TechGasp

pedroalves

Spam Master delivers powerful, real-time firewall and anti-spam protection for WordPress. Instantly block spam bots, brute force logins, fake registrations, comment spam, and malicious contact form submissions. Spam Master uses live RBL (real-time block lists) with millions of updated threats to keep your site secure.
Key Features: 
– Real-Time Spam Firewall (RBL/Blacklist) 
– Anti-bot, anti-flood, anti-crawler, brute force & DDoS protection 
– Compatible with WooCommerce, Contact Form 7, WPForms, BuddyPress, Gravity Forms, bbPress, Jetpack, Akismet, Ninja Forms, MailChimp, S2Member, MailPoet, Formidable, ConvertKit, ActiveCampaign, and any custom plugin or theme 
– No CAPTCHA, No JavaScript, No AJAX — fast and SEO-friendly 
– GDPR compliant & privacy-focused 
– Modular loading for optimal speed 
– IPv6 & PHP 8 ready
Why Choose Spam Master? 
– Blocks spam before it reaches your site 
– No annoying CAPTCHA or quizzes 
– Advanced honeypot fields for registrations, logins, comments, forms 
– Constant learning from millions of spam sources 
– Professional security logging, analytics & statistics 
– Whitelist management (safe emails/IPs exempted) 
– Customizable block messages
For full features, demo, docs, and support visit <a href="https://www.spammaster.org/" rel="nofollow ugc">Spam Master website</a>.
<h4>Plugin Integrations</h4>
<ul>
<li>WooCommerce: Block spam/fraudulent registrations, custom signatures</li>
<li>BuddyPress: Stops spam registrations/logins, custom signatures</li>
<li>Contact Form 7 & WPForms: Real-time scanning, honeypot & antibot protection</li>
<li>Gravity Forms: Scans data before submission</li>
<li>Akismet Compatibility: Marks missed spam</li>
<li>Custom Forms/Themes: Works with any registration, comment, or contact form</li>
</ul>
<h4>Fast, Secure, SEO-Friendly</h4>
Spam Master loads only what’s needed for security, keeping your site fast and optimized for Google PageSpeed and Lighthouse.
<h4>How It Works</h4>
Spam Master uses updated real-time block lists (RBL), spam buffer tech (for local speed), advanced honeypots, and learning heuristics to block millions of threats instantly.
<h3>Privacy & GDPR</h3>
Spam Master is developed by an EU company and fully complies with GDPR. No data is shared with third parties. <a href="https://www.spammaster.org/privacy-policy/" rel="nofollow ugc">Privacy Policy</a>
<h3>Try Online Demo</h3>
<ul>
<li><a href="https://www.spammaster.org/" rel="nofollow ugc">Spam Master Demo</a></li>
<li><a href="https://www.spammaster.org/search-threat/" rel="nofollow ugc">Search Threat Database</a></li>
<li><a href="https://www.spammaster.org/rbl-servers-status/" rel="nofollow ugc">RBL Cluster Status</a></li>
</ul>

Spam Master


I've tried to use this plugin for several years, but frequently something would go wrong and the author would tell me that there was nothing wrong, until I literally gave them a patch to fix the problem. This happened several times over the years.



More recently, they added a "firewall" feature which degrades performance and increases load on a server (because apparently a firewall should send blocked users a redirect to itself, so you then get 20+ requests to WP for a blocked page, instead of 1 successful request). Furthermore, my clients kept getting many reports from users that the website was inaccessible due to this "firewall".



After contacting the author, they didn't want to add anything in the UI to disable it, but they agreed to add a DB setting that would allow me to disable it. Another release a few weeks later, and they removed that option again, and then pretended we never agreed anything and refused to allow this dumb feature to be disabled.



So, after many years, I've completely given up on this, it will cause all sorts of problems over time and I can't recommend it at all anymore. All I wanted was a simple anti-spam plugin that worked without inline JS.


Includes a mandatory firewall that will block your users

Real-time firewall and anti-spam for WordPress. Block spam bots, comments, logins & registrations. No CAPTCHA, no slowdown.

ZeroBot

ZeroBot Security brings the full ZeroBot antibot platform to WordPress, adding six layered defenses 
managed from a single dashboard. Every event is screened against a 1.5M+ IP intelligence database, 
fingerprint-based scoring, and real-time threat sharing across the ZeroBot network.
<h4>Six Protection Layers</h4>
<ul>
<li>Page Protection — Per-page antibot screening. Renders Cloudflare Turnstile or the ZeroBot 
native slider captcha for borderline visitors before letting them through.</li>
<li>Firewall — Site-wide screening of every public request against the ZeroBot threat database.</li>
<li>Login Brute-Force Guard — Tracks failed logins per IP, auto-blocks after N attempts, 
optionally pushes IPs to your ZeroBot blacklist.</li>
<li>Comment Guard — Blocks bot comments before they’re saved.</li>
<li>REST API Guard — Screens public REST calls (with configurable exempt routes).</li>
<li>XML-RPC Guard — Disables XML-RPC entirely (a major attack vector).</li>
</ul>
<h4>Full Platform Management</h4>
<ul>
<li>Domain Rules — Create, edit, and delete antibot rules from inside wp-admin.</li>
<li>Whitelist — IPs, CIDR ranges, and ASNs scoped per service. Bulk import supported.</li>
<li>Blacklist — Same scoping and bulk import as the whitelist.</li>
<li>Threat Logs — Filterable, paginated viewer of every traffic event with CSV export.</li>
<li>Dashboard — Live stats, 7-day traffic chart, recent threats, account info.</li>
</ul>
<h4>Other Features</h4>
<ul>
<li>Cloudflare / proxy IP detection (CF-Connecting-IP, X-Real-IP, X-Forwarded-For)</li>
<li>Decision cache via WordPress object cache (Redis/Memcached) with transient fallback</li>
<li>Fail-open by default — never breaks your site if the API is unreachable</li>
<li>Daily license verification via wp-cron</li>
<li>WP-admin dashboard widget showing bots/humans (24h)</li>
<li>Pure PHP + vanilla JS — no jQuery, no React, no external CDN</li>
</ul>
<h3>External Services</h3>
This plugin connects to the following third-party service to provide its core bot-detection 
and threat-intelligence features. Nothing is contacted until the administrator enters a 
license key and activates a protection layer.
1. ZeroBot API (https://zerobot.info)
<ul>
<li>What it does: Classifies visitors as human or bot, synchronizes domain rules / whitelists / 
blacklists, and returns threat log data for the dashboard.</li>
<li>When it’s called: On every public request that one of the enabled protection layers handles 
(Firewall, Page Protection, Login Guard, Comment Guard, REST API Guard). Also called from the 
admin dashboard for stats, rules, lists, and traffic logs. Also called once per day by 
wp-cron for license verification.</li>
<li>Data transmitted: Visitor IP address, user agent, current URL host, site domain, and the 
plugin’s license key. No post content, no customer personal data, no form submissions.</li>
<li>What it returns: A JSON decision object (<code>is_bot</code>, <code>reason</code>, <code>risk_score</code>, optional 
 captcha_html), plan metadata, and aggregate stats for the dashboard.</li>
<li>Terms & Privacy: https://zerobot.info/terms — https://zerobot.info/policy</li>
</ul>
2. ZeroBot Fingerprint Collector (https://zerobot.info/fingerprint/index.js)
<ul>
<li>What it does: Collects client-side browser signals (canvas, WebGL, fonts, behavior) to detect 
headless browsers, VMs, and automation frameworks.</li>
<li>When it’s loaded: Injected on public pages and the login screen ONLY when the administrator 
enables “Browser Fingerprint” in Protection Settings. It is disabled by default; the plugin 
does not load any external JavaScript out of the box.</li>
<li>Data transmitted: Browser fingerprint signals and the visitor’s IP address. No WordPress 
user data, no cookies, no form data.</li>
<li>What it returns: A risk score used to decide whether a visitor should face a soft challenge.</li>
<li>Terms & Privacy: https://zerobot.info/terms — https://zerobot.info/policy</li>
</ul>
3. FlagCDN (https://flagcdn.com)
<ul>
<li>What it does: Serves tiny country-flag PNG images for the admin-only traffic log.</li>
<li>When it’s loaded: Only inside wp-admin, only when the administrator opens the Dashboard or 
Threat Logs page. It is never loaded on the public site. Only 2-letter ISO country codes are 
transmitted as part of the image URL.</li>
<li>Data transmitted: The 2-letter country code and standard image-request metadata. No visitor 
data, no WordPress data, no cookies.</li>
<li>Service homepage: https://flagcdn.com</li>
</ul>
If you do not wish to transmit any data to ZeroBot, simply do not activate a license — the 
plugin stays dormant.
<h3>Privacy</h3>
This plugin does not store visitor personal data in your WordPress database beyond IP 
addresses in the local threat-log table (<code>wp_zb_threats</code>, dropped on uninstall). It does 
not set any cookies on visitors. Data sent to the ZeroBot service is described in the 
External Services section above.

ZeroBot Security

Full-stack antibot, firewall, captcha, and threat intelligence for WordPress — powered by the ZeroBot platform.

Spam Master vs ZeroBot Security