{"id":394093,"date":"2026-11-02T17:31:32","date_gmt":"2026-11-02T17:31:32","guid":{"rendered":"https:\/\/wordpress.org\/plugins\/leadshield\/"},"modified":"2026-11-02T17:31:02","modified_gmt":"2026-11-02T17:31:02","slug":"leadshield","status":"publish","type":"plugin","link":"https:\/\/wordpress.org\/plugins\/leadshield\/","author":23594545,"comment_status":"closed","ping_status":"closed","template":"","meta":{"version":"1.0.0","stable_tag":"1.0.0","tested":"7.1.4","requires":"5.6","requires_php":"7.2","requires_plugins":null,"header_name":"LeadShield","header_author":"LeadShield.ai","header_description":"Blocks fake, bot and AI-generated form submissions in real time \u2014 before they reach your inbox or CRM. Works with Contact Form 7, WPForms, Gravity Forms, Elementor, WooCommerce and any other form. Free plan available.","assets_banners_color":"0f172a","last_updated":"2026-11-02 17:31:02","external_support_url":"","external_repository_url":"","donate_link":"","header_plugin_uri":"https:\/\/leadshield.ai\/docs#wordpress","header_author_uri":"https:\/\/leadshield.ai","rating":0,"author_block_rating":0,"active_installs":0,"downloads":46,"num_ratings":0,"support_threads":0,"support_threads_resolved":0,"author_block_count":0,"sections":["description","installation","faq","changelog"],"tags":{"1.0.0":{"tag":"1.0.0","author":"leadshieldai","date":"2026-11-02 17:31:02","revision":3780390}},"upgrade_notice":{"1.0.0":"<p>Initial release.<\/p>"},"ratings":[],"assets_icons":{"icon-128x128.png":{"filename":"icon-128x128.png","revision":3780388,"resolution":"128x128","location":"assets","locale":"","width":128,"height":128},"icon-256x256.png":{"filename":"icon-256x256.png","revision":3780388,"resolution":"256x256","location":"assets","locale":"","width":256,"height":256}},"assets_banners":{"banner-1544x500.png":{"filename":"banner-1544x500.png","revision":3780388,"resolution":"1544x500","location":"assets","locale":"","width":1544,"height":500},"banner-772x250.png":{"filename":"banner-772x250.png","revision":3780388,"resolution":"772x250","location":"assets","locale":"","width":772,"height":250}},"assets_blueprints":{},"all_blocks":[],"tagged_versions":["1.0.0"],"block_files":[],"assets_screenshots":[],"screenshots":{"1":"The settings screen \u2014 paste your API key and you are protected.","2":"The dashboard: what was blocked, and the plain-English reason for each verdict.","3":"A blocked submission showing its risk score and reasons."}},"plugin_section":[],"plugin_tags":[2656,166108,165261,2179,2419],"plugin_category":[54],"plugin_contributors":[290354],"plugin_business_model":[],"class_list":["post-394093","plugin","type-plugin","status-publish","hentry","plugin_tags-anti-spam","plugin_tags-bot-protection","plugin_tags-contact-form-spam","plugin_tags-form-validation","plugin_tags-spam-protection","plugin_category-security-and-spam-protection","plugin_contributors-leadshieldai","plugin_committers-leadshieldai"],"banners":{"banner":"https:\/\/ps.w.org\/leadshield\/assets\/banner-772x250.png?rev=3780388","banner_2x":"https:\/\/ps.w.org\/leadshield\/assets\/banner-1544x500.png?rev=3780388","banner_rtl":false,"banner_2x_rtl":false},"icons":{"svg":false,"icon":"https:\/\/ps.w.org\/leadshield\/assets\/icon-128x128.png?rev=3780388","icon_2x":"https:\/\/ps.w.org\/leadshield\/assets\/icon-256x256.png?rev=3780388","generated":false},"screenshots":[],"raw_content":"<!--section=description-->\n<p>Your contact form is filling up with junk: throwaway addresses, gibberish names, bot submissions, and \u2014 increasingly \u2014 enquiries written by AI that read exactly like a real person. Your sales time goes on chasing ghosts, and if you run Google or Meta ads, every junk conversion teaches the algorithm to find you more of the same.<\/p>\n\n<p>LeadShield screens every submission in real time and blocks the fakes before they land.<\/p>\n\n<p><strong>No CAPTCHA.<\/strong> Real visitors never see a puzzle, never tick a box, never identify a fire hydrant. Detection is invisible and runs on the submission itself.<\/p>\n\n<h4>What it checks<\/h4>\n\n<ul>\n<li><strong>Email<\/strong> \u2014 syntax, live mail-server (MX) lookup, a disposable\/throwaway domain blocklist refreshed weekly, and typo rescue (someone typing <code>gmial.com<\/code> is offered <code>gmail.com<\/code> instead of being lost)<\/li>\n<li><strong>Behaviour<\/strong> \u2014 a hidden honeypot field, how fast the form was completed, and whether a human actually typed, moved a mouse or touched the screen (mobile taps and browser autofill are recognised as human, never penalised)<\/li>\n<li><strong>IP reputation<\/strong> \u2014 known abusive addresses, via live threat data<\/li>\n<li><strong>Phone<\/strong> \u2014 format and region validity when a phone field is present<\/li>\n<li><strong>Device fingerprinting<\/strong> <em>(Pro and Agency \u2014 included in your first 14 days)<\/em> \u2014 catches the same device submitting over and over. Hashed in the visitor's browser; no third-party tracking scripts are loaded on your site<\/li>\n<li><strong>AI content analysis<\/strong> <em>(Pro and Agency \u2014 included in your first 14 days)<\/em> \u2014 reads the whole enquiry in context to spot machine-generated spam text and fabricated identities<\/li>\n<\/ul>\n\n<p>Every submission gets a 0\u2013100 risk score and a plain-English reason, so you always know <em>why<\/em> something was blocked.<\/p>\n\n<h4>Fail-open by design<\/h4>\n\n<p>If LeadShield is ever slow or unreachable, your forms submit normally. An outage on our side can never cost you a real lead. This is a deliberate design choice: we would rather let one junk lead through than lose you a customer.<\/p>\n\n<h4>Works with your existing forms<\/h4>\n\n<p>One setting, no per-form configuration. Automatically protects:<\/p>\n\n<ul>\n<li>Contact Form 7<\/li>\n<li>WPForms<\/li>\n<li>Gravity Forms<\/li>\n<li>Elementor Forms<\/li>\n<li>Ninja Forms<\/li>\n<li>Formidable Forms<\/li>\n<li>WooCommerce registration and contact forms<\/li>\n<li>Any other form on the page, including ones added dynamically by page builders<\/li>\n<\/ul>\n\n<h4>Pricing<\/h4>\n\n<ul>\n<li><strong>Free<\/strong> \u2014 100 validations\/month, free forever, no credit card<\/li>\n<li><strong>Pro<\/strong> $99\/mo \u2014 10,000\/month, plus AI analysis, device fingerprinting, webhooks, CSV export and Google Ads \/ Meta exclusion exports<\/li>\n<li><strong>Agency<\/strong> $249\/mo \u2014 unlimited, one account for all your clients' sites, plus tunable risk thresholds and configurable data retention<\/li>\n<\/ul>\n\n<p>Every account starts with 14 days of Pro \u2014 no card \u2014 and then stays on the Free plan unless you upgrade.<\/p>\n\n<h4>Privacy<\/h4>\n\n<p>The plugin sets no cookies and no browser storage on your visitors, and loads no third-party tracking. Screened lead data is deleted automatically after 90 days by default (configurable, down to zero, on the Agency plan). Exactly what is sent, and when, is listed under External services below.<\/p>\n\n<h3>External services<\/h3>\n\n<p>This plugin connects your forms to the LeadShield.ai service, which screens each submission for fake, bot and spam leads. It does nothing until you save a LeadShield API key in Settings \u2192 LeadShield.<\/p>\n\n<p>Once a key is saved:<\/p>\n\n<ul>\n<li>Front-end pages load the LeadShield script from https:\/\/leadshield.ai\/js\/shield.js. As with any externally hosted script, the visitor's browser connects to leadshield.ai to fetch it, so the service receives the visitor's IP address and browser user agent.<\/li>\n<li>When a visitor submits a protected form, the script sends the form's email, name, company, phone and message fields, the page address, how long the form took to fill in, whether keys, mouse or touch were used, a one-way device hash and any ad-click IDs in the page address (such as gclid or fbclid) to https:\/\/leadshield.ai\/api\/validate, which replies with a verdict. The visitor's IP address and user agent are part of that request.<\/li>\n<li>Nothing is sent from a form until it is submitted.<\/li>\n<\/ul>\n\n<p>The service is provided by LeadShield.ai: <a href=\"https:\/\/leadshield.ai\/terms\">terms of service<\/a>, <a href=\"https:\/\/leadshield.ai\/privacy\">privacy policy<\/a>.<\/p>\n\n<!--section=installation-->\n<ol>\n<li>Install and activate the plugin.<\/li>\n<li>Create a free account at <a href=\"https:\/\/leadshield.ai\/signup\">leadshield.ai\/signup<\/a> \u2014 no credit card required.<\/li>\n<li>Copy your API key from your LeadShield dashboard (the \"API key\" card).<\/li>\n<li>In WordPress, go to <strong>Settings \u2192 LeadShield<\/strong>, paste the key, and save.<\/li>\n<li>Test it: submit one of your own forms using <code>test@mailinator.com<\/code>. It should be blocked, and appear in your dashboard within seconds with the reason shown.<\/li>\n<\/ol>\n\n<!--section=faq-->\n<dl>\n<dt id=\"will%20it%20block%20real%20customers%3F\"><h3>Will it block real customers?<\/h3><\/dt>\n<dd><p>Hard blocks are reserved for high-confidence junk (score 70+). Borderline submissions are marked \"suspicious\", and you choose whether those are blocked \u2014 there is a setting for exactly that. Every verdict carries a plain-English reason you can audit in your dashboard, so nothing is a black box.<\/p><\/dd>\n<dt id=\"do%20my%20visitors%20have%20to%20solve%20a%20captcha%3F\"><h3>Do my visitors have to solve a CAPTCHA?<\/h3><\/dt>\n<dd><p>No. Detection happens on the submission itself. Genuine visitors notice nothing at all.<\/p><\/dd>\n<dt id=\"does%20it%20slow%20down%20my%20site%3F\"><h3>Does it slow down my site?<\/h3><\/dt>\n<dd><p>The script is small and loads asynchronously, so it never blocks page rendering. Validation typically completes in well under a second, and there is a hard 5-second timeout after which the form simply submits.<\/p><\/dd>\n<dt id=\"does%20it%20work%20with%20my%20form%20plugin%3F\"><h3>Does it work with my form plugin?<\/h3><\/dt>\n<dd><p>Almost certainly. It attaches to every form on the page rather than integrating with one specific plugin, and it watches for forms added later by page builders and single-page themes.<\/p><\/dd>\n<dt id=\"can%20i%20protect%20only%20some%20forms%3F\"><h3>Can I protect only some forms?<\/h3><\/dt>\n<dd><p>Yes \u2014 enter a CSS selector in the settings. This is useful on WooCommerce, where you may want to protect registration and contact forms but leave checkout completely untouched.<\/p><\/dd>\n<dt id=\"is%20there%20really%20a%20free%20plan%3F\"><h3>Is there really a free plan?<\/h3><\/dt>\n<dd><p>Yes. Every account starts with 14 days of Pro, then stays on the Free plan \u2014 100 validations a month, for as long as you want it, no card. There is also a free no-signup audit at <a href=\"https:\/\/leadshield.ai\/audit\">leadshield.ai\/audit<\/a> where you can upload a CSV of leads you already have and see how many are junk before installing anything.<\/p><\/dd>\n<dt id=\"does%20it%20show%20a%20%22protected%20by%20leadshield%22%20badge%20on%20my%20site%3F\"><h3>Does it show a \"Protected by LeadShield\" badge on my site?<\/h3><\/dt>\n<dd><p>Only if you switch it on in Settings \u2192 LeadShield. It is off by default.<\/p><\/dd>\n<dt id=\"what%20happens%20if%20i%20hit%20my%20monthly%20limit%3F\"><h3>What happens if I hit my monthly limit?<\/h3><\/dt>\n<dd><p>Submissions pass through unvalidated until the limit resets on the 1st \u2014 your forms keep working normally. You are emailed at 80% and 100% so it never happens as a surprise.<\/p><\/dd>\n\n<\/dl>\n\n<!--section=changelog-->\n<h4>1.0.0<\/h4>\n\n<ul>\n<li>Initial release: real-time form screening, settings screen with API key, optional credit badge (off by default), suspicious-blocking toggle and optional form selector.<\/li>\n<\/ul>","raw_excerpt":"Blocks fake, bot and AI-generated form submissions in real time \u2014 before they reach your inbox or CRM. No CAPTCHA. Free plan available.","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin\/394093","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin"}],"about":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/types\/plugin"}],"replies":[{"embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/comments?post=394093"}],"author":[{"embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wporg\/v1\/users\/leadshieldai"}],"wp:attachment":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/media?parent=394093"}],"wp:term":[{"taxonomy":"plugin_section","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_section?post=394093"},{"taxonomy":"plugin_tags","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_tags?post=394093"},{"taxonomy":"plugin_category","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_category?post=394093"},{"taxonomy":"plugin_contributors","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_contributors?post=394093"},{"taxonomy":"plugin_business_model","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_business_model?post=394093"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}