Spamify – Elastic Spam Shield

Spamify is a lightweight, self-contained email spam and validation plugin for WordPress forms. It scores every submitted email address and blocks or flags the ones that look fake, invalid, or abusive — without sending your visitors’ data to any tracking service.

It never sends your data to the plugin author or to any analytics or tracking service, and it does not require an account or a licence key. One optional feature — live mailbox verification — reaches out to the recipient’s own mail server, and it is on by default — you can turn it off under Settings → Advanced Filters (see External Services below).

Detection layers:

• Syntax – Validates the email format and catches gibberish, keyboard-mash, and obviously fake addresses. Runs locally, always on.
• SMTP mailbox verification (on by default) – Connects to the recipient domain’s mail server and asks whether the mailbox exists. No message is ever sent.
• Behavior & bot signals – Scores mouse, scroll, keyboard and focus activity, a headless-browser (automation) check, keystroke rhythm, and a JavaScript challenge — all collected locally from the page the visitor already loaded, with no network calls or third-party service involved.

Bot protection & security (all local, all free):

• Honeypot & timing – Hidden decoy fields plus a minimum form-fill time catch automated submissions.
• Rate limiting – Throttle how many submissions a single IP can make within a rolling window.
• CAPTCHA (optional) – Invisible Cloudflare Turnstile or Google reCAPTCHA v3, using your own free provider keys.
• Allowlist – Always let trusted domains, exact email addresses, or IP / CIDR ranges through.
• Hide login (optional) – Move wp-login.php to an address of your choice and serve a 404 (or a redirect) at the old one and at /wp-admin/ (WordPress normally bounces logged-out visitors from /wp-admin/ to the login screen, which would give the secret address away), so brute-force bots have nothing to hammer. Every login, logout, lost-password and registration link — including the ones inside WordPress emails — is rewritten for you. Multisite compatible: each site in a network keeps its own address, subdirectory installs get the slug under their own folder, and a single SPAMIFY_HIDE_LOGIN_SLUG constant in wp-config.php can enforce one address network-wide.

Privacy & administration:

• GDPR tools – Automatic daily log purge by retention window, plus optional IP anonymisation.
• Site Health – Built-in WordPress Site Health checks for logging, DNS, and mailbox verification.
• Setup wizard – A guided first-run wizard to get protected in about a minute.
• Dashboard & logs – See what was blocked, flagged, and allowed, with per-day charts, plus a WP Dashboard widget showing today’s and this week’s figures at a glance.
• Review Queue – Every currently-flagged submission — comments, registrations, profile changes, and every connected form — in one screen, instead of scattered across the native Comments/Users screens.
• Timeline – Look up one email address or IP and see its full chronological history across every zone, with the evidence behind every hit.
• Digest reports – A daily, weekly, or monthly summary email, optionally with a CSV report (totals, source breakdown, top offending domains) attached.

Supported forms:

• WordPress core (registration, comments, profile update, lost password, multisite signup)
• Contact Form 7
• WPForms
• Jetpack Forms
• Elementor Forms

Upgrade to Pro

Spamify is free forever on WordPress.org — everything described above runs standalone, with no account, licence key, or nag screens required.

Spamify Pro adds the rest of the detection engine and site-wide protection tools for busier or higher-traffic sites:

• Disposable domain blocking – 100,000+ throwaway and temporary-inbox providers, refreshed automatically.
• IP threat intel & DNSBL – matches the sender’s IP against aggregated abuse feeds and DNS blocklists.
• VPN / proxy / Tor detection – flags anonymised traffic from VPNs, open proxies, Tor exit nodes and datacenter ranges.
• Content analysis – link stuffing, spam keywords, homoglyph and Unicode obfuscation.
• Behavioural reputation – per-sender history layered on top of honeypot and timing.
• Custom rules – your own if-this-then-that logic on any field or signal.
• Network firewall – VPN/Tor/ASN blocking with escalating temporary bans.
• Geo report & country blocking – a world map of where blocked spam comes from, powered by a free offline database.
• Uptime monitor & deliverability tools – scheduled URL checks, bulk email-list verification, and an SPF/DKIM/DMARC checker.
• More integrations – WooCommerce, Gravity Forms, Ninja Forms, Fluent Forms, newsletter opt-ins, and a universal connector for any form.

Plans start at $49/year for up to 3 sites, with Agency and Lifetime options for larger portfolios. Buy Spamify Pro →

External Services

Two features can connect to an external service. SMTP mailbox verification is on by default (you can turn it off under Settings → Advanced Filters); CAPTCHA verification stays off until you enable it and add your own provider keys. Neither sends any data to the plugin author.

1. SMTP mailbox verification (on by default)

When you turn on SMTP Verification (Settings → Advanced Filters), the plugin opens a direct connection to the mail server (MX host) of the recipient email address’s own domain and performs an SMTP handshake to check whether the mailbox exists. What is sent: the email address being validated, sent only to that address’s own mail provider, and only at the moment a form containing that address is submitted or checked. No email message is ever sent, and no data is sent to the plugin author or to any third-party service. Because each address is verified against its own provider’s server, there is no single service, account, terms of service, or privacy policy involved. Turn this feature off under Settings → Advanced Filters if you prefer that submitted addresses are never contacted.

Outbound-port connectivity probe. Many hosts block outbound port 25, which makes mailbox verification impossible. To detect this, the plugin makes a one-off TCP connection to a well-known public mail server — by default Google’s inbound MX, gmail-smtp-in.l.google.com on port 25 — and closes it immediately without sending any data. Only a yes/no “is port 25 open” result is kept (cached for up to a week). This probe runs when SMTP verification is enabled, and when you open the Advanced settings tab or the Tools → Site Health screen (so the status can be shown). No personal data is transmitted. You can change or disable the probe host with the spamify_port25_probe_host filter.

2. CAPTCHA verification (optional, disabled by default)

If you enable CAPTCHA (Settings → Bot Protection) and enter your own provider keys, the visitor’s CAPTCHA token is sent to your chosen provider’s verification endpoint so the provider can confirm the visitor is human:

• Cloudflare Turnstile – token sent to https://challenges.cloudflare.com/turnstile/v0/siteverify. Terms: https://www.cloudflare.com/website-terms/ — Privacy: https://www.cloudflare.com/privacypolicy/
• Google reCAPTCHA v3 – token sent to https://www.google.com/recaptcha/api/siteverify. Terms: https://policies.google.com/terms — Privacy: https://policies.google.com/privacy

Only the CAPTCHA token and the visitor IP are sent, only on form submission, and only if you have configured a provider. This feature is off until you supply keys.