Rabbit Builds

<p>Rabbit Builds Anti-Spam Comment Shield is a fast, reliable anti-spam plugin for the <strong>default WordPress commenting system</strong>. It blocks automated bot submissions using layered validation, while keeping the experience clean for real visitors.</p>
<p>Developed and maintained by <a href="https://rabbitbuilds.com/" rel="nofollow ugc">Rabbit Builds</a> — visit our website to explore more WordPress tools and solutions.</p>
<h3>Important</h3>
<ul>
<li>Clear your page cache after activation or after changing plugin settings.</li>
<li>Works with the default WordPress comment form only (not AMP comment forms).</li>
</ul>
<h4>Features</h4>
<ul>
<li>🛡️ <strong>Hash-Based Verification</strong> — Blocks bots by hiding the comment form action URL</li>
<li>🍯 <strong>Honeypot Trap</strong> — Hidden field that catches bots filling every input</li>
<li>⏱️ <strong>Time-Based Check</strong> — Rejects comments submitted too quickly</li>
<li>🔒 <strong>REST API Protection</strong> — Blocks unauthenticated REST API comments</li>
<li>📊 <strong>Spam Statistics Dashboard</strong> — Real-time total & daily blocked spam counter</li>
<li>⚙️ <strong>Modern Settings Page</strong> — Beautiful card-based UI with toggle switches</li>
<li>🔔 <strong>Admin Bar Counter</strong> — See blocked spam count in the admin bar</li>
<li>✏️ <strong>Custom Block Message</strong> — Personalize the blocked spam response</li>
<li>100% GDPR Compliant — No external requests, no cookies, no tracking</li>
<li>Captcha-Free — Completely invisible to your visitors</li>
<li>~200 bytes inline JavaScript — Zero performance impact</li>
<li>Compatible with all page caching and performance optimization plugins</li>
</ul>
<h4>How does it work?</h4>
<ol>
<li>The plugin removes the comment form action URL from raw HTML output.</li>
<li>When real user interaction is detected (scroll, mouse move, touch, or focus), JavaScript restores the action URL with a unique hash token.</li>
<li>On submit, the server validates the hash token, checks the honeypot field, and verifies submission timing.</li>
<li>If any check fails, the request is blocked with a 403 response before spam can reach your database.</li>
</ol>
<h3>License</h3>
<p>This plugin is licensed under <strong>GPL-2.0-or-later</strong>.<br />
You may use, modify, and redistribute it under the terms of the GNU General Public License.</p>


Rabbit Builds Anti-Spam Comment Shield

Advanced, lightweight, GDPR-compliant anti-spam protection for WordPress comments. No setup required.

ThreatPoint UK

<p>This plugin validates email in realtime using live connections and aggregated data, by leveraging the ThreatPoint email verification API service. One use of this is to prevent spam bots inputting content into comments, easily and effectively</p>
<h3>External Service</h3>
<p>This plugin allows administrators include email validation using a real time verification service provided by the ThreatPoint email verification API.<br />
The Plugin uses existing is_email functionality and passes manually entered email addresses to the restAPI service at ThreatPoint.<br />
The response back from the ThreatPoint API provides information related to the email validity(valid email, valid domain, disposable, free, role, risk score). Automatically stop spam bots from entering comments onto your posts by verifying the email address first.</p>
<p>The plugin calls the rest API (requires an API KEY) at <a href="https://verify.threatpoint.co.uk/api/v1/resources/" rel="nofollow ugc">this ThreatPoint api endpoint</a><br />
The rest API is only passed the email address from the contact form via the is_email function.<br />
This external service is called whenever a form using is_email is used. By default the Contact Form 7 is supported. You can include any form field name (email address field) in the plugin to override the default.<br />
An API key is required to utilise the service, although the plugin will operate without one it will not be able to pass the email address or call any data from the API.<br />
Your email addresses will not be validated without a valid API key.</p>
<h3>Privacy Policy</h3>
<p>The privacy policy for the api services is viewable here <a href="https://threatpoint.co.uk/privacy-policy" rel="nofollow ugc">privacy policy</a><br />
This plugin only passes the email address information – no other PII is transferred. The email address is analysed across the aggregated data within the ThreatPoint email verification reputation service and a risk score with email properties (valid, free, role, disposable) to the plugin. Simple rules within the plugin dictate whether the email address is considered valid(set through the plugin settings). The email address is stored in the email address aggregated data and used as part of email address consortium for all customers. No other data such as originating website is stored. Only the email address  is held, with date, time and risk scores associated with the request.</p>
<h3>Plugin Features</h3>
<ul>
<li>Validates email addresses in real time including:</li>
<li>Valid email</li>
<li>Valid domain</li>
<li>Disposable Addresses (One time Use)</li>
<li>Role/Group Addresses</li>
<li>Free Email Addresses</li>
<li>Breached Email Addresses</li>
<li>Email Addresses known to be high risk (spam)</li>
<li>API Documentation is available here: <a href="https://threatpoint.co.uk/documentation" rel="nofollow ugc">documentation</a></li>
<li>Video is here <span class="embed-youtube" style="text-align:center; display: block;"><iframe loading="lazy" class="youtube-player" width="750" height="422" src="https://www.youtube.com/embed/YD9CAx4f3FM?version=3&rel=1&showsearch=0&showinfo=1&iv_load_policy=1&fs=1&hl=en-US&autohide=2&wmode=transparent" allowfullscreen="true" style="border:0;" sandbox="allow-scripts allow-same-origin allow-popups allow-presentation allow-popups-to-escape-sandbox"></iframe></span></li>
</ul>
<h3>Special Features</h3>
<ul>
<li>Provide real time email validation and decisions through configuration to allow an administrator the correct flow for their site.</li>
</ul>
<h3>Configuration Items</h3>
<ul>
<li>API Key – An API key is required to access the email address validation service as explained above – (api@threatpoint.co.uk)</li>
<li>Blacklisted domains – a list of domains that you would not wish to have entered into your forms</li>
<li>Email Field Name – the field name to pick the email address values from. Defaults to ‘your-email’ which is the contact form 7 default</li>
<li>Allow Free Email addresses?  – Option to allow or deny free email addresses (gmail, yahoo, hotmail etc.)</li>
<li>Allow disposable Email addresses? – Option to allow or deny one time use email addresses</li>
<li>Allows Role/Group Email Addresses? – Option to allow role and group email addresses (sales@company.com) for example</li>
</ul>
<h3>Localization</h3>
<ul>
<li>English (default) – only language currently supported</li>
</ul>
<h3>Feedback</h3>
<ul>
<li>Many thanks for taking the time to look at the plugin</li>
<li>Drop the ThreatPoint team a line <a href="http://twitter.com/#!/threatuk" rel="nofollow ugc">@threatuk</a> on Twitter</li>
<li>Email questions or suggestions via (info@threatpoint.co.uk)</li>
<li>Api key requests via info@threatpoint.co.uk</li>
</ul>
<h3>Translations</h3>
<ul>
<li>English – default, currently the only language supported</li>
</ul>
<h3>Contributors & Developers</h3>
<ul>
<li>The ThreatPoint team are often asked to investigate attacks on web sites and other services. More often than not these attacks begin from IP addresses that should be considered before access is granted.</li>
<li>ThreatPoint UK provide IP reputation, email verification, device reputation, dark web monitoring and password monitoring services as part of the API service layer. Please contact info@threatpoint.co.uk to find out more about these additional services.</li>
<li>The ThreatPoint IP Reputation WordPress plugin is also available from the WordPress official site.</li>
</ul>
<h3>Credits</h3>
<ul>
<li>Many credits go to the fraud and analytics team at ThreatPoint UK and the team behind the API services</li>
<li>Credits to numerous wordpress tutorials used to understand the plugin creation process. notably this article https://www.sitepoint.com/real-world-example-wordpress-plugin-development/</li>
</ul>


ThreatPoint Email Validator

This plugin validates email in realtime using live connections and aggregated data, by leveraging the ThreatPoint email verification API service.

Rabbit Builds Anti-Spam Comment Shield vs ThreatPoint Email Validator