Protect private conversations in Better Messages from spam and scam attempts with rate limits, contact filters, bot detection and safety warnings. Every module is optional and configurable.<\/p>\n\n
Spam protection has become more difficult.<\/p>\n\n
Modern bots do not always behave like obvious bots. Some can complete registration forms, work with automated browsers and behave enough like a normal visitor to get through basic anti bot measures. CAPTCHAs can help, but they are not a complete solution either.<\/p>\n\n
There is another problem with private communities: most protection stops at the login or registration stage.<\/strong><\/p>\n\n A bot may create an account in a relatively human way, wait until the account is accepted and then let automation take over. Once logged in, it can start sending private messages to other members without passing through the same protections that were used during registration.<\/p>\n\n This plugin was built specifically for that part of the problem.<\/p>\n\n It adds protection to the private messaging activity itself. Instead of relying on a single CAPTCHA or trying to identify every possible bot, it looks at behaviour and message patterns inside Better Messages.<\/p>\n\n That includes things such as:<\/p>\n\n The goal is not to find one perfect way to identify a bot. It is to make automated abuse harder at the point where it actually happens.<\/strong><\/p>\n\n The plugin comes with sensible defaults, but every community is different. Use Log only<\/strong> to see how the rules behave on your own site before deciding what you want to block.<\/p>\n\n This plugin was built to solve a real problem.<\/p>\n\n The site it was built for is a friendly community where members can chat privately with each other. Registration was already protected, comment forms were covered and public spam was under control. Yet new accounts kept appearing in private inboxes with the same opening lines, the same stories and the same requests to continue the conversation on another messenger platform.<\/p>\n\n Blocking one account only meant another would appear. Blocking a keyword was easy to work around and deleting one scam conversation did not stop the same message from being sent to other members. Bots also respected the message delay that can be configured in Better Messages and simply adjusted their behaviour to stay within that limit. Slowing messages down therefore did not stop them. It only made the automated activity look more like normal user behaviour.<\/p>\n\n Most anti spam plugins are designed for comments, forms and public content. They do not address what happens inside a real-time private chat.<\/p>\n\n That is why this plugin was built around the actual problems encountered on a live community.<\/p>\n\n The features were developed from real situations, tested against real examples and refined through use.<\/strong> The defaults are based on observed behaviour rather than theoretical scenarios. Detection rules have also been tested against both common scam patterns and normal messages that should not trigger a filter. The result is a plugin that works with sensible defaults but can also be adjusted to fit your own community.<\/p>\n\n Please treat this plugin as a free resource for the community.<\/p>\n\n Three principles guide the plugin:<\/p>\n\n The plugin protects logged-in members. Better Messages guest chats (visitors without an account) are outside its scope.<\/p>\n\n New accounts are often used to send messages at scale.<\/p>\n\n You can set:<\/p>\n\n Replies in existing conversations are not limited. A new member can still have a normal conversation with someone they have already contacted.<\/p>\n\n Detect e mail addresses, phone numbers and links in private messages.<\/p>\n\n Each type can independently be set to:<\/p>\n\n The default detection covers common local and international phone formats, e mail addresses, bare domains and common messenger invite links.<\/p>\n\n Phone prefixes can be configured for your own country.<\/p>\n\n The detection rules have been tested against legitimate content too, including dates, file names and version numbers.<\/p>\n\n Add your own messenger or service patterns to the link filter.<\/p>\n\n This is useful for services that are specific to your region or community, such as Zalo, LINE or KakaoTalk.<\/p>\n\n Patterns are matched case insensitively. You only need to enter the pattern itself. You do not need to add Use an editable keyword list to detect mentions of services such as WhatsApp, Telegram, Snapchat, Instagram, Discord, Kik, Viber, WeChat and Signal. Add one word or phrase per line and choose Block<\/strong>, Log only<\/strong> or Off<\/strong>. You can apply the filter to all accounts or only new accounts and optionally temporarily lock an account after repeated matches within a configurable retention window. Because keyword matching is less precise than the contact filter, Log only<\/strong> is recommended when setting it up.<\/p>\n\n Detect copy and paste spam across conversations.<\/p>\n\n The plugin counts identical messages per user within a configurable time window. Both the message threshold and the time window are configurable.<\/p>\n\n The check works across all conversations, so sending the same message to many different members still counts.<\/p>\n\n For established members, sharing an e mail address or phone number can trigger a confirmation step. The first message is held back and the member sees a short warning, giving them a moment to consider why the other person may be asking for their private details. If they send the exact same message again within the confirmation window, it is delivered. New accounts are handled by the new account rules instead.<\/p>\n\n When a very new account shares an e mail address or phone number, the other participant automatically sees a short safety warning in the conversation. It reminds them to be careful when a new member quickly asks to move the conversation elsewhere or requests private contact details. Nothing is blocked and the sender does not see the warning. The aim is to give members a moment to recognise a potentially risky pattern before sharing their own details. The warning threshold and message are configurable.<\/p>\n\n Receive an e mail when the plugin detects a signal such as contact information, a new account limit or duplicate messages.<\/p>\n\n Alerts can be enabled separately for each signal type.<\/p>\n\n A cooldown prevents one active account from generating a large number of identical alerts.<\/p>\n\n Alerts contain information about who triggered the signal, what was detected and when it happened. They do not contain the message itself.<\/p>\n\n Some automated browsers try to look like normal browsers. This check looks for a few clear inconsistencies that can reveal automation.<\/p>\n\n It can detect:<\/p>\n\n The check only acts on clear signals. Missing client hints are not treated as suspicious, since browsers such as Safari, Firefox and iOS may not send them at all. The Windows version check only applies when the relevant Windows values are present. Other browsers and operating systems are not affected.<\/p>\n\n Use Log only first to see what the check detects on your site before enabling Block.<\/p>\n\n Optionally add Cloudflare Turnstile for invisible bot verification.<\/p>\n\n Members do not see a puzzle or checkbox. The verification runs in the background. Users who actively block Turnstile with a privacy extension get a friendly notification to allow Cloudflare to run in order to send messages.<\/p>\n\n Turnstile requires Cloudflare keys and is completely optional. The other modules work without Cloudflare.<\/p>\n\n In older versions of Better Messages, when a message is rejected, the message editor is normally cleared.<\/p>\n\n This module restores the text so the member can edit it and try again without having to retype everything.<\/p>\n\n Enable this optional module only while you are still running an older version of Better Messages. It can also still be useful to enable when blocking certain words, as it gives people a chance to change their input.<\/p>\n\n Add user IDs that should bypass all checks. This is useful for testing and for moderators who should not be affected by new account limits.<\/p>\n\n The plugin can write its decisions to the PHP error log using The log shows who triggered a signal, which signal was detected and what action was taken.<\/p>\n\n Message content is never written to the log.<\/p>\n\n This makes Log only<\/strong> mode useful for tuning the settings based on what actually happens on your site.<\/p>\n\n The guard is designed to add as little overhead as possible. Each module only runs when it is relevant, and checks exit early when there is nothing to process. Front end scripts and styles are loaded only when needed, while counters and temporary data use lightweight cached storage.<\/p>\n\n The result is a guard that protects private messages without adding unnecessary work to the rest of your site.<\/p>\n\n The plugin has been thoroughly tested in both automated tests and a live community. The detection rules, duplicate detection, admin interface and individual modules are all covered by testing.<\/p>\n\n There are more than 90 automated assertions, all passing before a release. The plugin has also been tested against real scam attempts and normal user behaviour.<\/p>\n\n The features were developed from real situations, tested against real examples and refined through use.<\/p>\n\n This plugin includes an optional Cloudflare Turnstile anti-spam module. It is disabled by default and does nothing until an administrator enables it in the plugin settings.<\/p>\n\n When enabled, the plugin:<\/p>\n\n Turnstile is an interactive security service: when active, visitor interaction with the widget is processed by Cloudflare under Cloudflare's own terms and privacy policy. No message content is sent to Cloudflare; only the widget token is verified.<\/p>\n\n The widget script and server-side verification are provided by Cloudflare, Inc.:\n* Cloudflare Terms of Service:<\/strong> https:\/\/www.cloudflare.com\/terms\/<\/a>\n* Cloudflare Privacy Policy:<\/strong> https:\/\/www.cloudflare.com\/privacypolicy\/<\/a><\/p>\n\n\n
Based on real and thoroughly tested scenarios<\/h3>\n\n
How it works<\/h3>\n\n
\n
Features<\/h3>\n\n
New account limits<\/h3>\n\n
\n
Contact sharing filter<\/h3>\n\n
\n
Extra link patterns<\/h3>\n\n
https:\/\/<\/code>.<\/p>\n\nBad word and messenger filter<\/h3>\n\n
Duplicate message check<\/h3>\n\n
Two step confirmation for private details<\/h3>\n\n
Safety warning in the conversation<\/h3>\n\n
Admin e mail alerts<\/h3>\n\n
Automation & client-hints checks<\/h3>\n\n
\n
Cloudflare Turnstile<\/h3>\n\n
Editor restore (legacy)<\/h3>\n\n
Excluded users<\/h3>\n\n
Activity log<\/h3>\n\n
[BMSG]<\/code> entries.<\/p>\n\nPerformance<\/h3>\n\n
Rigorously tested<\/h3>\n\n
External services<\/h3>\n\n
\n
Requirements<\/h3>\n\n