Booker Privacy Spam Guard

Booker Privacy Spam Guard protects Elementor forms and the native WordPress comment form from spam without unnecessarily processing personal data. It is built specifically for Elementor users: the classic Elementor Pro Form widget gets the full feature set, and the WordPress comment form is covered as well. The new Atomic Form widget receives content checks, rate limiting, auto-ban and local proof of work based on the global default protection level; per-form honeypot and time checks are not yet available for its newer editor control system.

• Invisible honeypot field with a random field name that is unique per installation
• Time-based plausibility check via a signed, tamper-proof time window
• Server-side nonce integrity check per form
• Content heuristic: blocks entries with too many links or your own spam keywords
• Rate limiting based on a pseudonymous, daily-rotating fingerprint (no raw data such as IP addresses is stored)
• Automatic ban for fingerprints that repeatedly stand out (threshold and time window configurable)
• Local adaptive SHA-256 proof-of-work challenge with no external service, cookies or visible puzzle
• Per-form protection levels (Off / Basic / Standard / Strict)
• Statistics overview with a 14-day history chart and a list of blocked requests in the WordPress admin
• Ready-to-use text snippet for your privacy policy, including integration with WordPress’ built-in Privacy Policy Guide
• Configurable client IP detection for sites behind a reverse proxy, load balancer or CDN (e.g. Cloudflare), with a trusted-proxy list to prevent spoofing
• Cache- and CDN-friendly: the timing token and nonce are refreshed on page load from a non-cached endpoint, so full-page or edge caches never serve visitors a stale token
• No cookies, no external requests, no subscription costs

The built-in local proof-of-work provider uses the challenge extension points; optional alternative providers can be registered through the same interface.

The plugin’s privacy-friendly, data-minimal design does not, on its own, make your entire website legally compliant – that depends on many other factors and remains your responsibility.