pontocinza

NoCaptcha Spam Filter for Contact Form 7 provides a deterministic, cache-safe, multi-layered defense against automated form submissions for Contact Form 7 without the need for CAPTCHAs or external libraries.
The plugin uses a combination of:
<ul>
<li>Unique Honeypot: A site-specific hidden field that traps bots.</li>
<li>Cryptographic Signing: Ensures form tokens are genuine and haven’t been tampered with.</li>
<li>Anti-Replay Nonces: Each submission is unique; tokens cannot be reused.</li>
<li>Time-Check Validation: Blocks bots that fill out forms faster than humanly possible.</li>
<li>Cache-Safe Architecture: Automatically detects stale tokens on cached pages and refreshes them via a lightweight REST API fallback.</li>
</ul>
<h3>Scope of Protection</h3>
This plugin is designed to block the vast majority of automated spam submissions (99% of common web crawlers) in Contact Form 7, with zero impact on user experience or performance. However, please note:
<ul>
<li>Not a WAF: It is not a substitute for a Web Application Firewall or server-level security layers for mitigating sophisticated DDoS attacks.</li>
<li>Targeted Attacks: Highly sophisticated bots using headless browsers or manual human bypasses (spam farms) fall outside the scope of lightweight algorithmic protection.</li>
</ul>
For maximum security, we recommend using this plugin as part of a multi-layered defense strategy.
<h3>Configuration (optional, only for advanced users)</h3>
You can override defaults in ‘wp-config.php’: 
 <code>php 
define('CF7NCSP_DOMAIN_SALT', 'your-random-string'); 
define('CF7NCSP_TTL', 2400); // Token lifetime (seconds) 
define('CF7NCSP_MIN_TIME', 20); // Minimum time before submission</code> 
Recommendations 
* Use a long, random string for ‘CF7NCSP_DOMAIN_SALT’ 
* Keep ‘CF7NCSP_MIN_TIME’ between 10–30 seconds
<h3>Privacy Policy</h3>
This plugin is designed with privacy-first principles: 
* No PII Collection: It does not collect, store, or transmit any Personally Identifiable Information (PII). 
* No Persistent IP Storage: IP addresses are used transiently for rate limiting and are not stored in plain form or retained beyond a short-lived, temporary cache. 
* Local Processing: All validation happens on your server. No data is sent to third-party services. 
* Cookieless: The plugin does not set any browser cookies.
<h3>Disclaimer</h3>
This plugin is provided “as is”, without warranty of any kind, express or implied. Use at your own risk. While best efforts have been made to ensure reliability and security, the author is not liable for any damages or losses resulting from its use.
** DEVELOPER’S NOTE: **
This plugin is designed to be a lightweight, “set and forget” solution. It focuses on stability and minimal maintenance, with updates provided as needed for bug fixes and compatibility with WordPress and Contact Form 7. Because it is built to be self-sufficient, please be aware that the developer will not implement non-critical feature requests.

NoCaptcha Spam Filter for Contact Form 7

Honeypot, signed security tokens, and anti-replay protection for Contact Form 7. Built for performance and full-page cache compatibility.

Web Guy

<a href="https://github.com/webguyio/dam-spam/issues" rel="nofollow ugc">💬 Ask Question</a> | <a href="mailto:webguywork@gmail.com" rel="nofollow ugc">📧 Email Me</a>
Dam Spam is a spam protection plugin that blocks spam registrations, login attempts, comments, and contact form submissions. It provides multiple layers of protection including IP blocking, email validation, CAPTCHA challenges, and integration with third-party spam detection services.
How it Works
Dam Spam runs a series of configurable checks on registrations, logins, comments, and form submissions. When a submission is flagged as potentially suspicious, you can choose to block it outright or present a CAPTCHA challenge. Legitimate users are cached to speed up future submissions, while known spam sources are permanently blocked.
Features
<ul>
<li>Multiple Protection Layers: Block spam using IP lists, disposable email detection, and behavioral analysis</li>
<li>CAPTCHA Support: Integrate with Google reCAPTCHA or hCaptcha to challenge suspicious submissions</li>
<li>Third-Party API Integration: Connect with Akismet, Stop Forum Spam, BotScout, and other spam detection services</li>
<li>Customizable Challenges: Present challenges only to suspicious users while allowing legitimate users through</li>
<li>Allow and Block Lists: Maintain custom lists of allowed and blocked IPs, emails, and user IDs</li>
<li>Smart Caching: Cache known good and bad IPs to improve performance and reduce API calls</li>
<li>Logging: Track all blocked attempts and approved submissions for review</li>
<li>Custom Login/Registration Forms: Optional custom forms with built-in spam protection</li>
<li>User Management: Identify and manage inactive or suspicious user accounts</li>
</ul>
Configuration
After installation, go to the Dam Spam settings in your WordPress admin to:
<ol>
<li>Enable the protection types you need (registration, login, comments, contact forms)</li>
<li>Choose which spam detection methods to use (IP checks, email validation, third-party APIs)</li>
<li>Configure CAPTCHA settings if desired</li>
<li>Set up allow and block lists for your specific needs</li>
<li>Review logs to fine-tune your protection settings</li>
</ol>
Differences from Stop Spammers
Dam Spam is a fork of <a href="https://wordpress.org/plugins/stop-spammer-registrations-plugin/" rel="ugc">Stop Spammers</a>. While the core spam protection functionality remains similar, Dam Spam’s file and code structure has been significantly cleaned up and modernized.
Addon Support
Dam Spam supports custom spam checks via addons. Create a separate plugin with this structure:
<pre><code><?php
/*
Plugin Name: Dam Spam Addon Example
Description: Custom spam check addon for Dam Spam
Version: 1.0
*/

add_filter( 'dam_spam_addons_block', function( $addons ) {
 $addons[] = array( __FILE__, 'My_Spam_Check' );
 return $addons;
} );

class My_Spam_Check {
 public function process( $ip, &$stats, &$options, &$post ) {
 if ( $ip === '123.45.67.89' ) {
 return 'Blocked by custom check';
 }
 return false;
 }
}
</code></pre>
<ul>
<li>Hook into <code>dam_spam_addons_block</code> or <code>dam_spam_addons_allow</code></li>
<li>Return an array with your file path and class name</li>
<li>Create a class with a <code>process()</code> method</li>
<li>For <code>dam_spam_addons_block</code>: return <code>false</code> to continue checking, or a string to block</li>
<li>For <code>dam_spam_addons_allow</code>: return <code>false</code> to continue checking, or a string to approve</li>
<li>Test using Dam Spam > Testing (spam checks don’t run when logged in)</li>
</ul>

Dam Spam

Spam protection for WordPress registration, login, comments, and contact forms.

NoCaptcha Spam Filter for Contact Form 7 vs Dam Spam