Title: Spambargo: Anti-Spam for Forms & Comments Author: Aviv Digital Published: 6 Ogos 2026 Last modified: 11 Ogos 2026 --- Search plugins ![](https://ps.w.org/spambargo/assets/icon-256x256.png?rev=3639337) # Spambargo: Anti-Spam for Forms & Comments Oleh [Aviv Digital](https://profiles.wordpress.org/idoa89/) [Download](https://downloads.wordpress.org/plugin/spambargo.2.4.9.zip) * [Details](https://ms.wordpress.org/plugins/spambargo/#description) * [Reviews](https://ms.wordpress.org/plugins/spambargo/#reviews) * [Pemasangan](https://ms.wordpress.org/plugins/spambargo/#installation) * [Pembangunan](https://ms.wordpress.org/plugins/spambargo/#developers) [Support](https://wordpress.org/support/plugin/spambargo/) ## Description Spambargo is a simple anti-spam plugin for WordPress site owners, agencies and website builders. It helps block unwanted form submissions, comments and WooCommerce spam without requiring a third-party CAPTCHA service or complicated setup. It works with Elementor Pro Forms, Contact Form 7, JetFormBuilder, Ninja Forms, WooCommerce registration and checkout, WooCommerce Checkout Blocks, WordPress comments, and eligible generic lead forms. Start with the recommended settings, add common spam rules with one click, and adjust only what your site needs. The most useful controls are shown first, while technical options stay under Advanced settings. #### What can Spambargo block? * Messages containing blocked words or phrases. * Messages with too many links. * Disposable and suspicious email addresses. * Forms submitted unrealistically fast. * Repeated submissions from the same visitor. * Specific email addresses and email domains. * Specific IP addresses and IPv4 or IPv6 network ranges. * Messages written mostly in capital letters. * Clearly suspicious phone number patterns when the optional phone check is enabled. * Additional automated spam using optional browser-token and math-challenge checks. #### Supported forms and integrations * Elementor Pro Forms. * Contact Form 7. * JetFormBuilder. * Ninja Forms. * WooCommerce registration and classic checkout. * WooCommerce Checkout Blocks. * WordPress comments. * Eligible generic HTML lead forms using a best-effort browser-side pre-check. Native integrations validate submissions on the server. Generic forms without a native integration use a browser-side pre-check and require a native or custom server- side integration for protection against direct POST requests. #### Simple to set up * Dashboard statistics and the main protection settings are available on one screen. * Blocked words and phrases, link limits, email checks and automatic limits appear first. * Recommendation buttons can add useful starting values without deleting existing settings. * Advanced technical controls stay collapsed until you need them. * A searchable spam log helps you understand what was blocked and why. #### How protection works Spambargo combines several lightweight checks instead of relying on a single CAPTCHA: * Literal blocked-word and phrase rules with case-insensitive matching. * Link-count and email-pattern checks. * Honeypot and minimum submission-time checks. * Atomic minute and hourly rate limits with IPv6 network grouping. * Manual email, domain, IP and CIDR block lists. * Optional phone validation, math challenge and temporary signed browser correlation token. * Trusted-proxy handling for forwarded visitor IP addresses. * Automatic log retention, streamed CSV export and batched email or webhook notifications. Spambargo runs its checks locally on the WordPress site by default and does not require a CAPTCHA service operated by a third party. ### Privacy Spambargo does not send data to a service operated by the plugin author. All checks run on the site server by default. When a submission is blocked, the plugin may store the IP address, email address, form identifier, block reason, optional content snippet and optional verified fingerprint hash. The content snippet can be disabled and logs are cleaned according to the configured retention period. Optional browser correlation collects coarse screen-size buckets, timezone, language, platform, CPU-core count and touch capability. The server combines them with a random per-session identifier and returns a signed hash token stored in browser sessionStorage for up to eight hours. Raw attributes are not written to the spam log. Administrators should update their privacy notice as required by applicable law. Spambargo integrates with WordPress personal-data export and erasure tools and adds suggested text to the Privacy Policy Guide. When a webhook URL is configured, batched blocked-submission data is sent to that administrator-selected endpoint. This is the only optional external data transfer performed by the plugin. ## Installation 1. Upload the `spambargo` folder to `/wp-content/plugins/`. 2. Activate the plugin. 3. Open Spambargo. The dashboard and the main protection settings appear together on the first screen. 4. Test every important form in a staging environment before enabling strict signed- token mode, the math challenge, phone validation or browser correlation. 5. If the site is behind a reverse proxy or CDN, add only the actual proxy IPs/CIDRs to Trusted Proxies before relying on forwarded client IPs. ## FAQ ### Does the plugin intercept every form? No. Native integrations are never pre-validated by the universal AJAX checker. Generic interception targets likely lead forms and can be controlled with CSS selectors or data attributes. This generic mode is a browser-side, best-effort pre-check and cannot stop a bot that posts directly to a custom form handler; server-enforced protection requires one of the listed native integrations or custom server-side validation. ### Can visitors without JavaScript submit? By default, yes. The honeypot and server checks continue to work, while a missing behavior token is allowed. Administrators can enable strict token mode, which is stronger but requires JavaScript. ### Does Checkout Blocks support the math challenge? Not in this release. Checkout Blocks receive server-side identity, blacklist, content, phone and rate checks. Behavioral tokens and the visual math challenge are deliberately skipped because Blocks require a dedicated client-side extension-data integration. ### How are blocked words and phrases matched? Each line is a separate literal rule. A single-word line blocks that complete word, not a longer word that merely contains it. A multi-word rule blocks only when all of its words appear in the same order, although other words or punctuation may appear between them. Matching is not case-sensitive. Regular expressions are not executed. One matching line is enough to block a submission. ### What does the English spam recommendation button add? It adds an optional, intentionally strict list of common English spam terms covering gambling, pharmaceuticals, crypto, SEO outreach, adult content and similar messages. It is especially suitable for sites whose legitimate enquiries are mainly written in Hebrew. The list is never added automatically, does not replace existing entries and can be edited before saving. ### Are logs deleted automatically? Yes. A daily WordPress cron event removes entries older than the configured retention period and clears expired rate-limit counters. ### What happens on uninstall? Data is preserved by default. Enable “Delete all data when plugin is uninstalled” before deleting the plugin to remove its tables and settings. ## Reviews There are no reviews for this plugin. ## Contributors & Developers “Spambargo: Anti-Spam for Forms & Comments” adalah perisian sumber terbuka. Orang- orang berikut telah menyumbang kepada pemalam ini. Penyumbang * [ Aviv Digital ](https://profiles.wordpress.org/idoa89/) [Translate “Spambargo: Anti-Spam for Forms & Comments” into your language.](https://translate.wordpress.org/projects/wp-plugins/spambargo) ### Berminat dalam pembangunan? [Layari kod](https://plugins.trac.wordpress.org/browser/spambargo/), periksa [repositori SVN](https://plugins.svn.wordpress.org/spambargo/), atau langgani [log pembangunan](https://plugins.trac.wordpress.org/log/spambargo/) dengan [RSS](https://plugins.trac.wordpress.org/log/spambargo/?limit=100&mode=stop_on_copy&format=rss). ## Changelog #### 2.4.9 * Changed the plugin name punctuation to a colon for cleaner, consistent branding in WordPress Admin. * Rewrote the short description to clearly name supported form integrations and key spam checks. * Updated the dashboard title and related plugin-name strings for consistency. * No spam-protection logic, defaults or stored data were changed in this release. #### 2.4.8 * Removed bundled PO and MO files so translations are delivered through translate. wordpress.org language packs. * Converted built-in visitor messages to the standard WordPress gettext API. * Registered every setting with an explicit type and sanitization callback. * Added a dedicated webhook-secret validator that preserves printable HMAC secrets exactly without exposing them in the interface. #### 2.4.7 * Removed an unnecessary fclose() call from the streamed CSV export so the package passes WordPress Coding Standards. * The php://output stream remains managed automatically by PHP at the end of the request. #### 2.4.6 * Replaced the optional English recommendation preset with a strict, editable set of common gambling, pharmaceutical, financial, SEO outreach and adult-spam rules. * Kept every recommended rule opt-in and stopped adding blocked-content rules automatically on new installations. * Clarified that each line is an independent literal rule, matching complete words or ordered multi-word phrases without case sensitivity. * Removed administrator-supplied regular-expression execution and bounded the text allowed between phrase terms. * Fixed the zero-link setting so it blocks every message containing a link. * Prepared signed fields for native integrations even when their forms contain password fields. * Restricted webhook delivery to validated HTTPS endpoints. * Localized the honeypot label, sanitized custom visitor messages defensively and refreshed the Hebrew translation files. #### 2.4.5 * Removed dynamically interpolated SQL fragments from spam-log filtering and sorting queries. * Prepared every log query with an explicit placeholder list and fixed replacement counts. * Escaped WooCommerce Store API exception messages directly at the exception sink for static-analysis compatibility. #### 2.4.4 * Resolved Plugin Check errors for prepared database queries, output handling and translator comments. * Sanitized request inputs and removed discouraged runtime configuration and translation- loading calls. * Added a conservative starter list of common spam phrases while preserving customized lists. #### 2.4.1 * Clarified how blocked words and phrases are matched in the settings screen. * Multi-word rules now require every word in the same order while allowing extra words between them. * Expanded the safe local recommendation set without adding broad one-word rules. #### 2.4.0 * Combined the dashboard and main protection settings on one screen. * Moved technical controls into an accessible Advanced settings panel that is closed by default. * Reordered the settings so blocked phrases, link limits, temporary email domains and automatic limits appear first. * Rewrote field labels and explanations in clear English and Hebrew. * Changed the recommended minimum submission time to 2 seconds and clarified that only faster submissions are blocked. * Kept Spam Log and Tools as separate menu pages. ## Meta * Version **2.4.9** * Last updated **8 jam lalu** * Active installations **50+** * WordPress version ** 6.2 or higher ** * Tested up to **7.0.3** * PHP version ** 7.4 or higher ** * Language * [English (US)](https://wordpress.org/plugins/spambargo/) * Tags * [anti-spam](https://ms.wordpress.org/plugins/tags/anti-spam/)[bot protection](https://ms.wordpress.org/plugins/tags/bot-protection/) [comments](https://ms.wordpress.org/plugins/tags/comments/)[contact forms](https://ms.wordpress.org/plugins/tags/contact-forms/) [spam protection](https://ms.wordpress.org/plugins/tags/spam-protection/) * [Paparan Lanjutan](https://ms.wordpress.org/plugins/spambargo/advanced/) ## Ratings No reviews have been submitted yet. [Your review](https://wordpress.org/support/plugin/spambargo/reviews/#new-post) [See all reviews](https://wordpress.org/support/plugin/spambargo/reviews/) ## Penyumbang * [ Aviv Digital ](https://profiles.wordpress.org/idoa89/) ## Support Got something to say? Need help? [View support forum](https://wordpress.org/support/plugin/spambargo/)