UserCheck

<p>UserCheck blocks disposable and throwaway email addresses from your sign-up forms. The result: less spam, fewer fake accounts, and a cleaner user base.</p>
<h4>Supported plugins</h4>
<p>If you’re using any of these, UserCheck protects them automatically — nothing to configure:</p>
<ul>
<li>WordPress core (registration, comments, multisite signup, profile email change)</li>
<li>WooCommerce (classic checkout, Cart/Checkout Block, account registration, Edit-account email change)</li>
<li>Profile Builder (free + Pro)</li>
<li>Contact Form 7</li>
<li>WPForms</li>
<li>Elementor Pro Forms</li>
<li>Gravity Forms</li>
<li>Fluent Forms</li>
<li>Ninja Forms</li>
<li>Formidable Forms</li>
<li>MailPoet</li>
</ul>
<h4>Fallback for unsupported plugins</h4>
<p>For plugins without a built-in integration, a fallback check catches sign-ups from any other form on your site. It only runs when someone submits a form, so it won’t slow down your dashboard or background tasks. You can turn it off under Settings <span aria-hidden="true" class="wp-exclude-emoji">→</span> UserCheck <span aria-hidden="true" class="wp-exclude-emoji">→</span> Coverage.</p>
<h4>Choose what to block</h4>
<p>Pick which kinds of email addresses get blocked: domains that can’t receive email, disposable addresses, public providers (Gmail, Yahoo, etc.), forwarding services that hide the real address, and known spammers. Domains on your UserCheck account blocklist are always blocked.</p>
<h4>Lightweight by design</h4>
<p>Emails are checked only when users submit a form (registration, comment, checkout) — never re-checked for existing users or orders. No background scans, no surprises.</p>
<h4>Resilient by design</h4>
<p>If our service is ever down or slow, your site keeps working: sign-ups go through and the error is logged for review. Each request times out after 2 seconds, so an unresponsive API can’t hold up your forms.</p>
<h4>Full email or domain only</h4>
<p>Send the full email (more accurate) or just the domain.</p>
<h4>Extensible</h4>
<p>Developers can plug UserCheck into any plugin’s validation hook by calling <code>UserCheck::instance()->evaluate_email( $email )</code> and acting on the returned <code>action</code>, <code>reason</code>, and <code>message</code>.</p>
<h4>Translation ready</h4>
<p>All text in the plugin can be translated into any language.</p>
<h4>Works out of the box</h4>
<p>No configuration required. A free API key unlocks higher request limits.</p>
<p>Powered by <a href="https://www.usercheck.com" rel="nofollow ugc">UserCheck</a>, which tracks new disposable email providers as they appear so your site’s protection stays current.</p>
<h3>Privacy Policy</h3>
<p>The plugin sends the email address (or just its domain, depending on your settings) to the UserCheck API for validation. The request User-Agent identifies the plugin version, WordPress version, site URL, and which integration triggered the check (e.g. <code>wp_registration</code>, <code>wc_checkout</code>, or <code>fallback_is_email/<plugin-slug></code> when the fallback fires for an unsupported plugin). No other end-user data is sent. For more information on how UserCheck handles data, please visit <a href="https://www.usercheck.com/privacy" rel="nofollow ugc">https://www.usercheck.com/privacy</a>.</p>


Block disposable and throwaway email addresses on your WordPress site.

Wp Core Tools

<p>This plugin refuses sign-ups, comments, checkouts, and form submissions when the email address belongs to a disposable, burner, or temp-mail service. All checks run on your own server against domain lists that ship inside the plugin file — no email address is ever sent to a third-party service, and the plugin does not contact any external server in its default configuration.</p>
<p>Five well-known community-maintained disposable-email lists are bundled as snapshots. Two are active out of the box (around 9,800 unique domains combined); three larger lists are available as opt-in for stricter coverage. An optional auto-update from the upstream GitHub URLs is also available, off by default.</p>
<h4>What it detects</h4>
<ul>
<li>Disposable and burner addresses (default ON) — Mailinator, YOPmail, Guerrilla Mail, 10minutemail, Temp-Mail, and similar services.</li>
<li>Anonymous / privacy mail (default OFF) — Proton Mail, Tutanota, Mailbox.org, Posteo, StartMail, SimpleLogin, addy.io, DuckDuckGo Email Protection, Firefox Relay, Apple Hide My Email. Off by default because plenty of legitimate paying customers prefer these services.</li>
<li>Plus-addressing aliases (default OFF) — <code>user+tag@example.com</code> style sub-addresses.</li>
<li>Dead and no-MX domains (default OFF) — typos like <code>gnail.com</code>, parked or expired domains. One DNS lookup per new domain, then cached.</li>
<li>Custom block and allow rules with wildcard patterns: <code>*@spammer.com</code>, <code>*@*.ru</code>, <code>spam*@*</code>.</li>
</ul>
<h4>Where it checks</h4>
<p>WordPress core:</p>
<ul>
<li>Registration form</li>
<li>Profile email change</li>
<li>Comment author email (off by default)</li>
<li>Programmatic user creation (<code>wp_insert_user</code>, REST API, WP-CLI, other plugins)</li>
<li>Lost-password form</li>
<li>Multisite signup form</li>
</ul>
<p>WooCommerce:</p>
<ul>
<li>Customer registration</li>
<li>Checkout (billing email)</li>
<li>My Account <span aria-hidden="true" class="wp-exclude-emoji">→</span> Edit Account email change</li>
<li>Product reviews</li>
<li>Coupon application — refuse coupons when the billing email is on a blocklist (anti-abuse safety net)</li>
</ul>
<p>Form plugins:</p>
<ul>
<li>Contact Form 7 — built-in, no configuration needed</li>
<li>Gravity Forms — built-in, no configuration needed</li>
<li>Any other form plugin via the <code>wpcdeg_check</code> filter (one line of PHP from your form’s email-validation hook)</li>
</ul>
<h4>Three modes</h4>
<ul>
<li><strong>Block</strong> — reject the submission with a clear error message.</li>
<li><strong>Flag</strong> — let the submission through, but tag the user / comment / order with <code>wpcdeg_flagged</code> meta so you can review them in a list. Pairs with WooCommerce auto-hold and coupon refusal.</li>
<li><strong>Log only</strong> — record matches in the detection log without rejecting or tagging anything. Useful for a dry-run before turning enforcement on.</li>
</ul>
<h4>Domain lists</h4>
<p>Five bundled snapshots are available, each toggled independently:</p>
<ul>
<li><code>disposable-email-domains</code> (MIT) — ON by default, ~5,400 domains.</li>
<li><code>7c/fakefilter</code> — ON by default, ~4,500 domains.</li>
<li><code>groundcat/disposable-email-domain-list</code> (MIT) — opt-in, ~27,000 domains.</li>
<li><code>wesbos/burner-email-providers</code> (MIT) — opt-in, ~27,000 domains.</li>
<li><code>disposable/disposable-email-domains</code> (MIT) — opt-in, ~72,000 domains.</li>
</ul>
<p>Each ships as a snapshot inside the plugin (<code>data/sources/{id}.txt</code>) and is loaded from disk; no network call is required for any of them to function.</p>
<p>If you want the snapshots refreshed on a schedule from their GitHub raw URLs, an optional auto-update feature is available. It is off by default. See “External services” below for what is contacted and what is sent.</p>
<h4>Tools</h4>
<ul>
<li>Stats dashboard with a 14-day activity chart, per-reason breakdown, and top detected domains.</li>
<li>WP Dashboard widget with the same at-a-glance summary.</li>
<li>Detection log with date / reason / context filters and CSV export.</li>
<li>Optional periodic email digest, daily or weekly.</li>
<li>CSV / TXT bulk import for the blocklist and the allowlist.</li>
<li>Settings JSON export and import for moving configuration between sites.</li>
<li>WP-CLI: <code>wp wpcdeg refresh / test / stats / log / sources / clear-log</code>.</li>
<li>HPOS and Cart/Checkout Blocks compatibility declarations.</li>
</ul>
<h4>Privacy</h4>
<ul>
<li>No email address is ever sent to a third-party service.</li>
<li>The plugin does not contact any external server in its default configuration.</li>
<li>If you enable the optional auto-update feature, the plugin issues HTTPS GET requests to <code>raw.githubusercontent.com</code> for the source URLs you have selected. The request body is empty, the User-Agent is <code>WPCoreToolsDisposableEmailGuard/<version></code>, and no email addresses, user data, or your site URL are transmitted. Full disclosure under “External services” below.</li>
<li>The detection log stores the email address, domain, reason, and IP address locally for admin review. Retention is configurable from 7 to 365 days (default 90); a daily WP-Cron job purges older rows.</li>
<li>On uninstall, all data is deleted only if you turned on the “Delete data on uninstall” setting.</li>
</ul>
<h3>External services</h3>
<p>This plugin can optionally contact one external service. The feature is <strong>off by default</strong> and must be explicitly enabled via the setup wizard or the Lists tab (Settings <span aria-hidden="true" class="wp-exclude-emoji">→</span> WPCoreTools Disposable Email Guard <span aria-hidden="true" class="wp-exclude-emoji">→</span> Lists <span aria-hidden="true" class="wp-exclude-emoji">→</span> “Auto-update from upstream sources”).</p>
<h4>GitHub (raw.githubusercontent.com)</h4>
<ul>
<li><strong>What it is:</strong> GitHub serves the raw source files of five public, community-maintained lists of disposable-email domains. The plugin downloads only the list files; nothing else.</li>
<li><strong>What it is used for:</strong> Refreshing the bundled snapshots of the disposable-email lists you have selected, so your active blocklist stays current between plugin releases.</li>
<li><strong>When data is sent:</strong> Only when the “Auto-update from upstream sources” setting is enabled, and only on the schedule you configure (hourly / twice-daily / daily / weekly), or when you click the “Update now” button on the Lists tab.</li>
<li><strong>What is sent:</strong> One HTTPS GET request per enabled source URL. The request body is empty. The User-Agent is <code>WPCoreToolsDisposableEmailGuard/<plugin-version></code>. No email addresses, user data, IP information beyond what GitHub’s CDN normally logs, or your site URL are transmitted.</li>
<li><strong>Where the requests go:</strong>
<ul>
<li><code>https://raw.githubusercontent.com/disposable-email-domains/disposable-email-domains/main/disposable_email_blocklist.conf</code></li>
<li><code>https://raw.githubusercontent.com/7c/fakefilter/main/txt/data.txt</code></li>
<li><code>https://raw.githubusercontent.com/groundcat/disposable-email-domain-list/master/domains.txt</code></li>
<li><code>https://raw.githubusercontent.com/wesbos/burner-email-providers/master/emails.txt</code></li>
<li><code>https://raw.githubusercontent.com/disposable/disposable-email-domains/master/domains.txt</code></li>
</ul>
</li>
<li><strong>Service operator:</strong> GitHub, Inc.</li>
<li><strong>Terms of service:</strong> https://docs.github.com/en/site-policy/github-terms/github-terms-of-service</li>
<li><strong>Privacy statement:</strong> https://docs.github.com/en/site-policy/privacy-policies/github-general-privacy-statement</li>
</ul>
<p>If you would rather not contact GitHub at all, leave “Auto-update from upstream sources” off (its default state). The bundled snapshots provide full functionality offline.</p>
<p>You may also add your own custom URLs on the Lists tab (e.g. an internal threat-feed URL or a private gist). Those URLs are contacted on the same schedule and follow the same rules; they are entirely under your control.</p>


WPCoreTools Disposable Email Guard

Block disposable, burner, and temp-mail addresses on WordPress and WooCommerce sign-ups, comments, checkout, and any custom form. Works fully offline.

UserCheck vs WPCoreTools Disposable Email Guard