Tired of spam emails flooding your inbox from your contact form? MentoGuard is a lightweight, privacy-first spam blocker that protects your Contact Form 7 forms from bots – without annoying your real visitors with image puzzles or checkbox challenges.
If you are looking for a reliable reCAPTCHA alternative that is fully GDPR compliant, MentoGuard stops spam bots silently using behavioral analysis and server-side token verification. Zero data is sent to Google or any external server. Ever.
Currently optimized for Contact Form 7 (CF7), with support for more form builders coming in future releases.
How It Works
MentoGuard uses five independent protection layers that work together invisibly:
- IP Blacklist – known bad IPs are blocked instantly before any other check runs. Supports IPv4, IPv6, and CIDR ranges.
- Signed Token – every form load generates a unique one-time server-side token. Headless bots that submit without loading the page are blocked immediately.
- Submission Timing – measures the time between page load and form submission entirely server-side. Bots submit in milliseconds; real users take seconds.
- Behavioral Score – JavaScript silently tracks mouse movement, typing patterns, field interaction order, and paste vs keyboard input to generate an accurate spam score.
- JS Bypass Detection – if a bot disables JavaScript entirely to avoid tracking, MentoGuard catches it server-side.
Real users pass all five layers without ever knowing they exist.
Why Choose MentoGuard Over reCAPTCHA?
- No Google dependency – reCAPTCHA sends visitor data to Google servers. MentoGuard keeps everything on your own server.
- No puzzles, no friction – real visitors never click a checkbox or identify traffic lights. Protection is completely invisible.
- GDPR-friendly by design – no cookies, no third-party requests, no data leaving your server.
- Zero page speed impact – scripts only load on pages that contain an active contact form. Every other page is completely unaffected.
- No monthly fees – MentoGuard is free and open source. No API keys, no account registration, no renewal.
Key Features
- Native Contact Form 7 tag – place [mentoguard] directly inside the CF7 form editor
- Three protection presets – Relaxed, Balanced, Strict – one click to configure
- Per-signal control – enable or disable each behavioral signal and adjust its point value
- Configurable block threshold – set exactly how aggressive the spam filter should be
- Page time protection – configurable minimum time in seconds or milliseconds
- Spam Log dashboard – every blocked submission logged with IP, score, signals, and page URL
- Top Spammers page – IPs ranked by blocked attempt count with one-click blacklist addition
- IP Blacklist – manually add IPs or CIDR ranges permanently blocked before any other check
- Test Mode – see live spam scores without blocking anyone, perfect for tuning
- Debug Log – step-by-step validation showing exactly what happened for every submission
- Bulk log management – select and delete individual entries or clear all at once
- Automatic log retention – configurable from 30 days to forever
- Translation ready – full i18n support with .pot file included
Privacy
MentoGuard stores only the IP address and spam score of blocked submissions – in your own WordPress database. No data is transmitted to any external service at any time. On uninstall, all data is removed completely.
Usage with Contact Form 7
Add [mentoguard] inside your CF7 form editor, before the submit button:
[text* your-name]
[email* your-email]
[mentoguard]
[submit “Send”]
That is all. MentoGuard registers as a native CF7 form tag and activates automatically.
Screenshots
Dashboard - spam statistics, recent blocked submissions, and quick actions
Spam Logs - filterable table with date, IP, score, triggered signals, and bulk delete
Top Spammers - IPs ranked by attempt count with one-click blacklist
Settings - presets, behavioral signals, time protection, IP blacklist, and threshold controls
Debug Log - step-by-step validation output for every form submission