pontocinza

<p>NoCaptcha Spam Filter for Contact Form 7 provides a deterministic, cache-safe, multi-layered defense against automated form submissions for Contact Form 7 without the need for CAPTCHAs or external libraries.</p>
<p>The plugin uses a combination of:</p>
<ul>
<li>Unique Honeypot: A site-specific hidden field that traps bots.</li>
<li>Cryptographic Signing: Ensures form tokens are genuine and haven’t been tampered with.</li>
<li>Anti-Replay Nonces: Each submission is unique; tokens cannot be reused.</li>
<li>Time-Check Validation: Blocks bots that fill out forms faster than humanly possible.</li>
<li>Cache-Safe Architecture: Automatically detects stale tokens on cached pages and refreshes them via a lightweight REST API fallback.</li>
</ul>
<h3>Scope of Protection</h3>
<p>This plugin is designed to block the vast majority of automated spam submissions (99% of common web crawlers) in Contact Form 7, with zero impact on user experience or performance. However, please note:</p>
<ul>
<li>Not a WAF: It is not a substitute for a Web Application Firewall or server-level security layers for mitigating sophisticated DDoS attacks.</li>
<li>Targeted Attacks: Highly sophisticated bots using headless browsers or manual human bypasses (spam farms) fall outside the scope of lightweight algorithmic protection.</li>
</ul>
<p>For maximum security, we recommend using this plugin as part of a multi-layered defense strategy.</p>
<h3>Configuration (optional, only for advanced users)</h3>
<p>You can override defaults in ‘wp-config.php’:<br />
    <code>php<br />
define('CF7NCSP_DOMAIN_SALT', 'your-random-string');<br />
define('CF7NCSP_TTL', 2400);      // Token lifetime (seconds)<br />
define('CF7NCSP_MIN_TIME', 20);   // Minimum time before submission</code><br />
Recommendations<br />
* Use a long, random string for ‘CF7NCSP_DOMAIN_SALT’<br />
* Keep ‘CF7NCSP_MIN_TIME’ between 10–30 seconds</p>
<h3>Privacy Policy</h3>
<p>This plugin is designed with privacy-first principles:<br />
* No PII Collection: It does not collect, store, or transmit any Personally Identifiable Information (PII).<br />
* No Persistent IP Storage: IP addresses are used transiently for rate limiting and are not stored in plain form or retained beyond a short-lived, temporary cache.<br />
* Local Processing: All validation happens on your server. No data is sent to third-party services.<br />
* Cookieless: The plugin does not set any browser cookies.</p>
<h3>Disclaimer</h3>
<p>This plugin is provided “as is”, without warranty of any kind, express or implied. Use at your own risk. While best efforts have been made to ensure reliability and security, the author is not liable for any damages or losses resulting from its use.</p>
<p>** DEVELOPER’S NOTE: **</p>
<p>This plugin is designed to be a lightweight, “set and forget” solution. It focuses on stability and minimal maintenance, with updates provided as needed for bug fixes and compatibility with WordPress and Contact Form 7. Because it is built to be self-sufficient, please be aware that the developer will not implement non-critical feature requests.</p>


NoCaptcha Spam Filter for Contact Form 7

Honeypot, signed security tokens, and anti-replay protection for Contact Form 7. Built for performance and full-page cache compatibility.

Martín Gómez

RaiolaNetworks

<p><strong>Honeypot Anti-Spam</strong> stops comment spam in WordPress using the honeypot technique – with <strong>no captcha</strong>, no puzzles and nothing for your visitors to solve.</p>
<p>Spam bots automatically fill in a hidden field that real visitors never see. The moment they do, the comment is flagged as spam. The result: cleaner comments, zero friction for genuine users and no annoying CAPTCHA.</p>
<h4>Why Honeypot Anti-Spam?</h4>
<ul>
<li><strong>No captcha</strong> – completely invisible to visitors, nothing to type or click.</li>
<li><strong>Zero configuration</strong> – install, activate, done. There are no settings to touch.</li>
<li><strong>Lightweight and fast</strong> – a tiny script with no bloat and no impact on page speed.</li>
<li><strong>Privacy friendly</strong> – no external services, no tracking, no data leaves your site.</li>
<li><strong>Native WordPress comments</strong> – works out of the box with the standard comment form.</li>
</ul>
<h4>How the honeypot technique works</h4>
<p>The honeypot antispam technique adds a hidden field to your comment form via JavaScript. A legitimate visitor never sees this field and therefore never fills it in. Spam bots, however, detect it and fill it in, so the comment or submission is immediately classified as spam.</p>
<p>Honeypot Anti-Spam has NO options and NO configuration. To get it working you only have to install and activate it. Nothing else.</p>
<ul>
<li><strong><a href="https://raiolanetworks.com/blog/anti-spam-wordpress/" title="Information and support" rel="nofollow ugc">More information and support</a></strong></li>
</ul>
<h3>Bundled by default with</h3>
<p>Raiola Networks WordPress hosting service.</p>


Honeypot Anti-Spam

La mejor alternativa al antiguo plugin anti-spam!

El nuevo Anti-spam

Elección segura contra el SPAM en las páginas web.

Mi (nuevo) plugin de referencia anti-spam


Forget about all the other antispam plugins out there. They are all unnecessarily big. This is just what you need, a simple tool to block the spam for comments.


Just what you need

Stop comment spam in WordPress with the honeypot technique. No captcha, no setup, lightweight and invisible to your visitors.

NoCaptcha Spam Filter for Contact Form 7 vs Honeypot Anti-Spam