Gecka Antispam Wordpress Plugin - Rating, Reviews, Demo & Download
Plugin Description
Gecka Antispam stops spam on comments, login, registration, WooCommerce, Contact Form 7, Gravity Forms, ACF front-end forms and the forms you wrote yourself. There is no captcha: a visitor fills the form and sends it, nothing more. The checks run on your server, and no service outside the site reads what your visitors write.
How it catches bots
Most spam bots post without loading the page, fill in every field they find, or type random letters where a name goes. Each protected form carries:
- a signed timestamp: a form sent faster than anybody types, or days after it was shown, is refused
- a honeypot, a field people never see and bots fill in
- checks on what was typed: a name or a one-word message made of random letters, a message of too few words, a user agent no browser sends
A bot caught gets an error page. A person caught by mistake gets the same page, with a link back, and sends again: nothing is lost silently.
A filter that learns from you
Bots that load the page and fill the form like a person get past the checks of the form. For those, the plugin ships gecka/spamfilter, a statistical filter that rates every message from 0 to 100 % spam, trained on your own site: each time you mark a comment, a Flamingo message or a Gravity Forms entry as spam, or as legitimate, it learns. From 95 % a message is refused, from 75 % it goes to the spam queue, from 55 % it is flagged for review, and below that it passes. The thresholds are yours to set, and one click has it learn, in one go, everything already moderated on the site.
The filter compares what it learnt with background tables that tell a common word from a rare one, in each language of your site. It needs 20 spam texts and 10 legitimate ones before it rates anything, and its counters age, so the spam of today outweighs the campaigns of past years. It needs the intl and mbstring extensions of PHP, which most hosts provide.
Everything stays on your site
Nothing of the submissions leaves your server, no cookie is set, and no name, email address or IP address of a sender is kept. The only requests the plugin makes download the background tables of the filter, see External services. A paragraph for your privacy policy is offered under Settings > Privacy.
See what it does
- Security > Statistics: the submissions checked, accepted and caught over 7, 30, 90 or 365 days, by form and by check; with the Gecka Geolocation plugin, by country and by network, with their flags and logos, the address itself never being read nor kept
- Security > Journal: every refused submission, to review, learn from or delete, kept 30 days
- A dashboard widget for the last seven days, an Antispam column in the comments and in Flamingo with the rating of each message, and Site Health tests of the tables, the daily task and the filter
Protected forms
- WordPress: comments, login, registration, lost password, and the network registration of a multisite
- WooCommerce: classic checkout, product reviews, My account login, registration and lost password, the login of the app authorization screen
- Contact Form 7: every form, or only the forms holding the
[gecka_antispam]tag - Gravity Forms: every form, or only the forms holding the Antispam field
- ACF, ACF Pro and Secure Custom Fields: every front-end form, or only the forms whose
acf_form()arguments hold'gecka_antispam' => true - Your own forms, with two functions,
gecka_antispam_fields()andgecka_antispam_check(): see the developer documentation
The checkout block and the payment buttons of WooCommerce take other routes and are not covered.
Privacy
The plugin keeps daily counts of the submissions it checks, counts on hashes of the words of the subject and message of the texts marked as spam or not spam, and the subject and message of the submissions refused, until 30 days after the text was last sent. A refused message may hold personal details the sender wrote in it, and its subject is what the form cites as its subject: a field of the sender cited there, a phone number for instance, is kept with it. Words a sender typed in a message, a phone number in a signature for one, enter the counts as hashes and cannot be erased for one person.
The statistical filter is gecka/spamfilter, under the AGPL-3.0-or-later.
External services
The plugin downloads the background tables of the statistical filter from the releases of the spamfilter-backgrounds project on GitHub (https://github.com/Gecka-Apps/spamfilter-backgrounds): the manifest of the latest release, then the table of each language wanted, about 1 MB each. Nothing is downloaded before an administrator allows it with the “Download the background tables” button, which the plugins screen, the settings and Site Health point to. From then on it does so when the languages setting changes, from the button of the statistical filter tab, and once a week from its daily task, while the statistical filter is on; unticking the box under the languages stops it. The requests send nothing but what any download sends, the IP address of the server among it, under a user agent naming the plugin; nothing of the site, its visitors or its submissions. GitHub terms of service: https://docs.github.com/en/site-policy/github-terms/github-terms-of-service, privacy statement: https://docs.github.com/en/site-policy/privacy-policies/github-general-privacy-statement. The gecka_antispam_background_updates filter returning false stops the downloads.
Development
The plugin is developed on GitHub, where bugs can be reported and changes suggested: https://github.com/Gecka-Apps/wordpress-plugin-gecka-antispam. Questions on using it are welcome in the support forum.
Screenshots
The statistics: submissions checked, accepted and caught over the period, with the share of each check.
Where the spam comes from: countries, networks and systems, with the flags and logos of Gecka Geolocation.
The refused submissions, to review, learn from or delete.
The dashboard widget: the last seven days at a glance.
The Antispam column of the comments, with the spam rating of each one.
The statistical filter: what it learnt, when it rotates, and the comments and messages of the site it can still learn from.
The background tables: the word frequencies of each language of the site, downloaded and kept up to date.
The thresholds of the filter: refused, marked as spam, flagged for review, the texts it needs before it rates anything, and the rotation period.
The forms protected: WordPress, WooCommerce, Contact Form 7, Gravity Forms and ACF, every form or only those holding the marker.
The checks for bots: honeypot, timing, random names and texts, browsers that are none.
How long the statistics are kept.
