QWeb Spam Shield

QWeb Spam Shield blocks spam across your entire site, not just your contact form, and it does it without a single CAPTCHA. No puzzles for your real visitors, no account, no API key, and no external service. Everything runs on your own server and nothing ever leaves your site.

Most anti-spam plugins only watch comments or a single form. QWeb Spam Shield guards every place spam and abuse actually get in:

• Every form: Gravity Forms, Contact Form 7, WPForms, Fluent Forms, Elementor Pro Forms, Ninja Forms and Formidable, plus a universal wp_mail catch-all that automatically covers any other form plugin
• WordPress comments and WooCommerce product reviews
• User registration, so fake and bot sign-ups are stopped before an account is ever created
• WooCommerce checkout, with card-testing (carding) defenses that stop attackers from validating stolen cards on your store with waves of fake orders, and running up your payment processing fees
• Your outbound email: the built-in Mail Guard rate-limits the mail your own site sends, so a hacked form or a runaway plugin cannot blast thousands of messages and wreck your domain’s sending reputation

No CAPTCHA, ever. Your visitors never see a checkbox, a puzzle, or a « click all the crosswalks » challenge. Detection runs invisibly in the background, so genuine customers sail through and only spam is stopped.

How it decides (fast, all local):

• Content signals: links in messages, gibberish, non-Latin scripts (French, German, and Spanish accents are allowed), marketing-pitch phrasing, and banned keywords matched on whole words
• Identity signals: disposable-email domains (a bundled list of about 7,900), missing MX records with typo tolerance, and role accounts
• Behavioral signals: honeypot, submission timing, and per-email or per-IP velocity for repeat offenders

Built for site owners:

• A grouped spam log. A 1,000-request attack is one counted row, not 1,000, so your day-to-day spam stays visible. It is auto-cleaned by age and a row cap.
• Conservative by design. Genuine customer questions are not hard-blocked. Borderline submissions are held for review, never silently lost, and can be re-delivered.
• Comments use WordPress moderation (spam folder or moderation queue), so nothing is destroyed.
• GDPR friendly: IP anonymization, configurable retention, and support for Tools then Export or Erase Personal Data.

Privacy:

QWeb Spam Shield makes no external HTTP requests. It does not phone home, and it does not require a license, account, or third-party service.

Need even stronger protection? Meet QWeb Spam Shield AI

This free plugin is fully functional on its own and always will be. QWeb Spam Shield AI is the premium edition for sites that want the strongest protection possible. It layers a managed AI engine and a cross-site defense network on top of everything above:

• Managed AI tiebreaker. A purpose-built AI reviews only the borderline submissions the rules engine is unsure about, so you catch more real spam without ever blocking a genuine customer. There is no API key to buy or configure. It is included with your license.
• AI review of held submissions. Every held message is re-checked against your own business context, and real customer inquiries are released automatically. False positives drop close to zero, completely hands-off.
• Cross-site pattern network. The instant spam is confirmed on any protected site, every other licensed site is protected from it too, so your site benefits from attacks aimed at everyone else.
• Sharper detection that keeps improving, tuned continuously on live spam across the whole network.
• Faster, fully automatic updates delivered straight to your dashboard.
• Priority support from the team that builds it.

Get QWeb Spam Shield AI at https://qwebspamshield.com

Source code and build tools

The plugin ships all of its source. The only compiled asset is the React admin app in admin/build/, generated from the human-readable source included in admin/src/ with the official WordPress build tooling:

1. Run npm install in the plugin root (uses package.json, @wordpress/scripts).
2. Run npm run build. This regenerates admin/build/index.js and style-index.css.

Everything else (PHP, the frontend honeypot script in assets/js/, CSS) is plain, unminified source. The bundled disposable-email-domain list in data/ comes from the public domain disposable-email-domains project (github.com/disposable-email-domains).