Spam Guard filters spam out of your WordPress forms and article comments using rules that run entirely on your own site. There is no account to create, no API key, and no external service: every check happens locally, and nothing about your visitors is sent anywhere.
It protects the forms you already have. Submissions to supported form plugins and to ordinary public forms in your theme are checked before they are stored or emailed, and blocked submissions show a message you write yourself. Article comments get their own page, with manual approval switched on by default so nothing appears on your site until you have seen it.
Every rule is fully editable. Add or remove keywords, phrases and email domains, tune the validation limits and write your own messages, as often as you like. There is no limit on how many forms it protects, no trial period, and no expiry.
The plugin also publishes a small set of actions and filters, so developers can extend the scan with their own signals.
Features
- Native protection for major WordPress form plugins and for custom public forms in your theme
- Keyword, phrase, email-domain and email-suffix blocking
- Unsafe script and code-injection rules that are always enforced
- Server-side validation of required fields, email addresses, URLs, phone numbers and numbers, backed by matching checks in the browser
- Payload safety limits for field count, field length and total size
- Optional name-plus-number Outlook address rule, off by default
- Automatic North American phone-number formatting while typing, on by default
- Dedicated Comments page with manual approval enabled by default
- Pingback and trackback blocking for article posts
- Custom blocked-submission and validation messages
- Spam Log of every blocked submission: what was blocked, why, from which page and form, with search, a source filter and a new-entry counter in the admin menu
- Spam Log retention you control (30 days by default), with sensitive fields such as passwords and payment details never stored
Supported form plugins
Contact Form 7, Gravity Forms, WPForms, MetForm, Ninja Forms, Formidable Forms, Fluent Forms, Forminator, Elementor Forms, Everest Forms, JetFormBuilder, HappyForms, SureForms, WS Form, Bit Form, weForms, Jetpack Forms, Quform, ARForms, Kali Forms, FormCraft, Divi Forms, Mailchimp for WordPress, Newsletter, Advanced Forms, BuddyForms, Kadence Forms, Bricks Forms, Breakdance Forms, Spectra Forms, WordPress comments, and public forms in your theme.
Built to stay fast
Every check runs at submission time on your own server. The small browser script is only loaded while validation or phone formatting is switched on, and nothing else is added to your front end.
Privacy
Spam Guard does not phone home and does not contact any external server. Everything it does happens on your own site, and nothing is sent anywhere.
When a submission is blocked, Spam Guard records it in the Spam Log in your own database so you can check it was really spam: the date, the page and form, the reasons and score, the sender’s IP address and browser, and the submitted fields. Fields that look like passwords, card or payment details, security codes, tokens and nonces are never stored, and storing the submitted fields can be switched off. Entries are deleted automatically after the retention period you choose (30 days by default), and Clear Spam Log removes them all at once. Only administrators can see the Spam Log. Suggested wording for your privacy policy is added under Settings > Privacy.
Allowed submissions are not recorded. On moderated comments the plugin also stores a short scan result.