pontocinza

<p>NoCaptcha Spam Filter for Contact Form 7 provides a deterministic, cache-safe, multi-layered defense against automated form submissions for Contact Form 7 without the need for CAPTCHAs or external libraries.</p>
<p>The plugin uses a combination of:</p>
<ul>
<li>Unique Honeypot: A site-specific hidden field that traps bots.</li>
<li>Cryptographic Signing: Ensures form tokens are genuine and haven’t been tampered with.</li>
<li>Anti-Replay Nonces: Each submission is unique; tokens cannot be reused.</li>
<li>Time-Check Validation: Blocks bots that fill out forms faster than humanly possible.</li>
<li>Cache-Safe Architecture: Automatically detects stale tokens on cached pages and refreshes them via a lightweight REST API fallback.</li>
</ul>
<h3>Scope of Protection</h3>
<p>This plugin is designed to block the vast majority of automated spam submissions (99% of common web crawlers) in Contact Form 7, with zero impact on user experience or performance. However, please note:</p>
<ul>
<li>Not a WAF: It is not a substitute for a Web Application Firewall or server-level security layers for mitigating sophisticated DDoS attacks.</li>
<li>Targeted Attacks: Highly sophisticated bots using headless browsers or manual human bypasses (spam farms) fall outside the scope of lightweight algorithmic protection.</li>
</ul>
<p>For maximum security, we recommend using this plugin as part of a multi-layered defense strategy.</p>
<h3>Configuration (optional, only for advanced users)</h3>
<p>You can override defaults in ‘wp-config.php’:<br />
    <code>php<br />
define('CF7NCSP_DOMAIN_SALT', 'your-random-string');<br />
define('CF7NCSP_TTL', 2400);      // Token lifetime (seconds)<br />
define('CF7NCSP_MIN_TIME', 20);   // Minimum time before submission</code><br />
Recommendations<br />
* Use a long, random string for ‘CF7NCSP_DOMAIN_SALT’<br />
* Keep ‘CF7NCSP_MIN_TIME’ between 10–30 seconds</p>
<h3>Privacy Policy</h3>
<p>This plugin is designed with privacy-first principles:<br />
* No PII Collection: It does not collect, store, or transmit any Personally Identifiable Information (PII).<br />
* No Persistent IP Storage: IP addresses are used transiently for rate limiting and are not stored in plain form or retained beyond a short-lived, temporary cache.<br />
* Local Processing: All validation happens on your server. No data is sent to third-party services.<br />
* Cookieless: The plugin does not set any browser cookies.</p>
<h3>Disclaimer</h3>
<p>This plugin is provided “as is”, without warranty of any kind, express or implied. Use at your own risk. While best efforts have been made to ensure reliability and security, the author is not liable for any damages or losses resulting from its use.</p>
<p>** DEVELOPER’S NOTE: **</p>
<p>This plugin is designed to be a lightweight, “set and forget” solution. It focuses on stability and minimal maintenance, with updates provided as needed for bug fixes and compatibility with WordPress and Contact Form 7. Because it is built to be self-sufficient, please be aware that the developer will not implement non-critical feature requests.</p>


NoCaptcha Spam Filter for Contact Form 7

Honeypot, signed security tokens, and anti-replay protection for Contact Form 7. Built for performance and full-page cache compatibility.

Matthias Pfefferle

Bernhard Kau

Pascal Birchler

Simon Kraft

pluginkollektiv

websupporter

Torsten Landsiedel

Florian Brinkmann

Alain Schlesser

<p>Say Goodbye to comment spam on your WordPress blog or website. <em>Antispam Bee</em> blocks spam comments and trackbacks effectively, without captchas and without sending personal information to third party services. It is free of charge, ad-free and 100% GDPR compliant.</p>
<h3>Feature/Settings Overview</h3>
<ul>
<li>Trust approved commenters.</li>
<li>Trust commenters with a Gravatar.</li>
<li>Consider the comment time.</li>
<li>Allow comments only in a certain language.</li>
<li>Block or allow commenters from certain countries.</li>
<li>Treat BBCode links as spam.</li>
<li>Use regular expressions.</li>
<li>Search local spam database for commenters previously marked as spammers.</li>
<li>Notify admins by e-mail about incoming spam.</li>
<li>Delete existing spam after n days.</li>
<li>Limit approval to comments/pings (will delete other comment types).</li>
<li>Select spam indicators to send comments to deletion directly.</li>
<li>Optionally exclude trackbacks and pingbacks from spam detection.</li>
<li>Optionally spam-check comment forms on archive pages.</li>
<li>Display spam statistics on the dashboard, including daily updates of spam detection rate and a total of blocked spam comments.</li>
</ul>
<h3>Support</h3>
<ul>
<li>Community support via the <a href="https://wordpress.org/support/plugin/antispam-bee" rel="ugc">support forums on wordpress.org</a></li>
<li>Read <a href="https://antispambee.pluginkollektiv.org/documentation/" rel="nofollow ugc">the documentation</a></li>
<li>We don’t handle support via e-mail, Twitter, GitHub issues etc.</li>
</ul>
<h3>Contribute</h3>
<ul>
<li>Active development of this plugin is handled <a href="https://github.com/pluginkollektiv/antispam-bee" rel="nofollow ugc">on GitHub</a>.</li>
<li>Pull requests for documented bugs are highly appreciated.</li>
<li>If you think you’ve found a bug (e.g. you’re experiencing unexpected behavior), please post at the <a href="https://wordpress.org/support/plugin/antispam-bee" rel="ugc">support forums</a> first.</li>
<li>If you want to help us translate this plugin you can do so <a href="https://translate.wordpress.org/projects/wp-plugins/antispam-bee" rel="nofollow ugc">on WordPress Translate</a>.</li>
</ul>
<h3>Credits</h3>
<ul>
<li>Author: <a href="https://sergejmueller.github.io/" rel="nofollow ugc">Sergej Müller</a></li>
<li>Maintainers: <a href="https://pluginkollektiv.org" rel="nofollow ugc">pluginkollektiv</a></li>
</ul>


Antispam Bee

I have been using this for several years now and not had a single issue with spam.

lightweight and awesome.

Thank you.

The best antispam plugin


Using it since years and had no spam in my blog ever. Simple, clean, works.


Best Antispam Plugin


I've tested this plugin and seems to working very well. Most spam comments are gone, some of them (just a little) are able to avoid spam filters.



There is something need to be fixed and I'm already posted in support forum. I hope that it will be fixed soon.


Very good spam filter plugin.


Works quite well without calling out to a remote service, and doesn't require your visitors to be using JavaScript. (Seriously, I posted a test comment using Dillo and it showed up in the moderation queue!) No need to deal with API keys or licensing.



There are some optional tactics that will call a remote service for things like language identification, but so far it's doing the job fine without them!



The only problem I've had with it is that it only acts on comments, not on other features like contact forms.


Privacy-friendly spam filter


Simple to set up and use. Catches all the spam and deletes it before I get a chance to see it. Might miss one or two pieces a week, but that's still better than JetPack and it preserves my users' privacy.


Works better than JetPack


This is an amazing free plugin!What a mental dysfunction to generate spam, what a waste of resources, time, attention.Antispam Bee does a great job, for free.Thank you!


Spam pest...

Sophisticated antispam plugin for effective daily comment and trackback spam-fighting. Built with data protection and privacy in mind.

NoCaptcha Spam Filter for Contact Form 7 vs Antispam Bee