Stackedboost Signup Guard – Block Disposable Emails on Registration and Comments

Stackedboost Signup Guard stops throwaway and temporary email addresses at two points in WordPress: account registration (registration_errors) and comment submission (preprocess_comment). When someone tries to sign up or comment with an address from a known disposable domain, the plugin refuses it and shows a message you can edit. The point is fewer fake accounts, less registration spam and less comment spam, without adding a captcha and without sending anything to an outside service.

8,201 known throwaway domains are bundled with the plugin. The list ships as a plain text file inside the plugin folder and is only read into memory when an address actually needs checking, on a registration or a comment. No network request is made at any point, for any reason. There is no account to create, no API key to enter, and no external service involved. The check runs on your own server, on data that is already on the form.

Subdomains are matched too. Blocking example.com also blocks mail.example.com, test.example.com, and so on, because the plugin walks the domain from the right and checks each level.

You can add your own list of domains to always block, and a separate list of domains to always allow. The allow list wins over everything, including the bundled list, so if this plugin ever turns away a real person using a forwarding or privacy address, you add their domain there and they are never blocked again.

Anyone who can moderate comments on your site is exempt from every check, so an editor testing the registration form is never blocked by their own plugin.

Settings > Signup Guard is a dashboard, not just a form. It shows how many sign-ups and comments were refused in total and at each form, a 30 day chart, the domains refused most often, and the last 20 refusals. Only domains are stored, never email addresses, because the domain is all that is needed to see the plugin is working and to decide whether to add it to the allow list. All of it is kept in a few WordPress options on your own site, with no extra database table.

This plugin deliberately does not touch WooCommerce checkout or WooCommerce account registration. A sibling plugin, Stackedboost Email Guard, covers those forms. Two plugins checking the same field would show a shopper the same complaint twice, so this one stays out of WooCommerce entirely and only guards the WordPress core forms.

What it cannot do

This is a filter against a known list, not a defense against a determined person. Someone who wants to get past it can register a fresh domain of their own, or use a throwaway mail host that has not been added to any list yet. What this plugin does well is cut the casual bot registrations and spam signups that use the same handful of well known disposable services. It will not stop someone who is actually trying to get around it.

Signup Guard Pro (optional, paid)

The bundled list only changes when this plugin updates, and new throwaway services keep appearing. Signup Guard Pro is a separate add-on, sold on stackedboost.com, that checks each sign-up and comment the bundled list lets through against a live list of more than 160,000 throwaway domains, refreshed daily, and refuses domains that do not exist. Everything described above works without it, and this plugin contains no Pro code and no locked features. It only provides a filter, sbsg_check_result, that the add-on uses.

Where the bundled list comes from

The bundled list is built from the disposable-email-domains project, an open source list dedicated to the public domain under CC0 1.0. Credit belongs to that project and its contributors. This plugin packages a copy of the list, it did not compile it.