ayushtruelist

<p><strong>Truelist Email Validator</strong> connects your WordPress site to the <a href="https://truelist.io" rel="nofollow ugc">Truelist</a> email validation API. It checks every email address submitted through your forms before it enters your database — blocking invalid, disposable, and fake addresses at the point of entry.</p>
<h4>Why validate emails?</h4>
<ul>
<li>Reduce bounce rates on your mailing lists</li>
<li>Keep your CRM and contact database clean</li>
<li>Stop disposable email signups (Mailinator, Guerrilla Mail, etc.)</li>
<li>Prevent fake registrations and comment spam</li>
</ul>
<h4>What gets validated</h4>
<ul>
<li><strong>Invalid emails</strong> — addresses that don’t exist or have bad syntax</li>
<li><strong>Disposable emails</strong> — temporary addresses from throwaway services</li>
<li><strong>Role addresses</strong> — generic addresses like info@, admin@, support@</li>
<li><strong>Failed MX check</strong> — domains with no valid mail server</li>
<li><strong>Non-existent mailboxes</strong> — addresses where the mailbox doesn’t exist</li>
<li><strong>Failed SMTP check</strong> — addresses rejected by the mail server</li>
<li><strong>Bad syntax</strong> — addresses that don’t follow email formatting rules</li>
</ul>
<h4>Supported form plugins</h4>
<ul>
<li>Contact Form 7</li>
<li>Gravity Forms</li>
<li>WPForms</li>
<li>WordPress User Registration</li>
<li>WordPress Comments</li>
<li><strong>Universal mode</strong> — catches email fields from any other form plugin automatically</li>
</ul>
<h4>Features</h4>
<ul>
<li>Real-time inline validation as visitors type (optional)</li>
<li>24-hour result caching — no redundant API calls</li>
<li>Fully configurable blocking rules — enable only what you need</li>
<li>Custom error messages</li>
<li>API key test button in settings</li>
<li>Fails open on API errors — your forms never break due to an outage</li>
</ul>
<h4>Requirements</h4>
<p>A free or paid <a href="https://truelist.io" rel="nofollow ugc">Truelist</a> account is required. Sign up at truelist.io to get your API key.</p>
<h3>External Services</h3>
<p>This plugin connects to the Truelist email validation API to check whether email addresses are deliverable. This service is required for the plugin to function.</p>
<p><strong>What data is sent:</strong> The email address submitted through your form is sent to the Truelist API for validation.</p>
<p><strong>When it is sent:</strong> An API request is made each time a user submits a form with an email field. Results are cached for 24 hours — repeat submissions with the same address do not trigger a new API call.</p>
<p><strong>Service provider:</strong> Truelist (https://truelist.io)</p>
<ul>
<li>Terms of Service: https://truelist.io/terms</li>
<li>Privacy Policy: https://truelist.io/privacy</li>
</ul>


Truelist Email Validator

Validate email addresses in real-time on WordPress forms using the Truelist API. Block invalid, disposable, and role-based emails.

Wp Core Tools

<p>This plugin refuses sign-ups, comments, checkouts, and form submissions when the email address belongs to a disposable, burner, or temp-mail service. All checks run on your own server against domain lists that ship inside the plugin file — no email address is ever sent to a third-party service, and the plugin does not contact any external server in its default configuration.</p>
<p>Five well-known community-maintained disposable-email lists are bundled as snapshots. Two are active out of the box (around 9,800 unique domains combined); three larger lists are available as opt-in for stricter coverage. An optional auto-update from the upstream GitHub URLs is also available, off by default.</p>
<h4>What it detects</h4>
<ul>
<li>Disposable and burner addresses (default ON) — Mailinator, YOPmail, Guerrilla Mail, 10minutemail, Temp-Mail, and similar services.</li>
<li>Anonymous / privacy mail (default OFF) — Proton Mail, Tutanota, Mailbox.org, Posteo, StartMail, SimpleLogin, addy.io, DuckDuckGo Email Protection, Firefox Relay, Apple Hide My Email. Off by default because plenty of legitimate paying customers prefer these services.</li>
<li>Plus-addressing aliases (default OFF) — <code>user+tag@example.com</code> style sub-addresses.</li>
<li>Dead and no-MX domains (default OFF) — typos like <code>gnail.com</code>, parked or expired domains. One DNS lookup per new domain, then cached.</li>
<li>Custom block and allow rules with wildcard patterns: <code>*@spammer.com</code>, <code>*@*.ru</code>, <code>spam*@*</code>.</li>
</ul>
<h4>Where it checks</h4>
<p>WordPress core:</p>
<ul>
<li>Registration form</li>
<li>Profile email change</li>
<li>Comment author email (off by default)</li>
<li>Programmatic user creation (<code>wp_insert_user</code>, REST API, WP-CLI, other plugins)</li>
<li>Lost-password form</li>
<li>Multisite signup form</li>
</ul>
<p>WooCommerce:</p>
<ul>
<li>Customer registration</li>
<li>Checkout (billing email)</li>
<li>My Account <span aria-hidden="true" class="wp-exclude-emoji">→</span> Edit Account email change</li>
<li>Product reviews</li>
<li>Coupon application — refuse coupons when the billing email is on a blocklist (anti-abuse safety net)</li>
</ul>
<p>Form plugins:</p>
<ul>
<li>Contact Form 7 — built-in, no configuration needed</li>
<li>Gravity Forms — built-in, no configuration needed</li>
<li>Any other form plugin via the <code>wpcdeg_check</code> filter (one line of PHP from your form’s email-validation hook)</li>
</ul>
<h4>Three modes</h4>
<ul>
<li><strong>Block</strong> — reject the submission with a clear error message.</li>
<li><strong>Flag</strong> — let the submission through, but tag the user / comment / order with <code>wpcdeg_flagged</code> meta so you can review them in a list. Pairs with WooCommerce auto-hold and coupon refusal.</li>
<li><strong>Log only</strong> — record matches in the detection log without rejecting or tagging anything. Useful for a dry-run before turning enforcement on.</li>
</ul>
<h4>Domain lists</h4>
<p>Five bundled snapshots are available, each toggled independently:</p>
<ul>
<li><code>disposable-email-domains</code> (MIT) — ON by default, ~5,400 domains.</li>
<li><code>7c/fakefilter</code> — ON by default, ~4,500 domains.</li>
<li><code>groundcat/disposable-email-domain-list</code> (MIT) — opt-in, ~27,000 domains.</li>
<li><code>wesbos/burner-email-providers</code> (MIT) — opt-in, ~27,000 domains.</li>
<li><code>disposable/disposable-email-domains</code> (MIT) — opt-in, ~72,000 domains.</li>
</ul>
<p>Each ships as a snapshot inside the plugin (<code>data/sources/{id}.txt</code>) and is loaded from disk; no network call is required for any of them to function.</p>
<p>If you want the snapshots refreshed on a schedule from their GitHub raw URLs, an optional auto-update feature is available. It is off by default. See “External services” below for what is contacted and what is sent.</p>
<h4>Tools</h4>
<ul>
<li>Stats dashboard with a 14-day activity chart, per-reason breakdown, and top detected domains.</li>
<li>WP Dashboard widget with the same at-a-glance summary.</li>
<li>Detection log with date / reason / context filters and CSV export.</li>
<li>Optional periodic email digest, daily or weekly.</li>
<li>CSV / TXT bulk import for the blocklist and the allowlist.</li>
<li>Settings JSON export and import for moving configuration between sites.</li>
<li>WP-CLI: <code>wp wpcdeg refresh / test / stats / log / sources / clear-log</code>.</li>
<li>HPOS and Cart/Checkout Blocks compatibility declarations.</li>
</ul>
<h4>Privacy</h4>
<ul>
<li>No email address is ever sent to a third-party service.</li>
<li>The plugin does not contact any external server in its default configuration.</li>
<li>If you enable the optional auto-update feature, the plugin issues HTTPS GET requests to <code>raw.githubusercontent.com</code> for the source URLs you have selected. The request body is empty, the User-Agent is <code>WPCoreToolsDisposableEmailGuard/<version></code>, and no email addresses, user data, or your site URL are transmitted. Full disclosure under “External services” below.</li>
<li>The detection log stores the email address, domain, reason, and IP address locally for admin review. Retention is configurable from 7 to 365 days (default 90); a daily WP-Cron job purges older rows.</li>
<li>On uninstall, all data is deleted only if you turned on the “Delete data on uninstall” setting.</li>
</ul>
<h3>External services</h3>
<p>This plugin can optionally contact one external service. The feature is <strong>off by default</strong> and must be explicitly enabled via the setup wizard or the Lists tab (Settings <span aria-hidden="true" class="wp-exclude-emoji">→</span> WPCoreTools Disposable Email Guard <span aria-hidden="true" class="wp-exclude-emoji">→</span> Lists <span aria-hidden="true" class="wp-exclude-emoji">→</span> “Auto-update from upstream sources”).</p>
<h4>GitHub (raw.githubusercontent.com)</h4>
<ul>
<li><strong>What it is:</strong> GitHub serves the raw source files of five public, community-maintained lists of disposable-email domains. The plugin downloads only the list files; nothing else.</li>
<li><strong>What it is used for:</strong> Refreshing the bundled snapshots of the disposable-email lists you have selected, so your active blocklist stays current between plugin releases.</li>
<li><strong>When data is sent:</strong> Only when the “Auto-update from upstream sources” setting is enabled, and only on the schedule you configure (hourly / twice-daily / daily / weekly), or when you click the “Update now” button on the Lists tab.</li>
<li><strong>What is sent:</strong> One HTTPS GET request per enabled source URL. The request body is empty. The User-Agent is <code>WPCoreToolsDisposableEmailGuard/<plugin-version></code>. No email addresses, user data, IP information beyond what GitHub’s CDN normally logs, or your site URL are transmitted.</li>
<li><strong>Where the requests go:</strong>
<ul>
<li><code>https://raw.githubusercontent.com/disposable-email-domains/disposable-email-domains/main/disposable_email_blocklist.conf</code></li>
<li><code>https://raw.githubusercontent.com/7c/fakefilter/main/txt/data.txt</code></li>
<li><code>https://raw.githubusercontent.com/groundcat/disposable-email-domain-list/master/domains.txt</code></li>
<li><code>https://raw.githubusercontent.com/wesbos/burner-email-providers/master/emails.txt</code></li>
<li><code>https://raw.githubusercontent.com/disposable/disposable-email-domains/master/domains.txt</code></li>
</ul>
</li>
<li><strong>Service operator:</strong> GitHub, Inc.</li>
<li><strong>Terms of service:</strong> https://docs.github.com/en/site-policy/github-terms/github-terms-of-service</li>
<li><strong>Privacy statement:</strong> https://docs.github.com/en/site-policy/privacy-policies/github-general-privacy-statement</li>
</ul>
<p>If you would rather not contact GitHub at all, leave “Auto-update from upstream sources” off (its default state). The bundled snapshots provide full functionality offline.</p>
<p>You may also add your own custom URLs on the Lists tab (e.g. an internal threat-feed URL or a private gist). Those URLs are contacted on the same schedule and follow the same rules; they are entirely under your control.</p>


WPCoreTools Disposable Email Guard

Block disposable, burner, and temp-mail addresses on WordPress and WooCommerce sign-ups, comments, checkout, and any custom form. Works fully offline.

Truelist Email Validator vs WPCoreTools Disposable Email Guard