com/disposable-email- domains). ## Screenshots [⌊Dashboard: spam blocked, held, and allowed at a glance, with recent activity and sources.⌉⌊Dashboard: spam blocked, held, and allowed at a glance, with recent activity and sources.⌉[ Dashboard: spam blocked, held, and allowed at a glance, with recent activity and sources. [⌊Activity log: every inbound and outbound decision, with the reason it was flagged.⌉⌊ Activity log: every inbound and outbound decision, with the reason it was flagged .⌉[ Activity log: every inbound and outbound decision, with the reason it was flagged. [⌊Detection settings: tune the fast, multi-layer rules engine and the score thresholds.⌉⌊ Detection settings: tune the fast, multi-layer rules engine and the score thresholds .⌉[ Detection settings: tune the fast, multi-layer rules engine and the score thresholds. [⌊Integrations: turn protection on per form plugin, comments, registration, and WooCommerce.⌉⌊Integrations: turn protection on per form plugin, comments, registration, and WooCommerce.⌉[ Integrations: turn protection on per form plugin, comments, registration, and WooCommerce. [⌊Mail Guard: rate-limit outbound email, auto-ban flooders, and hold overflow for review.⌉⌊Mail Guard: rate-limit outbound email, auto-ban flooders, and hold overflow for review.⌉[ Mail Guard: rate-limit outbound email, auto-ban flooders, and hold overflow for review. [⌊Spam patterns: signatures the plugin learned from spam blocked on your own site.⌉⌊ Spam patterns: signatures the plugin learned from spam blocked on your own site.⌉[ Spam patterns: signatures the plugin learned from spam blocked on your own site. [⌊Privacy: review digests, data retention, and GDPR export and erase options.⌉⌊Privacy: review digests, data retention, and GDPR export and erase options.⌉[ Privacy: review digests, data retention, and GDPR export and erase options. [⌊Setup wizard: confirm protection is live and which forms are covered.⌉⌊Setup wizard: confirm protection is live and which forms are covered.⌉[ Setup wizard: confirm protection is live and which forms are covered. ## Installation 1. Upload the plugin to /wp-content/plugins/, or install it from Plugins then Add New, and activate it. 2. That is it. Protection is on by default with safe settings. Review and tune it under Spam Shield. ## FAQ ### Does it need an account or API key? No. It runs entirely on your server with no account, no API key, and no external calls. ### Will it block real customers? It is tuned to avoid that. Genuine product, order, and shipping questions pass through. Only high-confidence spam is filed away, and borderline submissions are held for review rather than deleted. ### Does it cover my form plugin? Gravity Forms, Contact Form 7, WPForms, Fluent Forms, Elementor Pro Forms, Ninja Forms, and Formidable Forms have dedicated integrations. Any other form plugin is still covered by the universal wp_mail catch-all. ### Does it work with WooCommerce? Yes. It covers product reviews and both the classic and block (Store API) checkout, with card-testing defenses. High-Performance Order Storage (HPOS) is supported. ### Is my data sent anywhere? No. The plugin makes no external requests and stores everything locally, with optional IP anonymization and content retention limits. ## Reviews There are no reviews for this plugin. ## Contributors & Developers “QWeb Spam Shield” is open source software. The following people have contributed to this plugin. Contributors * [ qwebmaster ](https://profiles.wordpress.org/qwebmaster/) [Translate “QWeb Spam Shield” into your language.](https://translate.wordpress.org/projects/wp-plugins/qweb-spam-shield) ### Interested in development? [Browse the code](https://plugins.trac.wordpress.org/browser/qweb-spam-shield/), check out the [SVN repository](https://plugins.svn.wordpress.org/qweb-spam-shield/), or subscribe to the [development log](https://plugins.trac.wordpress.org/log/qweb-spam-shield/) by [RSS](https://plugins.trac.wordpress.org/log/qweb-spam-shield/?limit=100&mode=stop_on_copy&format=rss). ## Changelog #### 1.0.2 * Removed development files from the package (.github) and removed the Mail Guard development simulator from the plugin entirely. #### 1.0.1 * Hardened database queries and input handling following plugin review feedback. Regex patterns are length-capped and unsafe shapes are refused before evaluation. #### 1.0.0 * First public release. Multi-layer rules engine. Integrations for Gravity Forms, Contact Form 7, WPForms, Fluent Forms, Elementor, Ninja Forms, Formidable, comments, registration, and WooCommerce (classic and block checkout). Universal wp_mail catch-all. Mail Guard outbound throttle. Grouped spam log. Held-submission review and re-delivery. GDPR export and erase. No external calls. ## Meta * Version **1.0.2** * Last updated **1 day ago** * Active installations **Fewer than 10** * WordPress version ** 5.8 or higher ** * Tested up to **7.0.2** * PHP version ** 7.4 or higher ** * Tags * [antispam](https://wordpress.org/plugins/tags/antispam/)[contact form](https://wordpress.org/plugins/tags/contact-form/) [no captcha](https://wordpress.org/plugins/tags/no-captcha/)[spam](https://wordpress.org/plugins/tags/spam/) [woocommerce](https://wordpress.org/plugins/tags/woocommerce/) * [Advanced View](https://wordpress.org/plugins/qweb-spam-shield/advanced/) ## Ratings No reviews have been submitted yet. [Your review](https://wordpress.org/support/plugin/qweb-spam-shield/reviews/#new-post) [See all reviews](https://wordpress.org/support/plugin/qweb-spam-shield/reviews/) ## Contributors * [ qwebmaster ](https://profiles.wordpress.org/qwebmaster/) ## Support Got something to say? Need help? [View support forum](https://wordpress.org/support/plugin/qweb-spam-shield/)