AccessNow Spam Eater

Spam Eater quietly checks every protected form submission and blocks the ones sent by bots. Real visitors never see a puzzle or a CAPTCHA, and nothing is sent to an outside service.

Each submission goes through up to four checks:

1. Honeypot – a hidden field that people never see, but bots fill in.
2. JavaScript token – set by a small script, so bots that don’t run JavaScript are caught.
3. Timing – forms sent within three seconds of loading, or from a page that is too old, are rejected.
4. Interaction – a mouse, keyboard, touch or scroll event must have happened on the page. The visitor then gets their own interaction token from your site; it is never in the page, so a bot can’t copy it, and each one only passes a few submissions.

Login forms only use the honeypot check, so password managers and visitors without JavaScript can still log in.

IP addresses that keep filling in the hidden honeypot field are blocked for a while (5 times and 24 hours by default, both adjustable). While blocked, an address can’t send any protected form. It can still log in, so a shared address can never lock you out of your own site.

Also included, all running on your own server

• Your own words and patterns to block, for spam that people type by hand: words, links or regular expressions, checked in memory as the form arrives and never stored.
• Turn away throwaway email addresses, using a list of disposable email domains that comes with the plugin, so no address is ever sent anywhere to be checked.
• Always allow and Always block lists of IP addresses and ranges (CIDR, IPv4 and IPv6).
• Slow down password guessing: repeated failed logins for one username from one address wait a little longer each time, without ever locking out the real owner.
• A spam summary on the Dashboard with the last 30 days, and an optional weekly email.
• Test a form as a bot: administrators get a button under each protected form that sends it as a bot would and reports whether Spam Eater refused it.
• WP-CLI commands for statistics, unblocking, settings and the allow and block lists.

The optional extras are off until you turn them on.

Protected forms

• WordPress comments, login, registration and lost password forms (and plugins that use them, such as Theme My Login and WooCommerce reviews)
• WooCommerce classic checkout and Checkout block, including card-testing bots that post to the Store API (express payment buttons keep working), Pay for Order, and My Account login, registration, lost password and account details
• Contact Form 7, Gravity Forms, WPForms, Formidable Forms, Fluent Forms, Ninja Forms, Forminator, HTML Forms, QuForm, Clean and Simple Contact Form, Jetpack Forms, Kadence Forms, WS Form, JetFormBuilder, SureForms and Everest Forms
• Elementor Pro forms, Bricks Builder forms and the Beaver Builder contact form
• bbPress, BuddyPress (and BuddyBoss, Youzify), Ultimate Member, UsersWP, wpDiscuz, MemberPress and Paid Memberships Pro
• MC4WP (Mailchimp for WordPress), MailPoet, Brevo, Easy Digital Downloads checkout and GiveWP (option-based donation forms)
• Your own forms, through three developer functions (see the FAQ)

Each integration can be turned off under Settings → Spam Eater. Integrations only load when the matching plugin is active, and the small script only loads on pages that show a protected form.

Privacy

• No cookies, no tracking and no calls to outside services.
• What people type into forms is never stored.
• The IP block list keeps a one-way hash of each address plus an anonymised version for display, and entries expire automatically.
• The spam log is off by default. When turned on, it records only the time, reason, page and an anonymised IP address, and keeps entries for 30 days.
• The spam summary keeps only daily counts per reason: no addresses or contents.
• The login throttle (off by default) keeps a keyed hash of the address and username of failed logins, for an hour at most.
• Addresses you type into Always allow, Always block and Trusted proxies are kept as you typed them.
• Suggested text is added to Settings → Privacy for your privacy policy.

Credits

• Disposable email domains: the disposable-email-domains project, https://github.com/disposable-email-domains/disposable-email-domains, CC0 1.0 Universal.
• Check engine (includes/engine/): Spam Eater for PHP forms, https://github.com/scratchy-76/spam-eater-php, by AccessNow, MIT licence (GPL-compatible).