randomoutputs

<p>The quickest and GDPR-compliant Anti-Spam Protection plugin to prevent bot spam comments in the Default Commenting System of WordPress.</p>
<h4>Features of Ninja Spam Protection</h4>
<ul>
<li>100% effective.</li>
<li>No settings are required at all.</li>
<li>Non-Captcha solution.</li>
<li>Fully Automatic.</li>
<li>100% GDPR Compliant.</li>
<li>Fastest Spam Protection like a Ninja.</li>
<li>Compatible with all page caching and performance optimization plugins.</li>
</ul>
<h4>How Does Ninja Spam Protection Works?</h4>
<p>To prevent spamming of comments, the default action path (wp-comments-post.php) is blocked for users and clickable over a unique hash key when a visitor scrolls to leave a comment. Doing so prevents comment spamming that can be done by bots.</p>
<h3>Installation of Ninja Spam Protection</h3>
<p>Install “Ninja Spam Protection” Plugin Manually</p>
<ol>
<li>Download the “Ninja Spam Protection” Plugin</li>
<li>Upload <code>Ninja Spam Protection</code> to the <code>/wp-content/plugins/</code> directory</li>
<li>Activate the plugin through the ‘Plugins’ menu in WordPress</li>
<li>If you are using any page cache plugin, make sure to purge/clear the cache.</li>
</ol>
<p>Install Ninja Spam Protection Plugin from WordPress Dashboard</p>
<ol>
<li>Go to Plugins menu > Add new</li>
<li>Search for “Ninja Spam Protection”</li>
<li>Activate the plugin through the ‘Plugins’ menu in WordPress</li>
<li>If you are using any page cache plugin, make sure to purge/clear the cache.</li>
</ol>
<h3>Changelog of Ninja Spam Protection</h3>
<h4>1.0.0</h4>
<ul>
<li>Initial Release</li>
</ul>


Ninja Spam Protection

The ultimate solution to prevent spam comments like a ninja on the default commenting system for WordPress in WordPress.

OptionWeb

<p>OW Forms is a modern WordPress form builder for sites that prioritize performance, accessibility, and GDPR compliance. Built by OptionWeb for production use on client sites, it ships with a JSON-driven schema engine, a REST-based submission pipeline, and a curated set of 16 field types — text, email, tel, URL, number, textarea, select, radio, checkbox, checkbox-group, date, time, datetime, file upload, hidden, and rating — plus auto-injected GDPR consent and anti-spam fields.</p>
<p>The anti-spam stack runs four layers in parallel: a visually-hidden honeypot input that bots fill but humans never see, a time-trap that rejects submissions completed faster than a configurable threshold, a multi-provider CAPTCHA layer (Cloudflare Turnstile, Google reCAPTCHA v3, hCaptcha, or Friendly Captcha), and optional OW Shield IP reputation scoring with a disposable-email blocklist. Every signal is logged so you can tune thresholds without flying blind. Submissions that score above 80 are silently rejected — no error message, no honeypot leak.</p>
<p>GDPR compliance is native, not bolted on. Every form gets a consent checkbox linked to your privacy policy, IP addresses can be stored pseudonymized or not at all, user agents are SHA-256 hashed by default, and a daily cron purges submissions older than your retention window (CNIL default: 1095 days). When OW Consent is active, OW Forms wires into its DSAR endpoint — erasure requests automatically delete matching submissions by email hash, with full audit trail. Submission emails are SHA-256 hashed with a plugin-owned salt (option <code>owfo_dsar_salt</code>, generated once at activation) so the database never holds plaintext PII linkable across systems, and DSAR erasure keeps working even after <code>wp config shuffle-salts</code>.</p>
<p>The one-click Contact Form 7 importer parses every CF7 form in your database, builds the equivalent OW Forms schema (preserving recipient, subject, and field types), and rewrites every <code>[contact-form-7 id="..."]</code> shortcode in your posts to <code>[owfo_form id="..."]</code>. Email notifications support HTML or plain text with <code>{{token}}</code> interpolation, optional auto-reply, signed outbound webhooks (HMAC-SHA256), and a Gutenberg block in addition to the shortcode and REST API.</p>
<h3>External services</h3>
<p>OW Forms relies on optional third-party CAPTCHA services to protect form submissions<br />
from spam. <strong>None of these services are contacted unless you explicitly enable a<br />
CAPTCHA provider in OW Forms <span aria-hidden="true" class="wp-exclude-emoji">→</span> Settings <span aria-hidden="true" class="wp-exclude-emoji">→</span> Anti-spam.</strong></p>
<p>The OW Shield integration is fully local — when the OW Shield plugin is installed<br />
and active on the same site, OW Forms reads its IP reputation score from the local<br />
database/cache. No request leaves your server for this lookup; OW Shield itself<br />
may contact its own reputation service, which is disclosed in the OW Shield readme.</p>
<p>The Friendly Captcha widget JavaScript is bundled with OW Forms under<br />
    assets/js/vendor/ (no external CDN is hit at page render). Source: the upstream<br />
MIT-licensed package at https://github.com/FriendlyCaptcha/friendly-challenge —<br />
the files shipped here are the official npm <code>friendly-challenge@0.9.18</code> build<br />
outputs (<code>widget.module.js</code> and <code>widget.module.min.js</code>, unmodified, renamed to<br />
    friendly-challenge-0.9.18.module.js / <code>friendly-challenge-0.9.18.module.min.js</code><br />
to make the version explicit in the filename). Both the minified and the<br />
human-readable non-minified source are shipped per WordPress.org Plugin Check<br />
requirements.</p>
<p>When a CAPTCHA provider is enabled, OW Forms loads the vendor’s JavaScript widget<br />
on pages that render a form, and posts the challenge solution back to the vendor’s<br />
verification API when a visitor submits the form. The data sent to the vendor is<br />
limited to: (a) the challenge token generated client-side by the vendor’s widget,<br />
(b) the visitor’s IP address (passed through to the vendor for fraud scoring), and<br />
(c) the site’s API secret key configured in the settings.</p>
<h4>Cloudflare Turnstile</h4>
<ul>
<li>What it is: a CAPTCHA / bot-mitigation service by Cloudflare, Inc.</li>
<li>When data is sent: only when <code>spam_captcha_provider</code> is set to <code>turnstile</code>, and<br />
only on form submission. The widget JS is also loaded on every page that renders<br />
a form.</li>
<li>Data sent: Turnstile challenge token, visitor IP, your Turnstile secret key.</li>
<li>Terms of service: https://www.cloudflare.com/website-terms/</li>
<li>Privacy policy: https://www.cloudflare.com/privacypolicy/</li>
</ul>
<h4>Google reCAPTCHA v3</h4>
<ul>
<li>What it is: an invisible CAPTCHA / risk-scoring service by Google LLC.</li>
<li>When data is sent: only when <code>spam_captcha_provider</code> is set to <code>recaptcha_v3</code>, and<br />
only on form submission. The widget JS is also loaded on every page that renders<br />
a form (this is how reCAPTCHA v3 builds its risk score).</li>
<li>Data sent: reCAPTCHA token, visitor IP, your reCAPTCHA secret key. Google may<br />
also collect additional telemetry as described in their privacy policy.</li>
<li>Terms of service: https://policies.google.com/terms</li>
<li>Privacy policy: https://policies.google.com/privacy</li>
</ul>
<h4>hCaptcha</h4>
<ul>
<li>What it is: a privacy-focused CAPTCHA service by Intuition Machines, Inc.</li>
<li>When data is sent: only when <code>spam_captcha_provider</code> is set to <code>hcaptcha</code>, and<br />
only on form submission. The widget JS is also loaded on every page that renders<br />
a form.</li>
<li>Data sent: hCaptcha token, visitor IP, your hCaptcha secret key.</li>
<li>Terms of service: https://www.hcaptcha.com/terms</li>
<li>Privacy policy: https://www.hcaptcha.com/privacy</li>
</ul>
<h4>Friendly Captcha</h4>
<ul>
<li>What it is: a privacy-first, proof-of-work CAPTCHA service by Friendly Captcha GmbH<br />
(Germany). No user puzzle, no tracking cookies.</li>
<li>When data is sent: only when <code>spam_captcha_provider</code> is set to <code>friendly_captcha</code>,<br />
and only on form submission. The widget JS itself is bundled with OW Forms (not<br />
loaded from an external CDN); only the verification request reaches the vendor.</li>
<li>Data sent: Friendly Captcha challenge token, visitor IP, your Friendly Captcha<br />
secret key.</li>
<li>Terms of service: https://friendlycaptcha.com/legal/terms/</li>
<li>Privacy policy: https://friendlycaptcha.com/legal/privacy-end-users/</li>
</ul>
<h4>Outgoing webhook (admin-configured)</h4>
<ul>
<li>What it is: a URL of your choosing that OW Forms POSTs to after each submission.<br />
No data leaves your site until you fill the <code>webhook_url</code> setting in OW Forms <span aria-hidden="true" class="wp-exclude-emoji">→</span><br />
Settings <span aria-hidden="true" class="wp-exclude-emoji">→</span> Notifications.</li>
<li>When data is sent: on every form submission, immediately after the admin<br />
notification email is dispatched. Non-blocking — your visitor’s submission<br />
response is not delayed by the webhook endpoint’s latency.</li>
<li>Data sent: form id, submission id, sanitized field payload (the same data<br />
stored in your <code>wp_owfo_submissions</code> table), site URL, ISO 8601 timestamp.<br />
If a webhook secret is configured, an <code>X-OWFO-Signature</code> HMAC-SHA256 header<br />
is added so the receiver can verify the payload origin.</li>
<li>Vendor: whoever owns the URL you configured. OW Forms has no built-in vendor<br />
for this — it is your responsibility to ensure the receiving endpoint complies<br />
with applicable privacy regulations for your submissions.</li>
</ul>


OW Forms

Modern, lightweight WordPress form builder with native GDPR compliance, anti-spam stack, and Contact Form 7 importer.

Ninja Spam Protection vs OW Forms