UserCheck

UserCheck blocks disposable and throwaway email addresses from your sign-up forms. The result: less spam, fewer fake accounts, and a cleaner user base.
<h4>Supported plugins</h4>
If you’re using any of these, UserCheck protects them automatically — nothing to configure:
<ul>
<li>WordPress core (registration, comments, multisite signup, profile email change)</li>
<li>WooCommerce (classic checkout, Cart/Checkout Block, account registration, Edit-account email change)</li>
<li>Profile Builder (free + Pro)</li>
<li>Contact Form 7</li>
<li>WPForms</li>
<li>Elementor Pro Forms</li>
<li>Gravity Forms</li>
<li>Fluent Forms</li>
<li>Ninja Forms</li>
<li>Formidable Forms</li>
<li>MailPoet</li>
</ul>
<h4>Fallback for unsupported plugins</h4>
For plugins without a built-in integration, a fallback check catches sign-ups from any other form on your site. It only runs when someone submits a form, so it won’t slow down your dashboard or background tasks. You can turn it off under Settings → UserCheck → Coverage.
<h4>Choose what to block</h4>
Pick which kinds of email addresses get blocked: domains that can’t receive email, disposable addresses, public providers (Gmail, Yahoo, etc.), forwarding services that hide the real address, and known spammers. Domains on your UserCheck account blocklist are always blocked.
<h4>Lightweight by design</h4>
Emails are checked only when users submit a form (registration, comment, checkout) — never re-checked for existing users or orders. No background scans, no surprises.
<h4>Resilient by design</h4>
If our service is ever down or slow, your site keeps working: sign-ups go through and the error is logged for review. Each request times out after 2 seconds, so an unresponsive API can’t hold up your forms.
<h4>Full email or domain only</h4>
Send the full email (more accurate) or just the domain.
<h4>Extensible</h4>
Developers can plug UserCheck into any plugin’s validation hook by calling <code>UserCheck::instance()->evaluate_email( $email )</code> and acting on the returned <code>action</code>, <code>reason</code>, and <code>message</code>.
<h4>Translation ready</h4>
All text in the plugin can be translated into any language.
<h4>Works out of the box</h4>
No configuration required. A free API key unlocks higher request limits.
Powered by <a href="https://www.usercheck.com" rel="nofollow ugc">UserCheck</a>, which tracks new disposable email providers as they appear so your site’s protection stays current.
<h3>Privacy Policy</h3>
The plugin sends the email address (or just its domain, depending on your settings) to the UserCheck API for validation. The request User-Agent identifies the plugin version, WordPress version, site URL, and which integration triggered the check (e.g. <code>wp_registration</code>, <code>wc_checkout</code>, or <code>fallback_is_email/<plugin-slug></code> when the fallback fires for an unsupported plugin). No other end-user data is sent. For more information on how UserCheck handles data, please visit <a href="https://www.usercheck.com/privacy" rel="nofollow ugc">https://www.usercheck.com/privacy</a>.

Block disposable and throwaway email addresses on your WordPress site.

neoparker007

NeoSmartApps

<blockquote>
Self-hosted. Privacy-first. Fully yours.
</blockquote>
Tempmails turns your WordPress site into a self-hosted temporary email 
service. Visitors generate a random disposable email address, receive 
messages in a real-time inbox, and discard them when done — all without 
leaving your site.
Unlike third-party services, Tempmails runs entirely on your own server 
and IMAP mailbox. You own the data, the domain, and the brand.
🔒 No third-party email APIs 
📬 Real IMAP inbox — not a simulation 
🎨 Material Design 3 UI — beautiful out of the box 
⚡ AJAX-powered — no page reloads
<h4>🚀 Quick Links</h4>
Everything you need to get started, get help, and stay connected:
<ul>
<li>🌐 Official Website — <a href="https://tempmails.cv/" rel="nofollow ugc">tempmails.cv</a> — docs, 
roadmap, and addon announcements</li>
<li>🎬 Installation Tutorial — Watch the step-by-step video guide below</li>
<li>📺 YouTube Channel — <a href="https://www.youtube.com/@NeoSmartApps101" rel="nofollow ugc">NeoSmartApps on YouTube</a> 
— tutorials, walkthroughs, and new release demos</li>
<li>☕ Support the Project — <a href="https://paypal.me/growmify" rel="nofollow ugc">Buy us a coffee via PayPal</a> 
— Tempmails is free forever; your support keeps development alive</li>
<li>🖥️ Need Hosting? — Tempmails works best on a VPS or shared host with 
catch-all IMAP support. We recommend <a href="https://www.hostinger.com/in?REFERRALCODE=neoparker" rel="nofollow ugc">Hostinger</a> 
(affiliate link — we earn a small commission at no extra cost to you)</li>
</ul>
<h4>🎬 Watch: Full Installation Tutorial</h4>
<iframe loading="lazy" class="youtube-player" width="750" height="422" src="https://www.youtube.com/embed/8SKRdyEUrog?version=3&rel=1&showsearch=0&showinfo=1&iv_load_policy=1&fs=1&hl=en-US&autohide=2&wmode=transparent" allowfullscreen="true" style="border:0;" sandbox="allow-scripts allow-same-origin allow-popups allow-presentation allow-popups-to-escape-sandbox"></iframe>
<h4>Core Features</h4>
📨 Email Engine
<ul>
<li>IMAP Email Fetching — connects to any catch-all IMAP mailbox</li>
<li>Auto Email Generation — random disposable addresses on your own domains</li>
<li>Real-time Inbox — AJAX-powered message viewer with configurable 
auto-refresh</li>
<li>Attachment Support — download files with 40+ allowed extensions</li>
</ul>
🎨 Design & UI
<ul>
<li>Material Design 3 UI — modern, responsive inbox with Inter & Poppins fonts</li>
<li>White-labeled — fully rebrandable, no third-party branding in the UI</li>
<li>Design Panel — live color picker and label customization in admin</li>
</ul>
🛡️ Privacy & Data
<ul>
<li>Soft Delete — messages are never hard-deleted; safe for compliance</li>
<li>Cookie-based sessions — no user accounts or registration required</li>
<li>Zero external data transmission — all data stays on your server</li>
</ul>
⚙️ WordPress Native
<ul>
<li>Uses WP database, cron, options, nonces, and security APIs throughout</li>
<li>Settings API compliant admin panel</li>
<li>Full i18n/l10n support with <code>.pot</code> file included</li>
</ul>
<h4>Shortcode</h4>
Place the inbox anywhere on your site with one shortcode:
<pre><code>[tempmails_inbox]
</code></pre>
This renders the full inbox UI — email generation, copy button, 
auto-refresh, message list, and message viewer modal.
<h4>Addon Ecosystem</h4>
Tempmails Core is frozen infrastructure. All new functionality is 
delivered via addons using a documented, stable hook system — your site 
never breaks on Core updates.
Available addon hooks cover: email generation, message routing, inbox 
access control, multi-domain support, billing integration, and more. 
See the Hooks section below for the full reference.
<h4>Privacy</h4>
Tempmails stores temporary email addresses in browser cookies to 
maintain inbox sessions between page loads. No personal data is collected, 
stored against user accounts, or transmitted to any external service. 
See External Services below for details on the optional GitHub 
ecosystem feed.
<h3>Hooks</h3>
Tempmails exposes a complete hook system for addon developers. All hooks 
below are stable and frozen — they will not be renamed, removed, or 
have their signatures changed in any minor version.
<h4>Action Hooks</h4>
<ul>
<li><code>tempmails_loaded</code> — Core fully initialized; safe for addon bootstrap</li>
<li><code>tempmails_core_ready</code> — fires after DB integrity check; passes Core 
version string</li>
<li><code>tempmails_activated</code> — fires on plugin activation; safe for addon setup</li>
<li><code>tempmails_deactivated</code> — fires on plugin deactivation</li>
<li><code>tempmails_email_generated</code> — new address generated; params: <code>$email</code>, 
 $ip</li>
<li><code>tempmails_inbox_accessed</code> — user opened inbox; params: <code>$email</code>, <code>$ip</code></li>
<li><code>tempmails_message_received</code> — new message stored; params: <code>$message_id</code>, 
 $to_address</li>
<li><code>tempmails_message_marked_seen</code> — message read; params: <code>$message_id</code></li>
<li><code>tempmails_message_deleted</code> — soft delete triggered; params: <code>$message_id</code>, 
 $email</li>
<li><code>tempmails_cleanup_completed</code> — cron cleanup finished; params: 
 $deleted_count</li>
<li><code>tempmails_fetch_completed</code> — fetch cycle finished; params: <code>$results</code> 
array</li>
</ul>
<h4>Filter Hooks</h4>
<ul>
<li><code>tempmails_registered_addons</code> — register your addon for the Addons admin 
page</li>
<li><code>tempmails_generated_email</code> — modify a generated address before returning 
it</li>
<li><code>tempmails_available_domains</code> — modify the domain list available for 
generation</li>
<li><code>tempmails_can_fetch_messages</code> — allow/block a fetch cycle; params: 
 $bool, <code>$engine</code></li>
<li><code>tempmails_can_process_message</code> — allow/block a single message; params: 
 $bool, <code>$message</code></li>
<li><code>tempmails_can_store_message</code> — allow/block DB insert; params: <code>$bool</code>, 
 $data</li>
<li><code>tempmails_can_read_inbox</code> — allow/block inbox access; params: <code>$bool</code>, 
 $email</li>
<li><code>tempmails_message_content</code> — filter body before display; params: 
 $content, <code>$message_id</code></li>
<li><code>tempmails_default_settings</code> — modify default option values on activation</li>
<li><code>tempmails_inbox_attributes</code> — modify shortcode default attributes</li>
<li><code>tempmails_admin_dashboard_stats</code> — extend dashboard stat cards</li>
<li><code>tempmails_settings_tabs</code> — add custom tabs to the Settings page</li>
</ul>
<h3>External Services</h3>
<h4>Ecosystem Feed (Optional — Default On)</h4>
Tempmails fetches a public JSON file from GitHub to display addon and 
ecosystem information inside the WordPress admin panel.
What this connection does:
<ul>
<li>Fires only when viewing Tempmails admin pages</li>
<li>Retrieves only public, non-personal JSON content</li>
<li>Transmits no user data, site URL, or any identifiable information</li>
<li>Results are cached locally for 1 hour to minimize requests</li>
</ul>
Remote endpoint: 
https://raw.githubusercontent.com/ubermensch-site/tempmails-ecosystem/main/ecosystem.json
Service provider: GitHub 
Privacy policy: https://docs.github.com/en/site-policy/privacy-policies/github-general-privacy-statement
To disable this connection entirely, uncheck Ecosystem Feed under 
Tempmails → Settings → General. Hardcoded fallback content is shown 
instead — no requests are made.
<h4>Google Fonts</h4>
The frontend inbox loads the Inter and Poppins typefaces and the 
Material Symbols icon font from Google Fonts CDN.
What this connection does:
<ul>
<li>Fires only on pages where <code>[tempmails_inbox]</code> is rendered</li>
<li>Transmits the visitor’s IP address to Google as part of a standard font 
request</li>
</ul>
Service provider: Google Fonts 
Privacy policy: https://developers.google.com/fonts/faq/privacy
To avoid this (e.g. for GDPR compliance), dequeue <code>tempmails-google-fonts</code> 
and load self-hosted font copies instead.
<h3>Developers</h3>
This section documents internal implementation details, security practices, 
and notes for addon developers.
<h4>Security Hardening Log</h4>
All security changes are tracked here for auditing purposes.
2026-04-04 — Security Review Pass (v1.0.7 patch)
<ol>
<li>class-core.php — <code>ajax_delete_message()</code>: <code>$_POST['message_id']</code> 
was <code>wp_unslash()</code>-ed but not sanitized, with a <code>phpcs:ignore</code> 
suppression comment masking the warning. Now wrapped with 
 sanitize_text_field( wp_unslash( … ) ). Suppression comment removed.</li>
</ol>
2026-04-02 — Security Review Pass (v1.0.7 patch)
<ol>
<li>class-design.php — Removed raw <code><style></code> echo from <code>render_page()</code>. 
Static CSS moved to <code>assets/css/admin.css</code>.</li>
<li>class-design.php — <code>inject_css_variables()</code> refactored: replaced 
 echo “…” with <code>wp_add_inline_style('tempmails-admin', ...)</code>. 
All <code>$v()</code> return values now pass through <code>esc_attr()</code>.</li>
<li>class-design.php — <code>inject_frontend_css_variables()</code> refactored: 
all CSS values escaped with <code>esc_attr()</code>, <code>wp_strip_all_tags()</code> applied.</li>
<li>class-design.php — <code>wp_footer</code> fallback replaced raw <code>echo '<style>'</code> 
with a dummy registered style handle.</li>
<li>class-tempmails-shortcodes.php — Inline <code><script></code> replaced with 
 wp_add_inline_script(‘tempmails-frontend’, …).</li>
<li>class-ecosystem.php — Inline <code><script></code> replaced with 
 wp_add_inline_script(‘tempmails-admin’, …).</li>
<li>class-core.php — <code>ajax_mark_seen()</code>: sanitized with 
 sanitize_text_field( wp_unslash( … ) ).</li>
<li>class-admin.php — <code>save_settings()</code>: Raw <code>$_POST</code> replaced with 
 $clean_post = array_map(‘sanitize_text_field’, wp_unslash($_POST)).</li>
<li>class-email-generator.php — <code>get_emails()</code>: Cookie data sanitized 
with <code>array_values(array_filter(array_map('sanitize_email', $raw)))</code>.</li>
</ol>
<h4>Addon Development Notes</h4>
Hook Stability Guarantee
All hooks listed in the <code>== Hooks ==</code> section are frozen. Signatures will 
not change in any 1.x release. Breaking changes will only occur in a major 
version bump with a migration guide.
$clean_post in save_settings hooks
As of the 2026-04-02 security patch, both <code>tempmails_before_save_settings</code> 
and <code>tempmails_before_save_imap_settings</code> receive a sanitized copy of 
 $_POST. If your addon previously relied on raw values via these hooks, 
retrieve those fields directly from <code>$_POST</code> with appropriate sanitization.
CSS Variable Injection
<pre><code>inject_css_variables() now attaches inline CSS to the `tempmails-admin`
</code></pre>
style handle. If your addon dequeues <code>tempmails-admin</code>, Design color 
variables will not be applied on admin pages.
<pre><code>inject_frontend_css_variables() uses a priority waterfall:
</code></pre>
1. Attaches to <code>tempmails-frontend</code> if registered/enqueued 
2. Falls back to <code>tempmails-frontend-css</code> 
3. Registers a dummy handle <code>tempmails-design-vars</code> in <code>wp_footer</code> at 
 priority 1
<h4>File Structure</h4>
tempmails/ 
├── assets/ 
│ ├── css/ 
│ │ ├── admin.css 
│ │ ├── frontend.css 
│ │ └── ecosystem.css 
│ └── js/ 
│ ├── admin.js 
│ ├── admin-design.js 
│ └── frontend.js 
├── core/ 
│ ├── class-core.php 
│ ├── class-admin.php 
│ ├── class-design.php 
│ ├── class-ecosystem.php 
│ ├── class-email-generator.php 
│ └── class-addon-handler.php 
├── includes/ 
│ ├── class-tempmails-shortcodes.php 
│ ├── class-tempmails-database.php 
│ ├── class-tempmails-settings.php 
│ ├── class-tempmails-imap.php 
│ └── class-tempmails-fetcher.php 
└── tempmails.php

Tempmails

White-label temporary email platform. Let visitors generate disposable inboxes on your site — powered by your own IMAP server.

UserCheck vs Tempmails