John Dalesandro

Most spam filters make your visitors do the work by solving captchas, clicking image grids, or proving they are human before they can leave a comment. Analytical Spam Filter takes a different approach. It analyzes how a submission behaves and blocks spam automatically, with no friction for legitimate visitors.
Key Features
<ul>
<li>No captchas</li>
<li>No API keys</li>
<li>No third-party services</li>
<li>Privacy-friendly design</li>
<li>Behavioral spam detection</li>
<li>IP reputation tracking</li>
<li>Content fingerprinting</li>
<li>Cache-compatible operation</li>
</ul>
Install it, activate it, and it starts working.
Spam is identified by observing behaviors that real visitors naturally exhibit. People take time to read before typing, interact with the page, and use a real browser. Bots often skip those signals. The plugin uses those differences to distinguish legitimate submissions from automated spam without interrupting the user experience.
The plugin uses multiple independent detection techniques on every submission. A bot that bypasses one check is likely to be caught by another. This layered approach improves effectiveness over time. Once a spammer’s IP address or message content has been identified, future attempts can be blocked more quickly. Visitors with a previously approved comment are never flagged, regardless of the spam history associated with their IP address.
No visitor data is sent to external spam services, and no account registration or API configuration is required.
All field names added by the plugin are randomized during installation and can be regenerated at any time. This helps prevent bots from targeting the plugin based on known source code signatures. The plugin is compatible with caching plugins when Cache Compatibility is enabled.
The plugin blocks spam submitted through the default WordPress comment form only. It is also automatically compatible with the Micro Contact Form plugin.
<h4>Blocking Methods</h4>
<ul>
<li>Timestamp Blocking — Records when the page loaded and when the form was submitted. Submissions that arrive too quickly to have genuinely read the page, or after the token has expired, are blocked.</li>
<li>Duration Blocking — Measures how long the visitor actively spent filling out the form. Bots fill forms almost instantly. Requires Cache Compatibility to be enabled.</li>
<li>IP Blocking — Remembers which IP addresses have been blocked before. Once an address reaches the configured threshold, future submissions are flagged without running the remaining checks. IP addresses with a previously approved comment are never flagged.</li>
<li>Content Blocking — Remembers the content of blocked spam. If the same message appears again from a different IP address, it is flagged immediately. Content that matches a previously approved comment is excluded from the spam history.</li>
<li>Honeypot — Adds a hidden field that legitimate visitors never see or interact with. Bots that fill every available field are caught. Submissions where the field is missing entirely are also flagged.</li>
<li>Automated Client Detection — Blocks submissions from automated tools that do not identify themselves as a real browser. Legitimate visitors send this information automatically.</li>
<li>Referer Check — Blocks submissions that did not originate from a page on your own site.</li>
<li>URL / Domain Blocking — Flags submissions containing more URLs or domain names than the configured limit. Spam comments frequently contain multiple links.</li>
<li>JavaScript Check — When Timestamp or Duration Blocking is active, the plugin can determine whether JavaScript ran when the form loaded. Bots that skip JavaScript are caught automatically.</li>
<li>Randomized Field Names — Hidden field names are randomized during installation and can be regenerated at any time from the settings page, so bots cannot target the plugin based on known field names.</li>
<li>Trackback Blocking — Optionally block all trackbacks, which are a common source of spam.</li>
<li>Pingback Blocking — Optionally block all pingbacks, which are a common source of spam.</li>
</ul>
<h4>General Options</h4>
<ul>
<li>Send email notifications for blocked spam, valid submissions, or all submissions</li>
<li>Configurable email rate limit to prevent inbox flooding during attacks</li>
<li>Add spam to the WordPress spam queue, or block and reject it immediately</li>
<li>Optionally show rejection reasons to the submitter</li>
<li>Enable Cache Compatibility for caching plugin support and duration blocking</li>
<li>Regenerate security keys at any time from the settings page</li>
</ul>

Analytical Spam Filter

Stop spam without making your visitors prove they're human. No captchas, no accounts, and no external services required.

Salman Patnee

Contact Form 7 is great at sending emails. It tells you nothing else.
Who saw your form but didn’t submit? Which form has a 3% conversion rate when it should be 20%? Are those “leads” real people or disposable-email bots? CF7 has no answers.
SP Lead Insights fixes that — no Google Analytics, no API keys, no data leaving your server. Install it, activate it, and every CF7 form on your site is tracked from that moment.
Real conversion data. See views, submissions, and conversion rate per form — right in your WordPress dashboard.
Full submission log. Every form entry with date, form name, and delivery status. When a client says they never got a reply, you’ll know in seconds.
Spam blocked at the door. Build an email domain blocklist. Submissions from blocked domains get a validation error — they never reach your inbox. Honeypot protection is on by default.
Private by design. No email addresses, no field values, no names stored. Ever. IPs are stored as one-way hashes that can’t be reversed. Nothing leaves your server.
<h4>Features</h4>
<ul>
<li>View and submission tracking on every CF7 form — automatic, no setup</li>
<li>Conversion rate per form, calculated for you</li>
<li>Dashboard widget — top 5 forms by conversion rate at a glance</li>
<li>Full submission log, sortable by date, form, and status</li>
<li>Email Domain Blocklist — block whole domains with one entry</li>
<li>Blocked Attempts log with timestamps and reasons</li>
<li>Honeypot spam protection, zero configuration</li>
<li>GDPR-safe HMAC-SHA256 IP hashing, keyed to your site’s <code>AUTH_SALT</code></li>
<li>Zero outbound HTTP — nothing phones home</li>
</ul>

SP Lead Insights for Contact Form 7

Know which Contact Form 7 forms convert, catch spam before it hits your inbox, and fix leaking leads — without leaving WordPress.

Analytical Spam Filter vs SP Lead Insights for Contact Form 7