Onsite Spam Guard

Onsite Spam Guard blocks spam on the forms your visitors actually use — WordPress comments, Contact Form 7, WooCommerce product reviews, Jetpack contact forms and WP Job Manager job submissions, plus account registration and BuddyPress private messages if you want them — without sending anything to a third-party service, requiring an API key, or putting a CAPTCHA in front of your users.

Protection is built from a pipeline of independent guards. Each guard is a small, focused check (a hidden honeypot field, a submit-speed gate, a keyword filter, and so on). Every enabled guard looks at every submission, and one objection is enough to block it; the log records every guard that objected, so you can see exactly why. Every guard can be toggled and tuned from a single settings page — for the whole site, or form by form — and every block can be logged for review.

Spam guards

• Honeypot — a hidden field that bots fill in but humans never see.
• Duplicate detection — rejects identical submissions sent within a short window.
• Time gate — rejects submissions completed faster than a human could plausibly type.
• Signature — requires a server-signed token proving the form was served by this site, deterring automated cross-site posting.
• Rate limit (optional) — throttles repeated submissions from the same sender within a short window, keyed on the logged-in user when there is one and the connection IP otherwise.
• Link limit — flags submissions that contain too many URLs.
• Keyword block — rejects submissions matching a configurable blocklist of words or phrases.
• Behavioral analysis (optional) — scores mouse movement, clicks, and time on page to spot bot-like interaction.

Why you might choose it

• No external services. Nothing leaves your site. No accounts, no API keys, no per-submission fees.
• No CAPTCHA. Protection is invisible to legitimate visitors.
• Try before you enforce. Monitor mode records what would have been blocked without blocking anything, for the whole site or a single form, and the Per-form tab sums up what enforcing a form would catch before you switch it on.
• Tuned per form. A contact form can be stricter about links than a comment thread, and a form such as a job listing starts with limits that suit it.
• Allowlist. Trusted IPs, CIDR ranges, email addresses, and email domains bypass every guard.
• Logging with retention. Blocked submissions are recorded in a dedicated table with a paginated admin viewer, and old entries are pruned automatically on a schedule you control.
• Privacy-aware. The plugin registers suggested privacy-policy text describing exactly what it records.
• Modern, dependency-free code. PHP 8.2+, vanilla front-end JavaScript (no jQuery), and no runtime third-party libraries.

Works with

• WordPress comments (always).
• WooCommerce product reviews (when WooCommerce is active).
• Jetpack contact form blocks (when Jetpack is active).
• WP Job Manager job submissions (when WP Job Manager is active).
• Contact Form 7 forms (when Contact Form 7 is active).
• BuddyPress private messages (when BuddyPress is active; off by default).
• Account registration forms — WordPress, WooCommerce My Account and BuddyPress signup (off by default).