VMS Elements

VMS Elements Form Guard is a comprehensive spam protection plugin that validates email domains, blocks disposable emails, and protects your forms from malicious submissions using multiple security layers.
<a href="https://vmselements.com/product/vms-elements-form-guard-pro" rel="nofollow ugc">VMS Elements Form Guard Pro</a> adds Form Guard, Contact Guard, Subscribe Guard, AI summaries, email templates, and more.
<h4>Key Features</h4>
Core Protection
<ul>
<li>Disposable Email Detection – Block 10,000+ temporary/disposable email domains automatically</li>
<li>Email Domain Validation – Verify email domains have valid MX records and HTTPS</li>
<li>Real-time Validation – Instant feedback before form submission</li>
<li>Custom Whitelist – Always allow trusted domains</li>
<li>Custom Blocklist – Add your own blocked domains</li>
</ul>
Security API Integrations
<ul>
<li>Google Web Risk API – Enterprise-grade malware and phishing detection</li>
<li>VirusTotal Integration – Multi-engine domain scanning with support for multiple API keys</li>
<li>Google reCAPTCHA – Both v2 and v3 support for bot protection</li>
</ul>
AI-Powered Features
<ul>
<li>AI Spam Detection – Intelligent comment analysis using leading AI providers</li>
<li>AI Post Summaries – Auto-generate summaries for blog posts</li>
<li>AI Product Summaries – Auto-generate WooCommerce product summaries</li>
<li>Multiple AI Providers – OpenAI (GPT-4), Anthropic (Claude), Google Gemini, DeepSeek</li>
</ul>
Form Protection Guards
<ul>
<li>Contact Guard – Protect contact forms from spam</li>
<li>Subscribe Guard – Protect newsletter subscription forms</li>
<li>Registration Guard – Protect WordPress user registration</li>
<li>Login Guard – Protect login forms with validation</li>
<li>Comment Guard – Advanced comment spam protection with custom rules</li>
<li>Product Review Guard – Protect WooCommerce product reviews</li>
</ul>
Additional Features
<ul>
<li>Activity Dashboard – Monitor all validation events with analytics</li>
<li>Detailed Logging – Track every blocked attempt with reasons</li>
<li>Blocked Users Management – View and manage blocked users</li>
<li>Custom Error Messages – Customize all validation messages</li>
<li>Email Templates – Customizable notification emails</li>
<li>Translation Ready – Full internationalization support</li>
</ul>
<h4>Supported Forms</h4>
VMS Elements Form Guard works with any HTML form including:
<ul>
<li>Contact Form 7</li>
<li>WPForms</li>
<li>Gravity Forms</li>
<li>Ninja Forms</li>
<li>Formidable Forms</li>
<li>Newsletter Plugin</li>
<li>Mailchimp Forms</li>
<li>WooCommerce Forms</li>
<li>WordPress Registration</li>
<li>WordPress Comments</li>
<li>Any Custom HTML Form</li>
</ul>
<h4>How It Works</h4>
<ol>
<li>Install and Activate – Simple one-click installation</li>
<li>Add Form Mapping – Tell the plugin which forms to protect</li>
<li>Configure Validation – Choose your protection level</li>
<li>Automatic Protection – Forms are protected in real-time</li>
</ol>
<h4>API Keys (Optional)</h4>
Basic protection works without any API keys. For enhanced security:
<ul>
<li>Google Web Risk – Detect malware and phishing domains</li>
<li>VirusTotal – Multi-engine scanning (free tier: 500 requests/day)</li>
<li>AI Providers – Enable intelligent spam detection</li>
</ul>
<h4>Privacy & GDPR</h4>
<ul>
<li>Only email domains are processed for validation, not full email addresses (unless you enable features that require them).</li>
<li>Data is sent to third-party services only when you enter API keys and enable those features.</li>
<li>No personal data is stored on VMS Elements servers by default.</li>
<li>Full GDPR compliance depends on your configuration and privacy policy.</li>
</ul>
<h3>Privacy Policy</h3>
VMS Elements Form Guard does not collect, store, or send any data from your website on its own. Every outbound network call is opt-in and only happens after you explicitly configure the corresponding API key or feature in the plugin settings.
<h4>Third-party services used by this plugin</h4>
The plugin can connect to the following third-party services. Each one is only contacted when you actively enable the matching feature and provide the required API key:
<ul>
<li>Google Web Risk — Sends the email domain or URL hostname being validated to <code>https://webrisk.googleapis.com/v1/uris:search</code>. Requires your own Google API key. <a href="https://cloud.google.com/terms" rel="nofollow ugc">Terms of Service</a> · <a href="https://policies.google.com/privacy" rel="nofollow ugc">Privacy Policy</a>.</li>
<li>VirusTotal — Sends the email domain or URL hostname being validated to <code>https://www.virustotal.com/api/v3/domains/</code>. Requires your own VirusTotal API key. <a href="https://docs.virustotal.com/docs/historic-terms-of-service" rel="nofollow ugc">Terms of Service</a> · <a href="https://docs.virustotal.com/docs/historic-privacy-policy" rel="nofollow ugc">Privacy Policy</a>.</li>
<li>Google reCAPTCHA — Loaded only when you enable reCAPTCHA on a form. The visitor’s browser exchanges a verification token with <code>https://www.google.com/recaptcha/</code>. <a href="https://policies.google.com/terms" rel="nofollow ugc">Terms</a> · <a href="https://policies.google.com/privacy" rel="nofollow ugc">Privacy Policy</a>.</li>
<li>OpenAI — Sends the message body being moderated to <code>https://api.openai.com/v1/chat/completions</code>. Requires your own OpenAI API key. <a href="https://openai.com/policies/terms-of-use" rel="nofollow ugc">Terms</a> · <a href="https://openai.com/policies/privacy-policy" rel="nofollow ugc">Privacy Policy</a>.</li>
<li>Anthropic — Sends the message body being moderated to <code>https://api.anthropic.com/v1/messages</code>. Requires your own Anthropic API key. <a href="https://www.anthropic.com/legal/consumer-terms" rel="nofollow ugc">Terms</a> · <a href="https://www.anthropic.com/legal/privacy" rel="nofollow ugc">Privacy Policy</a>.</li>
<li>Google Gemini — Sends the message body being moderated to <code>https://generativelanguage.googleapis.com/</code>. Requires your own Gemini API key. <a href="https://ai.google.dev/gemini-api/terms" rel="nofollow ugc">Terms</a> · <a href="https://policies.google.com/privacy" rel="nofollow ugc">Privacy Policy</a>.</li>
<li>DeepSeek — Sends the message body being moderated to <code>https://api.deepseek.com/chat/completions</code>. Requires your own DeepSeek API key. <a href="https://chat.deepseek.com/downloads/DeepSeek%20Terms%20of%20Use.html" rel="nofollow ugc">Terms</a> · <a href="https://chat.deepseek.com/downloads/DeepSeek%20Privacy%20Policy.html" rel="nofollow ugc">Privacy Policy</a>.</li>
<li>Amazon Bedrock — Sends the message body being moderated to the AWS Bedrock Runtime endpoint <code>https://bedrock-runtime.{region}.amazonaws.com/model/{model}/invoke</code> (the region and model are the ones you configure). Requires your own AWS access key, secret key, and model ID. <a href="https://aws.amazon.com/service-terms/" rel="nofollow ugc">Terms</a> · <a href="https://aws.amazon.com/privacy/" rel="nofollow ugc">Privacy Policy</a>.</li>
</ul>
<h4>What data is sent</h4>
For each enabled service the plugin sends ONLY:
<ul>
<li>The domain part of the submitted email or the URL hostname, for reputation checks (Web Risk, VirusTotal).</li>
<li>The message text the visitor typed in a guarded textarea, for AI spam moderation (OpenAI, Anthropic, Gemini, DeepSeek, Amazon Bedrock). The chosen AI provider receives the body of the field plus a fixed system prompt.</li>
<li>The reCAPTCHA token generated by the visitor’s browser, for bot-protection verification (Google reCAPTCHA).</li>
</ul>
The plugin does NOT send the full submitted form, IP addresses, user accounts, or any other personal data to these third parties.
<h4>Data stored locally</h4>
The plugin writes only to the WordPress site database. The following tables and options may be created:
<ul>
<li><code>*_vms_elements_form_guard_whitelist_domains</code>, <code>*_vms_elements_form_guard_disposable_domains</code> — Email-domain reputation lists you manage.</li>
<li><code>*_vms_elements_form_guard_logs</code> — Validation events (domain, decision, timestamp). No personal data.</li>
<li><code>*_vms_elements_form_guard_api_keys</code> — Encrypted copies of the API keys you entered.</li>
<li><code>*_vms_elements_form_guard_comment_enforcement</code> — IP/user-ID strike counters for the optional Block User feature.</li>
<li><code>vefg-google-config</code>, <code>vefg-virustotal-config</code>, <code>vefg-ai-span-config</code>, <code>vefg-recaptcha-config</code>, <code>vefg-error-messages</code>, <code>vefg-registration-guard</code> — Plugin settings.</li>
</ul>
All tables and options are removed when you uninstall the plugin.
<h4>Cookies</h4>
The plugin itself does not set any cookies. Google reCAPTCHA sets its own cookies when you enable it.
<h4>GDPR</h4>
Because every outbound request requires an administrator to first enable the matching feature and provide an API key, your site only becomes a “data processor” toward these third parties after you opt in. We recommend listing each enabled service in your site’s own privacy policy.
<h3>External services</h3>
This plugin relies on the following third-party / external services. Each service is contacted ONLY after a site administrator enables the matching feature and provides the required API key or credentials. Nothing is sent by default.
<ol>
<li>
Google Web Risk — Used to detect malware and phishing domains. The email domain or URL hostname being validated is sent to <code>https://webrisk.googleapis.com/v1/uris:search</code> each time a guarded field is validated and this feature is enabled. Provided by Google. <a href="https://cloud.google.com/terms" rel="nofollow ugc">Terms of Service</a> — <a href="https://policies.google.com/privacy" rel="nofollow ugc">Privacy Policy</a>.
</li>
<li>
VirusTotal — Used for multi-engine domain reputation scanning. The email domain or URL hostname being validated is sent to <code>https://www.virustotal.com/api/v3/domains/</code> each time a guarded field is validated and this feature is enabled. Provided by VirusTotal (Google). <a href="https://docs.virustotal.com/docs/historic-terms-of-service" rel="nofollow ugc">Terms of Service</a> — <a href="https://docs.virustotal.com/docs/historic-privacy-policy" rel="nofollow ugc">Privacy Policy</a>.
</li>
<li>
Google reCAPTCHA — Used for bot protection on guarded forms. When enabled, the visitor’s browser exchanges a verification token with <code>https://www.google.com/recaptcha/</code>. Provided by Google. <a href="https://policies.google.com/terms" rel="nofollow ugc">Terms of Service</a> — <a href="https://policies.google.com/privacy" rel="nofollow ugc">Privacy Policy</a>.
</li>
<li>
OpenAI — Used for AI spam moderation. The message text typed in a guarded field is sent to <code>https://api.openai.com/v1/chat/completions</code> when AI moderation is enabled with this provider. Provided by OpenAI. <a href="https://openai.com/policies/terms-of-use" rel="nofollow ugc">Terms of Use</a> — <a href="https://openai.com/policies/privacy-policy" rel="nofollow ugc">Privacy Policy</a>.
</li>
<li>
Anthropic — Used for AI spam moderation. The message text typed in a guarded field is sent to <code>https://api.anthropic.com/v1/messages</code> when AI moderation is enabled with this provider. Provided by Anthropic. <a href="https://www.anthropic.com/legal/consumer-terms" rel="nofollow ugc">Terms</a> — <a href="https://www.anthropic.com/legal/privacy" rel="nofollow ugc">Privacy Policy</a>.
</li>
<li>
Google Gemini — Used for AI spam moderation. The message text typed in a guarded field is sent to <code>https://generativelanguage.googleapis.com/</code> when AI moderation is enabled with this provider. Provided by Google. <a href="https://ai.google.dev/gemini-api/terms" rel="nofollow ugc">Terms</a> — <a href="https://policies.google.com/privacy" rel="nofollow ugc">Privacy Policy</a>.
</li>
<li>
DeepSeek — Used for AI spam moderation. The message text typed in a guarded field is sent to <code>https://api.deepseek.com/chat/completions</code> when AI moderation is enabled with this provider. Provided by DeepSeek. <a href="https://chat.deepseek.com/downloads/DeepSeek%20Terms%20of%20Use.html" rel="nofollow ugc">Terms</a> — <a href="https://chat.deepseek.com/downloads/DeepSeek%20Privacy%20Policy.html" rel="nofollow ugc">Privacy Policy</a>.
</li>
<li>
Amazon Bedrock — Used for AI spam moderation. The message text typed in a guarded field is sent to the AWS Bedrock Runtime endpoint <code>https://bedrock-runtime.{region}.amazonaws.com/model/{model}/invoke</code> (region and model are the ones you configure) when AI moderation is enabled with this provider. Provided by Amazon Web Services. <a href="https://aws.amazon.com/service-terms/" rel="nofollow ugc">Service Terms</a> — <a href="https://aws.amazon.com/privacy/" rel="nofollow ugc">Privacy Policy</a>.
</li>
</ol>

VMS Elements Form Guard

Protect your WordPress forms from spam, fake emails, and malicious domains with advanced validation and AI-powered detection.

fiddlemail.com

Disposable email addresses are temporary, throw-away addresses that expire after a short period of time. Our Fiddlemail API helps you to identify domains of fake email addresses and blocks them. All you need to start is a free API key from <a href="https://fiddlemail.com" rel="nofollow ugc">Fiddlemail</a>.

Fiddlemail

Identify and block disposable fake email addresses to prevent junk user registration and comments.

VMS Elements Form Guard vs Fiddlemail