No longer redirects to the settings screen after activation. Fixes a duplicate purchase button on the paid plan tab.<\/p>","1.0.0":"
Initial public release. Optional sales-email detection sends masked enquiry text when enabled. Default service wait is 10s (max 15). Early renewal carries remaining quota into the next period. Free mode (detection off) does not contact the management server.<\/p>"},"ratings":[],"assets_icons":{"icon-128x128.png":{"filename":"icon-128x128.png","revision":3791741,"resolution":"128x128","location":"assets","locale":"","width":128,"height":128},"icon-256x256.png":{"filename":"icon-256x256.png","revision":3791741,"resolution":"256x256","location":"assets","locale":"","width":256,"height":256}},"assets_banners":{"banner-1544x500.png":{"filename":"banner-1544x500.png","revision":3791741,"resolution":"1544x500","location":"assets","locale":"","width":1544,"height":500},"banner-772x250.png":{"filename":"banner-772x250.png","revision":3791741,"resolution":"772x250","location":"assets","locale":"","width":772,"height":250}},"assets_blueprints":{},"all_blocks":[],"tagged_versions":["1.0.1"],"block_files":[],"assets_screenshots":{"screenshot-1.png":{"filename":"screenshot-1.png","revision":3791741,"resolution":"1","location":"assets","locale":"","width":1280,"height":637},"screenshot-2.png":{"filename":"screenshot-2.png","revision":3791741,"resolution":"2","location":"assets","locale":"","width":1280,"height":1441},"screenshot-3.png":{"filename":"screenshot-3.png","revision":3791741,"resolution":"3","location":"assets","locale":"","width":1280,"height":1327},"screenshot-4.png":{"filename":"screenshot-4.png","revision":3791741,"resolution":"4","location":"assets","locale":"","width":1280,"height":1458}},"screenshots":{"1":"Setup wizard: environment check.","2":"Dashboard: status, seven-day totals, daily graph, and recent detections.","3":"Automatic blocking of attack sources: settings, blocked sources, and the copy-and-paste list.","4":"Optional sales-email detection settings."}},"plugin_section":[],"plugin_tags":[2656,2359,1152,598,599],"plugin_category":[54],"plugin_contributors":[291575],"plugin_business_model":[],"class_list":["post-397462","plugin","type-plugin","status-publish","hentry","plugin_tags-anti-spam","plugin_tags-bot","plugin_tags-contact-form-7","plugin_tags-honeypot","plugin_tags-spam","plugin_category-security-and-spam-protection","plugin_contributors-aistreamjp","plugin_committers-aistreamjp"],"banners":{"banner":"https:\/\/ps.w.org\/ais-formguard\/assets\/banner-772x250.png?rev=3791741","banner_2x":"https:\/\/ps.w.org\/ais-formguard\/assets\/banner-1544x500.png?rev=3791741","banner_rtl":false,"banner_2x_rtl":false},"icons":{"svg":false,"icon":"https:\/\/ps.w.org\/ais-formguard\/assets\/icon-128x128.png?rev=3791741","icon_2x":"https:\/\/ps.w.org\/ais-formguard\/assets\/icon-256x256.png?rev=3791741","generated":false},"screenshots":[{"src":"https:\/\/ps.w.org\/ais-formguard\/assets\/screenshot-1.png?rev=3791741","caption":"Setup wizard: environment check."},{"src":"https:\/\/ps.w.org\/ais-formguard\/assets\/screenshot-2.png?rev=3791741","caption":"Dashboard: status, seven-day totals, daily graph, and recent detections."},{"src":"https:\/\/ps.w.org\/ais-formguard\/assets\/screenshot-3.png?rev=3791741","caption":"Automatic blocking of attack sources: settings, blocked sources, and the copy-and-paste list."},{"src":"https:\/\/ps.w.org\/ais-formguard\/assets\/screenshot-4.png?rev=3791741","caption":"Optional sales-email detection settings."}],"raw_content":"\n
The administration screens are available in Japanese only. Paid cloud sales-email detection is intended for Japanese-language inquiries only; local protection works regardless of language.<\/p>\n\n
AIS FormGuard protects your Contact Form 7 forms from bot spam, and is designed for site owners who do not have an engineer on staff. A three-step setup wizard checks your environment, lets you choose a protection level, and verifies that everything works. It starts in monitor mode<\/strong>, which only records what it would have blocked, so you can confirm that no real inquiry is affected before you switch to defense mode<\/strong>.<\/p>\n\n What makes AIS FormGuard different<\/strong><\/p>\n\n Protection that runs entirely on your own site<\/strong><\/p>\n\n Automatic blocking of attack sources (defense mode only)<\/strong><\/p>\n\n When the same source repeatedly triggers a strong bot signal (a filled honeypot field or a missing token) within a short time, it is blocked for a limited time. While a source is blocked, its form submissions are treated as spam by Contact Form 7, so no email is sent, and the other checks are skipped. The dashboard lists blocked sources, lets you unblock them, and gives you a copy-and-paste list that you can add to your firewall or CDN.<\/p>\n\n To avoid blocking all visitors by mistake, automatic blocking is disabled when the site appears to be behind a proxy or CDN (such as Cloudflare) and you have not told the plugin which proxies to trust.<\/p>\n\n Dashboard for non-engineers<\/strong><\/p>\n\n Optional: sales-email detection with an external service<\/strong><\/p>\n\n With an API key from a paid plan, the plugin can ask the AIS FormGuard judgement service whether a message that passed the local checks looks like a sales solicitation. Messages judged to be sales solicitations are not blocked<\/strong>. They are delivered with a tag in the subject line (for example \"\u3010\u55b6\u696d\u306e\u53ef\u80fd\u6027\u3011\"), optionally to a different recipient, so that a genuine inquiry that is misjudged is never lost. This feature is off by default<\/strong>. See \"External services\" below for exactly what is sent.<\/p>\n\n Fail-open by design<\/strong><\/p>\n\n If anything goes wrong (for example, the optional service is unreachable or slow), the message is allowed through instead of being blocked.<\/p>\n\n What it does not do<\/strong><\/p>\n\n Language<\/strong><\/p>\n\n The administration screens are currently available in Japanese only. Paid sales-email detection is intended for Japanese-language inquiries only.<\/p>\n\n Data stored on your site<\/strong><\/p>\n\n IP addresses can be personal data under some privacy laws. We recommend mentioning the use of this plugin in your site's privacy policy.<\/p>\n\n Data sent to external services<\/strong><\/p>\n\n Only if you enable the optional sales-email detection. See \"External services\".\nAI judgement uses Amazon Bedrock (AWS Tokyo region); see External services.<\/p>\n\n This plugin can optionally connect to the AIS FormGuard judgement service, operated by AIStream Corporation (https:\/\/www.aistream.co.jp\/), to check whether an enquiry looks like a sales or solicitation email. This feature is off by default.<\/strong> The plugin connects only after a site administrator enters an API key and turns on \"Use sales-email detection\".<\/p>\n\n Nothing is sent unless the optional integration is turned on. WordPress user accounts and passwords are never sent.<\/p>\n\n This plugin does not contact Cloudflare. Cloudflare Turnstile, if used, is configured in Contact Form 7.<\/p>\n\n\n If your site is behind Cloudflare or another proxy\/CDN, also read the FAQ entry about trusted proxies, and exclude the page that contains your form from page caching.<\/p>\n\n\n Yes. AIS FormGuard works only with Contact Form 7 (5.4 or later).<\/p><\/dd>\n No. All of the protection described above runs on your own site. The plugin contacts an external server only when the site administrator enters an API key and turns on the optional integration.<\/p><\/dd>\n It starts in monitor mode, which blocks nothing, so you can check first. In defense mode, a message is blocked only when it shows signs of automation, such as a filled hidden field, a forged token, a submission that is far too fast, repeated messages, or an unusual number of links. Messages that look like sales solicitations are never blocked; they are delivered with a tag in the subject line. If a visitor is blocked by mistake, you can unblock them from the dashboard, and you can add addresses that must never be blocked.<\/p><\/dd>\n Most plugins decide only between \"accept\" and \"block\". AIS FormGuard adds a third outcome: a message that might be a sales solicitation, but might also be a real inquiry, is delivered with a tag in the subject line instead of being discarded. It also offers a monitor mode that blocks nothing while you check the results, runs its checks on your own site without registering or buying anything (only the optional sales-email detection needs an API key from a paid plan), and temporarily blocks sources that keep sending obvious bot traffic. Other plugins may suit you better if you want to block sales messages outright or want a different approach; AIS FormGuard is designed to avoid losing a genuine inquiry.<\/p><\/dd>\n They are complementary. Turnstile (a feature of Contact Form 7) checks in the visitor's browser that the visitor is likely to be a real browser. AIS FormGuard looks at how a submission behaves and, optionally, at its content. Contact Form 7 runs its Turnstile check before AIS FormGuard does, so submissions rejected by Turnstile are not seen by this plugin.<\/p><\/dd>\n Enter the IP ranges of your proxy in \"Trusted proxies\" (Dashboard, \"Automatic blocking of attack sources\"). Until you do, the plugin cannot tell your visitors apart and, for safety, automatic blocking stays off. Also exclude the page that contains your form from page caching.<\/p><\/dd>\n No. Automated sales mailers are fairly easy to recognize, but a sales message written by hand in natural language is hard to distinguish from a genuine inquiry. This is why such messages are tagged and delivered rather than blocked.<\/p><\/dd>\n See the \"Privacy\" section below.<\/p><\/dd>\n The plugin's settings, scheduled tasks, and database tables are deleted.<\/p><\/dd>\n\n<\/dl>\n\n\n\n
\n
\n
\n
Privacy<\/h3>\n\n
\n
{prefix}aisfg_log<\/code>) that records the time, form ID, decision, reason codes, a hit counter, and the visitor's IP address with its last part masked (the last octet for IPv4, the lower 80 bits for IPv6). The content of messages is never stored.<\/strong> Log entries are deleted after 30 days by default.<\/li>\n{prefix}aisfg_ban<\/code>) that records the full IP address of each blocked source, the reason, counters, and timestamps. Entries are deleted 7 days after the block expires, or when you unblock the source.<\/li>\nExternal services<\/h3>\n\n
\n
https:\/\/vtrsplxud8.execute-api.ap-northeast-1.amazonaws.com\/prod<\/code> (operated by AIStream Corporation on Amazon Web Services, Tokyo region).<\/li>\nhttps:\/\/d3a2ozkjmvji3q.cloudfront.net\/buy.html<\/code>) in the administrator's browser; the plugin itself does not request it. Payment is handled by Stripe Checkout.<\/li>\n<\/ul>\n\n\n
\n
ais-formguard<\/code> folder to the \/wp-content\/plugins\/<\/code> directory, or install the plugin through the WordPress plugins screen.<\/li>\n\n
Do I need Contact Form 7?<\/h3><\/dt>\n
Does the plugin send any data to an external server by default?<\/h3><\/dt>\n
Can it block genuine visitors?<\/h3><\/dt>\n
How is this different from other spam plugins for Contact Form 7?<\/h3><\/dt>\n
How does this compare with Cloudflare Turnstile?<\/h3><\/dt>\n
My site is behind Cloudflare or another proxy. What do I need to do?<\/h3><\/dt>\n
Can it stop all sales emails?<\/h3><\/dt>\n
What data does the plugin store?<\/h3><\/dt>\n
What happens when I uninstall the plugin?<\/h3><\/dt>\n
1.0.1<\/h4>\n\n
\n
1.0.0<\/h4>\n\n
\n