VMS Elements

VMS Elements Form Guard is a comprehensive spam protection plugin that validates email domains, blocks disposable emails, and protects your forms from malicious submissions using multiple security layers.
<a href="https://vmselements.com/product/vms-elements-form-guard-pro" rel="nofollow ugc">VMS Elements Form Guard Pro</a> adds Form Guard, Contact Guard, Subscribe Guard, AI summaries, email templates, and more.
<h4>Key Features</h4>
Core Protection
<ul>
<li>Disposable Email Detection – Block 10,000+ temporary/disposable email domains automatically</li>
<li>Email Domain Validation – Verify email domains have valid MX records and HTTPS</li>
<li>Real-time Validation – Instant feedback before form submission</li>
<li>Custom Whitelist – Always allow trusted domains</li>
<li>Custom Blocklist – Add your own blocked domains</li>
</ul>
Security API Integrations
<ul>
<li>Google Web Risk API – Enterprise-grade malware and phishing detection</li>
<li>VirusTotal Integration – Multi-engine domain scanning with support for multiple API keys</li>
<li>Google reCAPTCHA – Both v2 and v3 support for bot protection</li>
</ul>
AI-Powered Features
<ul>
<li>AI Spam Detection – Intelligent comment analysis using leading AI providers</li>
<li>AI Post Summaries – Auto-generate summaries for blog posts</li>
<li>AI Product Summaries – Auto-generate WooCommerce product summaries</li>
<li>Multiple AI Providers – OpenAI (GPT-4), Anthropic (Claude), Google Gemini, DeepSeek</li>
</ul>
Form Protection Guards
<ul>
<li>Contact Guard – Protect contact forms from spam</li>
<li>Subscribe Guard – Protect newsletter subscription forms</li>
<li>Registration Guard – Protect WordPress user registration</li>
<li>Login Guard – Protect login forms with validation</li>
<li>Comment Guard – Advanced comment spam protection with custom rules</li>
<li>Product Review Guard – Protect WooCommerce product reviews</li>
</ul>
Additional Features
<ul>
<li>Activity Dashboard – Monitor all validation events with analytics</li>
<li>Detailed Logging – Track every blocked attempt with reasons</li>
<li>Blocked Users Management – View and manage blocked users</li>
<li>Custom Error Messages – Customize all validation messages</li>
<li>Email Templates – Customizable notification emails</li>
<li>Translation Ready – Full internationalization support</li>
</ul>
<h4>Supported Forms</h4>
VMS Elements Form Guard works with any HTML form including:
<ul>
<li>Contact Form 7</li>
<li>WPForms</li>
<li>Gravity Forms</li>
<li>Ninja Forms</li>
<li>Formidable Forms</li>
<li>Newsletter Plugin</li>
<li>Mailchimp Forms</li>
<li>WooCommerce Forms</li>
<li>WordPress Registration</li>
<li>WordPress Comments</li>
<li>Any Custom HTML Form</li>
</ul>
<h4>How It Works</h4>
<ol>
<li>Install and Activate – Simple one-click installation</li>
<li>Add Form Mapping – Tell the plugin which forms to protect</li>
<li>Configure Validation – Choose your protection level</li>
<li>Automatic Protection – Forms are protected in real-time</li>
</ol>
<h4>API Keys (Optional)</h4>
Basic protection works without any API keys. For enhanced security:
<ul>
<li>Google Web Risk – Detect malware and phishing domains</li>
<li>VirusTotal – Multi-engine scanning (free tier: 500 requests/day)</li>
<li>AI Providers – Enable intelligent spam detection</li>
</ul>
<h4>Privacy & GDPR</h4>
<ul>
<li>Only email domains are processed for validation, not full email addresses (unless you enable features that require them).</li>
<li>Data is sent to third-party services only when you enter API keys and enable those features.</li>
<li>No personal data is stored on VMS Elements servers by default.</li>
<li>Full GDPR compliance depends on your configuration and privacy policy.</li>
</ul>
<h3>Privacy Policy</h3>
VMS Elements Form Guard does not collect, store, or send any data from your website on its own. Every outbound network call is opt-in and only happens after you explicitly configure the corresponding API key or feature in the plugin settings.
<h4>Third-party services used by this plugin</h4>
The plugin can connect to the following third-party services. Each one is only contacted when you actively enable the matching feature and provide the required API key:
<ul>
<li>Google Web Risk — Sends the email domain or URL hostname being validated to <code>https://webrisk.googleapis.com/v1/uris:search</code>. Requires your own Google API key. <a href="https://cloud.google.com/terms" rel="nofollow ugc">Terms of Service</a> · <a href="https://policies.google.com/privacy" rel="nofollow ugc">Privacy Policy</a>.</li>
<li>VirusTotal — Sends the email domain or URL hostname being validated to <code>https://www.virustotal.com/api/v3/domains/</code>. Requires your own VirusTotal API key. <a href="https://docs.virustotal.com/docs/historic-terms-of-service" rel="nofollow ugc">Terms of Service</a> · <a href="https://docs.virustotal.com/docs/historic-privacy-policy" rel="nofollow ugc">Privacy Policy</a>.</li>
<li>Google reCAPTCHA — Loaded only when you enable reCAPTCHA on a form. The visitor’s browser exchanges a verification token with <code>https://www.google.com/recaptcha/</code>. <a href="https://policies.google.com/terms" rel="nofollow ugc">Terms</a> · <a href="https://policies.google.com/privacy" rel="nofollow ugc">Privacy Policy</a>.</li>
<li>OpenAI — Sends the message body being moderated to <code>https://api.openai.com/v1/chat/completions</code>. Requires your own OpenAI API key. <a href="https://openai.com/policies/terms-of-use" rel="nofollow ugc">Terms</a> · <a href="https://openai.com/policies/privacy-policy" rel="nofollow ugc">Privacy Policy</a>.</li>
<li>Anthropic — Sends the message body being moderated to <code>https://api.anthropic.com/v1/messages</code>. Requires your own Anthropic API key. <a href="https://www.anthropic.com/legal/consumer-terms" rel="nofollow ugc">Terms</a> · <a href="https://www.anthropic.com/legal/privacy" rel="nofollow ugc">Privacy Policy</a>.</li>
<li>Google Gemini — Sends the message body being moderated to <code>https://generativelanguage.googleapis.com/</code>. Requires your own Gemini API key. <a href="https://ai.google.dev/gemini-api/terms" rel="nofollow ugc">Terms</a> · <a href="https://policies.google.com/privacy" rel="nofollow ugc">Privacy Policy</a>.</li>
<li>DeepSeek — Sends the message body being moderated to <code>https://api.deepseek.com/chat/completions</code>. Requires your own DeepSeek API key. <a href="https://chat.deepseek.com/downloads/DeepSeek%20Terms%20of%20Use.html" rel="nofollow ugc">Terms</a> · <a href="https://chat.deepseek.com/downloads/DeepSeek%20Privacy%20Policy.html" rel="nofollow ugc">Privacy Policy</a>.</li>
<li>Amazon Bedrock — Sends the message body being moderated to the AWS Bedrock Runtime endpoint <code>https://bedrock-runtime.{region}.amazonaws.com/model/{model}/invoke</code> (the region and model are the ones you configure). Requires your own AWS access key, secret key, and model ID. <a href="https://aws.amazon.com/service-terms/" rel="nofollow ugc">Terms</a> · <a href="https://aws.amazon.com/privacy/" rel="nofollow ugc">Privacy Policy</a>.</li>
</ul>
<h4>What data is sent</h4>
For each enabled service the plugin sends ONLY:
<ul>
<li>The domain part of the submitted email or the URL hostname, for reputation checks (Web Risk, VirusTotal).</li>
<li>The message text the visitor typed in a guarded textarea, for AI spam moderation (OpenAI, Anthropic, Gemini, DeepSeek, Amazon Bedrock). The chosen AI provider receives the body of the field plus a fixed system prompt.</li>
<li>The reCAPTCHA token generated by the visitor’s browser, for bot-protection verification (Google reCAPTCHA).</li>
</ul>
The plugin does NOT send the full submitted form, IP addresses, user accounts, or any other personal data to these third parties.
<h4>Data stored locally</h4>
The plugin writes only to the WordPress site database. The following tables and options may be created:
<ul>
<li><code>*_vms_elements_form_guard_whitelist_domains</code>, <code>*_vms_elements_form_guard_disposable_domains</code> — Email-domain reputation lists you manage.</li>
<li><code>*_vms_elements_form_guard_logs</code> — Validation events (domain, decision, timestamp). No personal data.</li>
<li><code>*_vms_elements_form_guard_api_keys</code> — Encrypted copies of the API keys you entered.</li>
<li><code>*_vms_elements_form_guard_comment_enforcement</code> — IP/user-ID strike counters for the optional Block User feature.</li>
<li><code>vefg-google-config</code>, <code>vefg-virustotal-config</code>, <code>vefg-ai-span-config</code>, <code>vefg-recaptcha-config</code>, <code>vefg-error-messages</code>, <code>vefg-registration-guard</code> — Plugin settings.</li>
</ul>
All tables and options are removed when you uninstall the plugin.
<h4>Cookies</h4>
The plugin itself does not set any cookies. Google reCAPTCHA sets its own cookies when you enable it.
<h4>GDPR</h4>
Because every outbound request requires an administrator to first enable the matching feature and provide an API key, your site only becomes a “data processor” toward these third parties after you opt in. We recommend listing each enabled service in your site’s own privacy policy.
<h3>External services</h3>
This plugin relies on the following third-party / external services. Each service is contacted ONLY after a site administrator enables the matching feature and provides the required API key or credentials. Nothing is sent by default.
<ol>
<li>
Google Web Risk — Used to detect malware and phishing domains. The email domain or URL hostname being validated is sent to <code>https://webrisk.googleapis.com/v1/uris:search</code> each time a guarded field is validated and this feature is enabled. Provided by Google. <a href="https://cloud.google.com/terms" rel="nofollow ugc">Terms of Service</a> — <a href="https://policies.google.com/privacy" rel="nofollow ugc">Privacy Policy</a>.
</li>
<li>
VirusTotal — Used for multi-engine domain reputation scanning. The email domain or URL hostname being validated is sent to <code>https://www.virustotal.com/api/v3/domains/</code> each time a guarded field is validated and this feature is enabled. Provided by VirusTotal (Google). <a href="https://docs.virustotal.com/docs/historic-terms-of-service" rel="nofollow ugc">Terms of Service</a> — <a href="https://docs.virustotal.com/docs/historic-privacy-policy" rel="nofollow ugc">Privacy Policy</a>.
</li>
<li>
Google reCAPTCHA — Used for bot protection on guarded forms. When enabled, the visitor’s browser exchanges a verification token with <code>https://www.google.com/recaptcha/</code>. Provided by Google. <a href="https://policies.google.com/terms" rel="nofollow ugc">Terms of Service</a> — <a href="https://policies.google.com/privacy" rel="nofollow ugc">Privacy Policy</a>.
</li>
<li>
OpenAI — Used for AI spam moderation. The message text typed in a guarded field is sent to <code>https://api.openai.com/v1/chat/completions</code> when AI moderation is enabled with this provider. Provided by OpenAI. <a href="https://openai.com/policies/terms-of-use" rel="nofollow ugc">Terms of Use</a> — <a href="https://openai.com/policies/privacy-policy" rel="nofollow ugc">Privacy Policy</a>.
</li>
<li>
Anthropic — Used for AI spam moderation. The message text typed in a guarded field is sent to <code>https://api.anthropic.com/v1/messages</code> when AI moderation is enabled with this provider. Provided by Anthropic. <a href="https://www.anthropic.com/legal/consumer-terms" rel="nofollow ugc">Terms</a> — <a href="https://www.anthropic.com/legal/privacy" rel="nofollow ugc">Privacy Policy</a>.
</li>
<li>
Google Gemini — Used for AI spam moderation. The message text typed in a guarded field is sent to <code>https://generativelanguage.googleapis.com/</code> when AI moderation is enabled with this provider. Provided by Google. <a href="https://ai.google.dev/gemini-api/terms" rel="nofollow ugc">Terms</a> — <a href="https://policies.google.com/privacy" rel="nofollow ugc">Privacy Policy</a>.
</li>
<li>
DeepSeek — Used for AI spam moderation. The message text typed in a guarded field is sent to <code>https://api.deepseek.com/chat/completions</code> when AI moderation is enabled with this provider. Provided by DeepSeek. <a href="https://chat.deepseek.com/downloads/DeepSeek%20Terms%20of%20Use.html" rel="nofollow ugc">Terms</a> — <a href="https://chat.deepseek.com/downloads/DeepSeek%20Privacy%20Policy.html" rel="nofollow ugc">Privacy Policy</a>.
</li>
<li>
Amazon Bedrock — Used for AI spam moderation. The message text typed in a guarded field is sent to the AWS Bedrock Runtime endpoint <code>https://bedrock-runtime.{region}.amazonaws.com/model/{model}/invoke</code> (region and model are the ones you configure) when AI moderation is enabled with this provider. Provided by Amazon Web Services. <a href="https://aws.amazon.com/service-terms/" rel="nofollow ugc">Service Terms</a> — <a href="https://aws.amazon.com/privacy/" rel="nofollow ugc">Privacy Policy</a>.
</li>
</ol>

VMS Elements Form Guard

Protect your WordPress forms from spam, fake emails, and malicious domains with advanced validation and AI-powered detection.

Amzil Ayoub

Disposable Email Detector prevents users from registering with known disposable or temporary email addresses.
This helps reduce spam accounts and improve the quality of your user base. It supports both: 
– Native WordPress registrations 
– WooCommerce customer registrations
Key Features 
– Blocks disposable email during registration 
– WooCommerce compatible 
– Lightweight and fast

Disposable Email Detector

Blocks user registration with disposable or temporary email addresses. Supports WordPress and WooCommerce.

VMS Elements Form Guard vs Disposable Email Detector