QWeb Spam Shield Wordpress Plugin - Rating, Reviews, Demo & Download
Plugin Description
QWeb Spam Shield stops spam across your whole site with a fast, multi-layer rules engine tuned on real-world spam. It runs entirely on your server. There is no account, no API key, and no external service. Nothing leaves your site.
Protects everywhere:
- Gravity Forms, Contact Form 7, WPForms, Fluent Forms, Elementor Pro Forms, Ninja Forms, Formidable Forms
- WordPress comments and WooCommerce product reviews
- User registration
- WooCommerce checkout, including the block (Store API) checkout, with card-testing defenses
- A universal wp_mail catch-all that scans notification emails from any form plugin, so plugins without a dedicated integration are still covered
- Mail Guard: rate-limits outbound mail, holds overflow, and bans flooding recipients
How it decides (fast, all local):
- Content signals: links in messages, gibberish, non-Latin scripts (French, German, and Spanish accents are allowed), marketing-pitch phrasing, and banned keywords matched on whole words
- Identity signals: disposable-email domains (a bundled list of about 7,900), missing MX records with typo tolerance, and role accounts
- Behavioral signals: honeypot, submission timing, and per-email or per-IP velocity for repeat offenders
Built for site owners:
- A grouped spam log. A 1,000-request attack is one counted row, not 1,000, so your day-to-day spam stays visible. It is auto-cleaned by age and a row cap.
- Conservative by design. Genuine customer questions are not hard-blocked. Borderline submissions are held for review, never silently lost, and can be re-delivered.
- Comments use WordPress moderation (spam folder or moderation queue), so nothing is destroyed.
- GDPR friendly: IP anonymization, configurable retention, and support for Tools then Export or Erase Personal Data.
Privacy:
QWeb Spam Shield makes no external HTTP requests. It does not phone home, and it does not require a license, account, or third-party service.
Looking for more:
A commercial edition (QWeb Spam Shield AI) adds an optional AI tiebreaker for borderline submissions and cross-site pattern sharing. It is entirely optional. This free plugin is fully functional on its own. See https://qwebspamshield.com for details.
Source code and build tools
The plugin ships all of its source. The only compiled asset is the React admin app
in admin/build/, generated from the human-readable source included in admin/src/
with the official WordPress build tooling:
- Run
npm installin the plugin root (uses package.json, @wordpress/scripts). - Run
npm run build. This regenerates admin/build/index.js and style-index.css.
Everything else (PHP, the frontend honeypot script in assets/js/, CSS) is plain,
unminified source. The bundled disposable-email-domain list in data/ comes from the
public domain disposable-email-domains project (github.com/disposable-email-domains).
Screenshots
Dashboard: spam blocked, held, and allowed at a glance, with recent activity and sources.
Activity log: every inbound and outbound decision, with the reason it was flagged.
Detection settings: tune the fast, multi-layer rules engine and the score thresholds.
Integrations: turn protection on per form plugin, comments, registration, and WooCommerce.
Mail Guard: rate-limit outbound email, auto-ban flooders, and hold overflow for review.
Spam patterns: signatures the plugin learned from spam blocked on your own site.
Privacy: review digests, data retention, and GDPR export and erase options.
Setup wizard: confirm protection is live and which forms are covered.
