Alexandre Amato

SpamAnvil is a free, open-source WordPress anti-spam plugin that uses artificial intelligence to block comment spam. Unlike Akismet (which requires a paid plan for commercial sites) or simple keyword-based filters, SpamAnvil leverages large language models (LLMs) to actually understand your comments and detect even the most sophisticated spam.
Traditional spam filters rely on static word lists and link counting. Spammers have evolved. SpamAnvil fights back with AI that understands context, intent, and language patterns – catching spam that looks legitimate and approving real comments that others would flag.
<h4>Why SpamAnvil?</h4>
<ul>
<li>100% Free – No premium tier, no subscription, no hidden costs. Bring your own API key (free options available).</li>
<li>Smarter Than Rules – AI understands context. A comment about “buying a new home” won’t be flagged just because it contains “buy”.</li>
<li>Works With Free AI Models – Use OpenRouter’s free Llama models for $0 cost, or connect premium models for maximum accuracy.</li>
<li>Privacy-First – Your data stays between you and your chosen AI provider. IP addresses are stored as irreversible SHA-256 hashes. GDPR/LGPD compliant by design.</li>
<li>No Cloud Lock-in – Choose from 6+ AI providers. Switch anytime. Your anti-spam, your rules.</li>
</ul>
<h4>Supported AI Providers</h4>
<ul>
<li>OpenAI (GPT-4o-mini, GPT-4o, etc.)</li>
<li>Anthropic Claude (Claude Sonnet, Haiku, etc.)</li>
<li>Google Gemini (Gemini 2.0 Flash, Pro, etc.)</li>
<li>OpenRouter (100+ models, including FREE ones)</li>
<li>Featherless.ai (Open-source models)</li>
<li>Any OpenAI-compatible API (LM Studio, Ollama via proxy, vLLM, etc.)</li>
</ul>
<h4>Key Features</h4>
<ul>
<li>AI-Powered Spam Detection – Each comment is analyzed by an LLM that scores it 0-100 for spam probability</li>
<li>Intelligent Heuristics Engine – Pre-analyzes comments with regex patterns, spam word detection, URL counting, and prompt injection detection to catch obvious spam without API calls</li>
<li>Async Background Processing – Comments are queued and processed via WP-Cron so your site stays fast</li>
<li>Smart IP Blocking – Automatically blocks repeat offenders with escalating ban durations (24h, 48h, 96h…)</li>
<li>Automatic Retry with Backoff – Failed API calls retry up to 3 times with exponential delays</li>
<li>Encrypted API Key Storage – AES-256-CBC encryption for all stored API keys. Optional wp-config.php constants for maximum security</li>
<li>Statistics Dashboard – Track how many comments were checked, how much spam was caught, API usage and errors</li>
<li>Full Evaluation Logs – See the AI’s reasoning for every comment scored, with provider, model, response time, and score</li>
<li>Customizable AI Prompts – Full control over what the AI is instructed to do</li>
<li>Fallback Provider – Configure a backup AI so spam checking never stops</li>
<li>Prompt Injection Defense – Multi-layered protection prevents attackers from manipulating the AI through crafted comments</li>
<li>Configurable Spam Threshold – Slide between aggressive (catch more spam) and permissive (fewer false positives)</li>
<li>Moderator Bypass – Trusted users skip spam checking entirely</li>
</ul>
<h4>How It Works</h4>
<ol>
<li>A visitor submits a comment</li>
<li>SpamAnvil checks if the IP is blocked from previous spam attempts</li>
<li>The heuristic engine runs a quick pre-analysis (URL count, spam words, suspicious patterns)</li>
<li>If the heuristic score is very high, the comment is instantly marked as spam – no API call needed</li>
<li>Otherwise, the comment is queued for AI analysis (or processed immediately in sync mode)</li>
<li>The AI analyzes the comment in context (post title, author info, heuristic data) and returns a spam score</li>
<li>Comments scoring above your threshold are marked as spam; clean comments are auto-approved</li>
<li>Repeat offender IPs are automatically blocked with escalating durations</li>
</ol>
<h4>Use Cases</h4>
<ul>
<li>Blogs receiving hundreds of spam comments per day</li>
<li>WooCommerce stores where comment spam affects SEO and credibility</li>
<li>Membership sites that need to protect community discussions</li>
<li>Multilingual sites – AI understands comments in any language, unlike keyword-based filters</li>
<li>High-traffic sites – Async processing handles any volume without slowing down your site</li>
<li>Sites tired of Akismet – Free alternative with no cloud dependency and full data control</li>
</ul>
<h4>Security</h4>
SpamAnvil follows WordPress security best practices throughout:
<ul>
<li>AES-256-CBC encrypted API key storage</li>
<li>wp-config.php constant support for API keys (never touch the database)</li>
<li>Nonce verification on all forms and AJAX requests</li>
<li>Capability checks on all admin actions</li>
<li>Prepared SQL statements on every database query</li>
<li>Output escaping on all rendered content</li>
<li>Prompt injection defense: boundary tags, system prompt hardening, heuristic injection detection, strict JSON validation, temperature 0</li>
</ul>
<h4>Languages</h4>
<ul>
<li>English (default)</li>
<li>Translation-ready (.pot file included)</li>
</ul>
<h4>Third-Party Services</h4>
SpamAnvil sends comment data (content, author name, email, and URL) to external AI services for spam analysis. The specific service used depends on your configuration. No data is sent until you configure and enable a provider.
<ul>
<li>OpenAI — <a href="https://openai.com" rel="nofollow ugc">https://openai.com</a> — <a href="https://openai.com/policies/terms-of-use" rel="nofollow ugc">Terms of Use</a> — <a href="https://openai.com/policies/privacy-policy" rel="nofollow ugc">Privacy Policy</a></li>
<li>Anthropic (Claude) — <a href="https://www.anthropic.com" rel="nofollow ugc">https://www.anthropic.com</a> — <a href="https://www.anthropic.com/policies#terms" rel="nofollow ugc">Terms of Service</a> — <a href="https://www.anthropic.com/policies#privacy" rel="nofollow ugc">Privacy Policy</a></li>
<li>Google Gemini — <a href="https://ai.google.dev" rel="nofollow ugc">https://ai.google.dev</a> — <a href="https://ai.google.dev/gemini-api/terms" rel="nofollow ugc">Terms of Service</a> — <a href="https://policies.google.com/privacy" rel="nofollow ugc">Privacy Policy</a></li>
<li>OpenRouter — <a href="https://openrouter.ai" rel="nofollow ugc">https://openrouter.ai</a> — <a href="https://openrouter.ai/terms" rel="nofollow ugc">Terms of Service</a> — <a href="https://openrouter.ai/privacy" rel="nofollow ugc">Privacy Policy</a></li>
<li>Featherless.ai — <a href="https://featherless.ai/" rel="nofollow ugc">https://featherless.ai</a> — <a href="https://featherless.ai/terms" rel="nofollow ugc">Terms of Service</a> — <a href="https://featherless.ai/privacy" rel="nofollow ugc">Privacy Policy</a></li>
</ul>
When using the “Generic OpenAI-Compatible” option, data is sent to the URL you configure. You are responsible for ensuring compliance with the privacy policies of your chosen service.

SpamAnvil

Stop comment spam with AI. Uses ChatGPT, Claude, Gemini and other LLMs to catch spam that traditional filters miss. 100% free.

SpamAnvil vs AI