Block disposable, burner, and temp-mail addresses on WordPress and WooCommerce sign-ups, comments, checkout, and any custom form. Works fully offline.

Wp Core Tools

<p>This plugin refuses sign-ups, comments, checkouts, and form submissions when the email address belongs to a disposable, burner, or temp-mail service. All checks run on your own server against domain lists that ship inside the plugin file — no email address is ever sent to a third-party service, and the plugin does not contact any external server in its default configuration.</p>
<p>Five well-known community-maintained disposable-email lists are bundled as snapshots. Two are active out of the box (around 9,800 unique domains combined); three larger lists are available as opt-in for stricter coverage. An optional auto-update from the upstream GitHub URLs is also available, off by default.</p>
<h4>What it detects</h4>
<ul>
<li>Disposable and burner addresses (default ON) — Mailinator, YOPmail, Guerrilla Mail, 10minutemail, Temp-Mail, and similar services.</li>
<li>Anonymous / privacy mail (default OFF) — Proton Mail, Tutanota, Mailbox.org, Posteo, StartMail, SimpleLogin, addy.io, DuckDuckGo Email Protection, Firefox Relay, Apple Hide My Email. Off by default because plenty of legitimate paying customers prefer these services.</li>
<li>Plus-addressing aliases (default OFF) — <code>user+tag@example.com</code> style sub-addresses.</li>
<li>Dead and no-MX domains (default OFF) — typos like <code>gnail.com</code>, parked or expired domains. One DNS lookup per new domain, then cached.</li>
<li>Custom block and allow rules with wildcard patterns: <code>*@spammer.com</code>, <code>*@*.ru</code>, <code>spam*@*</code>.</li>
</ul>
<h4>Where it checks</h4>
<p>WordPress core:</p>
<ul>
<li>Registration form</li>
<li>Profile email change</li>
<li>Comment author email (off by default)</li>
<li>Programmatic user creation (<code>wp_insert_user</code>, REST API, WP-CLI, other plugins)</li>
<li>Lost-password form</li>
<li>Multisite signup form</li>
</ul>
<p>WooCommerce:</p>
<ul>
<li>Customer registration</li>
<li>Checkout (billing email)</li>
<li>My Account <span aria-hidden="true" class="wp-exclude-emoji">→</span> Edit Account email change</li>
<li>Product reviews</li>
<li>Coupon application — refuse coupons when the billing email is on a blocklist (anti-abuse safety net)</li>
</ul>
<p>Form plugins:</p>
<ul>
<li>Contact Form 7 — built-in, no configuration needed</li>
<li>Gravity Forms — built-in, no configuration needed</li>
<li>Any other form plugin via the <code>wpcdeg_check</code> filter (one line of PHP from your form’s email-validation hook)</li>
</ul>
<h4>Three modes</h4>
<ul>
<li><strong>Block</strong> — reject the submission with a clear error message.</li>
<li><strong>Flag</strong> — let the submission through, but tag the user / comment / order with <code>wpcdeg_flagged</code> meta so you can review them in a list. Pairs with WooCommerce auto-hold and coupon refusal.</li>
<li><strong>Log only</strong> — record matches in the detection log without rejecting or tagging anything. Useful for a dry-run before turning enforcement on.</li>
</ul>
<h4>Domain lists</h4>
<p>Five bundled snapshots are available, each toggled independently:</p>
<ul>
<li><code>disposable-email-domains</code> (MIT) — ON by default, ~5,400 domains.</li>
<li><code>7c/fakefilter</code> — ON by default, ~4,500 domains.</li>
<li><code>groundcat/disposable-email-domain-list</code> (MIT) — opt-in, ~27,000 domains.</li>
<li><code>wesbos/burner-email-providers</code> (MIT) — opt-in, ~27,000 domains.</li>
<li><code>disposable/disposable-email-domains</code> (MIT) — opt-in, ~72,000 domains.</li>
</ul>
<p>Each ships as a snapshot inside the plugin (<code>data/sources/{id}.txt</code>) and is loaded from disk; no network call is required for any of them to function.</p>
<p>If you want the snapshots refreshed on a schedule from their GitHub raw URLs, an optional auto-update feature is available. It is off by default. See “External services” below for what is contacted and what is sent.</p>
<h4>Tools</h4>
<ul>
<li>Stats dashboard with a 14-day activity chart, per-reason breakdown, and top detected domains.</li>
<li>WP Dashboard widget with the same at-a-glance summary.</li>
<li>Detection log with date / reason / context filters and CSV export.</li>
<li>Optional periodic email digest, daily or weekly.</li>
<li>CSV / TXT bulk import for the blocklist and the allowlist.</li>
<li>Settings JSON export and import for moving configuration between sites.</li>
<li>WP-CLI: <code>wp wpcdeg refresh / test / stats / log / sources / clear-log</code>.</li>
<li>HPOS and Cart/Checkout Blocks compatibility declarations.</li>
</ul>
<h4>Privacy</h4>
<ul>
<li>No email address is ever sent to a third-party service.</li>
<li>The plugin does not contact any external server in its default configuration.</li>
<li>If you enable the optional auto-update feature, the plugin issues HTTPS GET requests to <code>raw.githubusercontent.com</code> for the source URLs you have selected. The request body is empty, the User-Agent is <code>WPCoreToolsDisposableEmailGuard/<version></code>, and no email addresses, user data, or your site URL are transmitted. Full disclosure under “External services” below.</li>
<li>The detection log stores the email address, domain, reason, and IP address locally for admin review. Retention is configurable from 7 to 365 days (default 90); a daily WP-Cron job purges older rows.</li>
<li>On uninstall, all data is deleted only if you turned on the “Delete data on uninstall” setting.</li>
</ul>
<h3>External services</h3>
<p>This plugin can optionally contact one external service. The feature is <strong>off by default</strong> and must be explicitly enabled via the setup wizard or the Lists tab (Settings <span aria-hidden="true" class="wp-exclude-emoji">→</span> WPCoreTools Disposable Email Guard <span aria-hidden="true" class="wp-exclude-emoji">→</span> Lists <span aria-hidden="true" class="wp-exclude-emoji">→</span> “Auto-update from upstream sources”).</p>
<h4>GitHub (raw.githubusercontent.com)</h4>
<ul>
<li><strong>What it is:</strong> GitHub serves the raw source files of five public, community-maintained lists of disposable-email domains. The plugin downloads only the list files; nothing else.</li>
<li><strong>What it is used for:</strong> Refreshing the bundled snapshots of the disposable-email lists you have selected, so your active blocklist stays current between plugin releases.</li>
<li><strong>When data is sent:</strong> Only when the “Auto-update from upstream sources” setting is enabled, and only on the schedule you configure (hourly / twice-daily / daily / weekly), or when you click the “Update now” button on the Lists tab.</li>
<li><strong>What is sent:</strong> One HTTPS GET request per enabled source URL. The request body is empty. The User-Agent is <code>WPCoreToolsDisposableEmailGuard/<plugin-version></code>. No email addresses, user data, IP information beyond what GitHub’s CDN normally logs, or your site URL are transmitted.</li>
<li><strong>Where the requests go:</strong>
<ul>
<li><code>https://raw.githubusercontent.com/disposable-email-domains/disposable-email-domains/main/disposable_email_blocklist.conf</code></li>
<li><code>https://raw.githubusercontent.com/7c/fakefilter/main/txt/data.txt</code></li>
<li><code>https://raw.githubusercontent.com/groundcat/disposable-email-domain-list/master/domains.txt</code></li>
<li><code>https://raw.githubusercontent.com/wesbos/burner-email-providers/master/emails.txt</code></li>
<li><code>https://raw.githubusercontent.com/disposable/disposable-email-domains/master/domains.txt</code></li>
</ul>
</li>
<li><strong>Service operator:</strong> GitHub, Inc.</li>
<li><strong>Terms of service:</strong> https://docs.github.com/en/site-policy/github-terms/github-terms-of-service</li>
<li><strong>Privacy statement:</strong> https://docs.github.com/en/site-policy/privacy-policies/github-general-privacy-statement</li>
</ul>
<p>If you would rather not contact GitHub at all, leave “Auto-update from upstream sources” off (its default state). The bundled snapshots provide full functionality offline.</p>
<p>You may also add your own custom URLs on the Lists tab (e.g. an internal threat-feed URL or a private gist). Those URLs are contacted on the same schedule and follow the same rules; they are entirely under your control.</p>


Alternatives to WPCoreTools Disposable Email Guard

Top alternatives