{"id":319343,"date":"2026-06-01T04:22:16","date_gmt":"2026-06-01T04:22:16","guid":{"rendered":"https:\/\/wordpress.org\/plugins\/gb-anti-spam-for-contact-form-7\/"},"modified":"2026-07-02T05:25:14","modified_gmt":"2026-07-02T05:25:14","slug":"gb-anti-spam-for-contact-form-7","status":"publish","type":"plugin","link":"https:\/\/wordpress.org\/plugins\/gb-anti-spam-for-contact-form-7\/","author":9916946,"comment_status":"closed","ping_status":"closed","template":"","meta":{"version":"2.1.0","stable_tag":"2.1.0","tested":"7.0.2","requires":"5.8","requires_php":"7.0","requires_plugins":null,"header_name":"GB Anti-Spam for Contact Form 7","header_author":"Greg Bialowas","header_description":"Lightweight anti-spam layer for Contact Form 7.","assets_banners_color":"c7ddf3","last_updated":"2026-07-02 05:25:14","external_support_url":"","external_repository_url":"","donate_link":"https:\/\/gregbialowas.com\/donate","header_plugin_uri":"https:\/\/gregbialowas.com\/anti-spam-cf7","header_author_uri":"https:\/\/gregbialowas.com","rating":0,"author_block_rating":0,"active_installs":0,"downloads":370,"num_ratings":0,"support_threads":1,"support_threads_resolved":0,"author_block_count":0,"sections":["description","installation","faq","changelog"],"tags":{"1.0.0":{"tag":"1.0.0","author":"gregbialowas","date":"2026-06-01 04:21:59"},"1.1.0":{"tag":"1.1.0","author":"gregbialowas","date":"2026-06-10 04:57:23"},"1.2.0":{"tag":"1.2.0","author":"gregbialowas","date":"2026-06-25 13:48:46"},"2.0.0":{"tag":"2.0.0","author":"gregbialowas","date":"2026-07-01 10:17:11"},"2.1.0":{"tag":"2.1.0","author":"gregbialowas","date":"2026-07-02 05:25:14"}},"upgrade_notice":{"1.0.0":"<p>Initial release of GB Anti-Spam for Contact Form 7.<\/p>"},"ratings":[],"assets_icons":{"icon-128x128.jpg":{"filename":"icon-128x128.jpg","revision":3556134,"resolution":"128x128","location":"assets","locale":"","width":256,"height":256},"icon-256x256.jpg":{"filename":"icon-256x256.jpg","revision":3556134,"resolution":"256x256","location":"assets","locale":"","width":256,"height":256}},"assets_banners":{"banner-772x250.jpg":{"filename":"banner-772x250.jpg","revision":3556134,"resolution":"772x250","location":"assets","locale":"","width":772,"height":250}},"assets_blueprints":{},"all_blocks":[],"tagged_versions":["1.0.0","1.1.0","1.2.0","2.0.0","2.1.0"],"block_files":[],"assets_screenshots":[],"screenshots":{"1":"Example of protected Contact Form 7 form with hidden honeypot field","2":"Admin settings overview (if applicable)"}},"plugin_section":[],"plugin_tags":[2656,1152,598,2419],"plugin_category":[54],"plugin_contributors":[170329],"plugin_business_model":[],"class_list":["post-319343","plugin","type-plugin","status-publish","hentry","plugin_tags-anti-spam","plugin_tags-contact-form-7","plugin_tags-honeypot","plugin_tags-spam-protection","plugin_category-security-and-spam-protection","plugin_contributors-gregbialowas","plugin_committers-gregbialowas"],"banners":{"banner":"https:\/\/ps.w.org\/gb-anti-spam-for-contact-form-7\/assets\/banner-772x250.jpg?rev=3556134","banner_2x":false,"banner_rtl":false,"banner_2x_rtl":false},"icons":{"svg":false,"icon":"https:\/\/ps.w.org\/gb-anti-spam-for-contact-form-7\/assets\/icon-128x128.jpg?rev=3556134","icon_2x":"https:\/\/ps.w.org\/gb-anti-spam-for-contact-form-7\/assets\/icon-256x256.jpg?rev=3556134","generated":false},"screenshots":[],"raw_content":"<!--section=description-->\n<p>GB Anti-Spam for Contact Form 7 adds a lightweight security layer to Contact Form 7 forms without CAPTCHA.<\/p>\n\n<p>Features:\n* Honeypot field protection\n* Timing-based bot detection\n* Request integrity token\n* IP rate limiting\n* Automatic injection (no manual form editing required)<\/p>\n\n<p>Designed to be lightweight and compatible with caching and performance plugins<\/p>\n\n<!--section=installation-->\n<ol>\n<li>Upload plugin to WordPress<\/li>\n<li>Activate plugin<\/li>\n<li>Works automatically with all Contact Form 7 forms<\/li>\n<\/ol>\n\n<!--section=faq-->\n<dl>\n<dt id=\"does%20it%20require%20editing%20forms%3F\"><h3>Does it require editing forms?<\/h3><\/dt>\n<dd><p>No. Everything is injected automatically.<\/p><\/dd>\n<dt id=\"does%20it%20slow%20down%20the%20site%3F\"><h3>Does it slow down the site?<\/h3><\/dt>\n<dd><p>No noticeable impact.<\/p><\/dd>\n\n<\/dl>\n\n<!--section=changelog-->\n<h4>2.1.0<\/h4>\n\n<ul>\n<li>Refactored core validation into structured pipeline architecture (validate() now acts as orchestration layer)<\/li>\n<li>Introduced modular detection stages: context collection, honeypot, timing, nonce, fingerprint, rate limiting, field analysis, payload analysis, scoring, and final decision<\/li>\n<li>Replaced flat string-based signals with structured signal objects (type + optional field metadata)<\/li>\n<li>Added unified scoring engine with centralized weight map for all detection signals<\/li>\n<li>Introduced hard-block vs score-based decision separation (critical threats bypass scoring)<\/li>\n<li>Split validation logic into dedicated methods for each detection layer for improved maintainability<\/li>\n<li>Improved field-level analysis with structured output (URL, emoji, markup, Cyrillic, length detection per field)<\/li>\n<li>Introduced dedicated payload analysis layer for cross-field pattern detection (SQL injection, XSS, command injection, spam keywords)<\/li>\n<li>Centralized spam keyword detection into reusable helper method<\/li>\n<li>Improved rate limiting mechanism with explicit signal output (rate_limited)<\/li>\n<li>Added structured debug logging including score value alongside signals, IP, user agent, and sanitized submission data<\/li>\n<li>Enhanced logging safety with improved data sanitization and truncation limits<\/li>\n<li>Improved observability of validation flow through explicit stage separation and consistent signal output format<\/li>\n<li>Reduced coupling between detection logic and validation decision logic<\/li>\n<li>Maintained backward compatibility with existing Contact Form 7 validation filter<\/li>\n<\/ul>\n\n<h4>2.0.0<\/h4>\n\n<ul>\n<li>Complete redesign of anti-spam engine architecture<\/li>\n<li>Replaced legacy scoring system with structured signals-based detection model<\/li>\n<li>Introduced unified signals[] system as primary validation output<\/li>\n<li>Split validation logic into layered detection system (hard-block, behavioral signals, content analysis)<\/li>\n<li>Added per-field validation engine via analyze_field() method<\/li>\n<li>Introduced helper-based security detection functions (SQL injection, XSS, command injection)<\/li>\n<li>Added structured JSON logging system for all CF7 submission attempts<\/li>\n<li>Improved rate limiting mechanism based on IP tracking<\/li>\n<li>Added detection for URLs, emojis, HTML\/BBCode markup, and Cyrillic content<\/li>\n<li>Separated detection logic from final blocking decision<\/li>\n<li>Improved observability with detailed request-level debug output<\/li>\n<li>Prepared internal architecture for future rule weighting and per-field validation engine expansion<\/li>\n<li>Improved overall maintainability and extensibility of the plugin core<\/li>\n<\/ul>\n\n<h4>1.2.0<\/h4>\n\n<ul>\n<li>Major refactor of anti-spam engine<\/li>\n<li>Added hard firewall layer using wpcf7_before_send_mail<\/li>\n<li>Introduced unified payload inspection (email, URL, injection patterns)<\/li>\n<li>Removed client-side hash-based token system in favor of WP nonce<\/li>\n<li>Improved scoring logic and reduced redundant validation checks<\/li>\n<li>Fixed CF7 bypass allowing spam submissions to reach mail layer<\/li>\n<li>Improved debug logging system with configurable file path<\/li>\n<\/ul>\n\n<h4>1.1.0<\/h4>\n\n<ul>\n<li>Replaced JS-based token mechanism with secure WordPress nonce validation (wp_create_nonce \/ wp_verify_nonce)<\/li>\n<li>Removed insecure client-side hash-based token generation<\/li>\n<li>Added human interaction signal detection (mouse, keyboard, touch events)<\/li>\n<li>Improved fingerprinting method for better bot anomaly detection<\/li>\n<li>Added universal payload inspection for SQL injection, XSS, and command injection patterns across all form fields<\/li>\n<li>Improved rate limiting logic with stricter thresholds per IP<\/li>\n<li>Enhanced honeypot detection reliability across all CF7 forms<\/li>\n<\/ul>\n\n<h4>1.0.5<\/h4>\n\n<ul>\n<li>Improved validation scoring system for spam detection<\/li>\n<li>Added additional heuristic checks for automated bot submissions<\/li>\n<li>Optimized transient-based rate limiting mechanism<\/li>\n<\/ul>\n\n<h4>1.0.0<\/h4>\n\n<ul>\n<li>Initial release<\/li>\n<li>Basic honeypot protection<\/li>\n<li>Timing-based submission validation<\/li>\n<li>Lightweight fingerprint detection<\/li>\n<\/ul>","raw_excerpt":"Lightweight anti-spam protection for Contact Form 7 without CAPTCHA. More details: https:\/\/gregbialowas.com\/anti-spam-cf7","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin\/319343","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin"}],"about":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/types\/plugin"}],"replies":[{"embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/comments?post=319343"}],"author":[{"embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wporg\/v1\/users\/gregbialowas"}],"wp:attachment":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/media?parent=319343"}],"wp:term":[{"taxonomy":"plugin_section","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_section?post=319343"},{"taxonomy":"plugin_tags","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_tags?post=319343"},{"taxonomy":"plugin_category","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_category?post=319343"},{"taxonomy":"plugin_contributors","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_contributors?post=319343"},{"taxonomy":"plugin_business_model","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_business_model?post=319343"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}