Title: Spamify – Elastic Spam Shield Author: Spamify Published: September 1, 2026 Last modified: September 1, 2026 --- Search plugins ![](https://ps.w.org/spamify/assets/banner-772x250.png?rev=3675662) ![](https://ps.w.org/spamify/assets/icon.svg?rev=3675590) # Spamify – Elastic Spam Shield By [Spamify](https://profiles.wordpress.org/arslanwp/) [Download](https://downloads.wordpress.org/plugin/spamify.1.0.0.zip) * [Details](https://wordpress.org/plugins/spamify/#description) * [Reviews](https://wordpress.org/plugins/spamify/#reviews) * [Installation](https://wordpress.org/plugins/spamify/#installation) * [Development](https://wordpress.org/plugins/spamify/#developers) [Support](https://wordpress.org/support/plugin/spamify/) ## Description Spamify is a lightweight, self-contained email spam and validation plugin for WordPress forms. It scores every submitted email address and blocks or flags the ones that look fake, invalid, or abusive — without sending your visitors’ data to any tracking service. Out of the box the plugin runs entirely on your own server. It never sends your data to the plugin author or to any analytics or tracking service, and it does not require an account or a licence key. One optional feature — live mailbox verification— reaches out to the recipient’s own mail server, and it is turned **off by default**( see _External Services_ below). **Detection layers:** * **Syntax** – Validates the email format and catches gibberish, keyboard-mash, and obviously fake addresses. Runs locally, always on. * **SMTP mailbox verification** _(optional, off by default)_ – Connects to the recipient domain’s mail server and asks whether the mailbox exists. No message is ever sent. **Bot protection & security (all local, all free):** * **Honeypot & timing** – Hidden decoy fields plus a minimum form-fill time catch automated submissions. * **Rate limiting** – Throttle how many submissions a single IP can make within a rolling window. * **CAPTCHA** _(optional)_ – Invisible Cloudflare Turnstile or Google reCAPTCHA v3, using your own free provider keys. * **Allowlist** – Always let trusted domains, exact email addresses, or IP / CIDR ranges through. * **Hide login** _(optional)_ – Move wp-login.php to an address of your choice and serve a 404 (or a redirect) at the old one **and at /wp-admin/** (WordPress normally bounces logged-out visitors from /wp-admin/ to the login screen, which would give the secret address away), so brute-force bots have nothing to hammer. Every login, logout, lost-password and registration link — including the ones inside WordPress emails — is rewritten for you. Multisite compatible: each site in a network keeps its own address, subdirectory installs get the slug under their own folder, and a single `SPAMIFY_HIDE_LOGIN_SLUG` constant in wp-config. php can enforce one address network-wide. **Privacy & administration:** * **GDPR tools** – Automatic daily log purge by retention window, plus optional IP anonymisation. * **Site Health** – Built-in WordPress Site Health checks for logging, DNS, and mailbox verification. * **Setup wizard** – A guided first-run wizard to get protected in about a minute. * **Dashboard & logs** – See what was blocked, flagged, and allowed, with per-day charts. **Supported forms:** * WordPress core (registration, comments, profile update, lost password, multisite signup) * Contact Form 7 * WPForms * Jetpack Forms * Elementor Forms ### Upgrade to Pro Spamify is free forever on WordPress.org — everything described above runs standalone, with no account, licence key, or nag screens required. **[Spamify Pro](https://spamify-pro.github.io/)** adds the rest of the detection engine and site-wide protection tools for busier or higher-traffic sites: * **Disposable domain blocking** – 100,000+ throwaway and temporary-inbox providers, refreshed automatically. * **IP threat intel & DNSBL** – matches the sender’s IP against aggregated abuse feeds and DNS blocklists. * **VPN / proxy / Tor detection** – flags anonymised traffic from VPNs, open proxies, Tor exit nodes and datacenter ranges. * **Content analysis** – link stuffing, spam keywords, homoglyph and Unicode obfuscation. * **Behavioural reputation** – per-sender history layered on top of honeypot and timing. * **Custom rules** – your own if-this-then-that logic on any field or signal. * **Network firewall** – VPN/Tor/ASN blocking with escalating temporary bans. * **Geo report & country blocking** – a world map of where blocked spam comes from, powered by a free offline database. * **Uptime monitor & deliverability tools** – scheduled URL checks, bulk email- list verification, and an SPF/DKIM/DMARC checker. * **More integrations** – WooCommerce, Gravity Forms, Ninja Forms, Fluent Forms, newsletter opt-ins, and a universal connector for any form. Plans start at $49/year for up to 3 sites, with Agency and Lifetime options for larger portfolios. **[Buy Spamify Pro ](https://spamify-pro.github.io/#pricing)** ### External Services Spamify is self-contained by default. Two **optional** features connect to an external service only after you explicitly enable and configure them. Neither sends any data to the plugin author, and neither is active on a fresh install. **1. SMTP mailbox verification (optional, disabled by default)** When you turn on _SMTP Verification_ (Settings Advanced Filters), the plugin opens a direct connection to the mail server (MX host) of the **recipient email address’s own domain** and performs an SMTP handshake to check whether the mailbox exists. What is sent: the email address being validated, sent only to that address’s own mail provider, and only at the moment a form containing that address is submitted or checked. No email message is ever sent, and no data is sent to the plugin author or to any third-party service. Because each address is verified against its own provider’s server, there is no single service, account, terms of service, or privacy policy involved. Leave this feature off if you prefer that submitted addresses are never contacted. _Outbound-port connectivity probe._ Many hosts block outbound port 25, which makes mailbox verification impossible. To detect this, the plugin makes a one-off TCP connection to a well-known public mail server — by default Google’s inbound MX, ` gmail-smtp-in.l.google.com` on port 25 — and closes it immediately **without sending any data**. Only a yes/no “is port 25 open” result is kept (cached for up to a week). This probe runs when SMTP verification is enabled, and when you open the Advanced settings tab or the Tools Site Health screen (so the status can be shown). No personal data is transmitted. You can change or disable the probe host with the `spamify_port25_probe_host` filter. **2. CAPTCHA verification (optional, disabled by default)** If you enable CAPTCHA (Settings Bot Protection) and enter your own provider keys, the visitor’s CAPTCHA token is sent to your chosen provider’s verification endpoint so the provider can confirm the visitor is human: * **Cloudflare Turnstile** – token sent to `https://challenges.cloudflare.com/turnstile/ v0/siteverify`. Terms: https://www.cloudflare.com/website-terms/ — Privacy: https:// www.cloudflare.com/privacypolicy/ * **Google reCAPTCHA v3** – token sent to `https://www.google.com/recaptcha/api/ siteverify`. Terms: https://policies.google.com/terms — Privacy: https://policies. google.com/privacy Only the CAPTCHA token and the visitor IP are sent, only on form submission, and only if you have configured a provider. This feature is off until you supply keys. ## Installation 1. Upload the `spamify` folder to the `/wp-content/plugins/` directory, or install it through the Plugins screen in WordPress. 2. Activate the plugin through the **Plugins** menu in WordPress. 3. Open **Spamify** in the admin menu and follow the setup wizard to configure protection. ## FAQ ### Does this plugin send any data to your servers? No. Spamify never contacts the plugin author’s servers, and it sends no data to any analytics or tracking service. It runs on your own site. The only outbound connections are those described in _External Services_ — SMTP mailbox verification and its port- 25 connectivity probe (verification is off by default), and CAPTCHA verification( off until you add your own keys). ### Is SMTP verification required? No. It is off by default. The plugin still validates syntax and protects your forms with the honeypot, timing, rate-limiting, allowlist, and CAPTCHA features without it. ### Which PHP version is required? PHP 7.4 or higher. ### Why are some submissions marked “unverifiable”? Many hosts block outbound port 25, and many mail servers greylist or use catch-all addresses, so a mailbox cannot always be confirmed. By default these are flagged for review rather than blocked; you can change this in Settings. ### Is there a Pro version? Yes. [Spamify Pro](https://spamify-pro.github.io/) adds the rest of the detection engine (disposable-domain blocking, IP threat intel, VPN/Tor detection, content analysis, custom rules), a network firewall, a geo report, deliverability tools, and integrations for WooCommerce, Gravity Forms, Ninja Forms and Fluent Forms. The free version on WordPress.org is fully functional on its own and is not a limited trial. See [spamify-pro.github.io](https://spamify-pro.github.io/) or **[Buy Spamify Pro](https://spamify-pro.github.io/#pricing)**. ### I hid my login page and locked myself out. What now? Add `define( 'SPAMIFY_HIDE_LOGIN_DISABLE', true );` to your wp-config.php. wp-login. php works normally again, and you can change or switch off the setting from Protection Hide login. ### Does hiding the login work on multisite? Yes. Every site in the network sets its own address on its own Protection screen, and on a subdirectory network the address lives under that site’s folder (example. com/team/secret-login/). To use one address everywhere, add `define( 'SPAMIFY_HIDE_LOGIN_SLUG',' secret-login' );` to wp-config.php. wp-signup.php and wp-activate.php stay reachable so registration and activation keep working. The feature needs pretty permalinks. ## Reviews There are no reviews for this plugin. ## Contributors & Developers “Spamify – Elastic Spam Shield” is open source software. The following people have contributed to this plugin. Contributors * [ Spamify ](https://profiles.wordpress.org/arslanwp/) * [ Muhammad Arslan ](https://profiles.wordpress.org/wparslan/) [Translate “Spamify – Elastic Spam Shield” into your language.](https://translate.wordpress.org/projects/wp-plugins/spamify) ### Interested in development? [Browse the code](https://plugins.trac.wordpress.org/browser/spamify/), check out the [SVN repository](https://plugins.svn.wordpress.org/spamify/), or subscribe to the [development log](https://plugins.trac.wordpress.org/log/spamify/) by [RSS](https://plugins.trac.wordpress.org/log/spamify/?limit=100&mode=stop_on_copy&format=rss). ## Changelog #### 1.0.0 * Initial release. * Feature: Hide login — serve wp-login.php from a custom address and answer the old one, plus /wp-admin/ for logged-out visitors, with the theme’s 404 page, a home-page redirect, or a URL of your choice. All generated login/logout/lost- password/registration links are rewritten automatically. * Multisite: per-site login addresses, subdirectory-network aware matching, network- level links resolve against the main site, and an optional `SPAMIFY_HIDE_LOGIN_SLUG` constant enforces one address across the whole network. * Major: syntax validation, optional SMTP mailbox verification (off by default), honeypot & timing, per-IP rate limiting, allowlist, invisible CAPTCHA (bring your own keys), GDPR log tools, Site Health checks, and a setup wizard. Integrations for WordPress core forms, Contact Form 7, WPForms, Jetpack Forms, and Elementor Forms. ## Meta * Version **1.0.0** * Last updated **4 days ago** * Active installations **Fewer than 10** * WordPress version ** 5.8 or higher ** * Tested up to **7.1** * PHP version ** 7.4 or higher ** * Tags * [anti-spam](https://wordpress.org/plugins/tags/anti-spam/)[contact form](https://wordpress.org/plugins/tags/contact-form/) [email validation](https://wordpress.org/plugins/tags/email-validation/)[protection](https://wordpress.org/plugins/tags/protection/) [spam](https://wordpress.org/plugins/tags/spam/) * [Advanced View](https://wordpress.org/plugins/spamify/advanced/) ## Ratings No reviews have been submitted yet. [Your review](https://wordpress.org/support/plugin/spamify/reviews/#new-post) [See all reviews](https://wordpress.org/support/plugin/spamify/reviews/) ## Contributors * [ Spamify ](https://profiles.wordpress.org/arslanwp/) * [ Muhammad Arslan ](https://profiles.wordpress.org/wparslan/) ## Support Got something to say? Need help? [View support forum](https://wordpress.org/support/plugin/spamify/)