Blueforce Spam Protect

Blueforce Spam Protect checks every submission of your forms and comments on your own server. There is no captcha, no puzzle and, unless you switch it on yourself, no external service. Visitors do not notice anything.

What it is, and what it is not. The plugin reduces spam from bots. It cannot guarantee that every spam submission is stopped, and a real submission can occasionally look suspicious. That is why only clear spam is rejected, and everything that merely looks suspicious is still delivered and written to the log. Newsletter sign-ups are the exception: a suspicion is enough to reject them.

Why another anti-spam plugin

Many spam plugins either send every submission to a cloud service or put a captcha in front of your visitors. This plugin does neither.

• Everything stays on your server. Out of the box nothing is sent to an external service, and there is no spam service to name in your privacy policy. Two optional functions use StopForumSpam, a check of the sender’s IP address and the reporting of bots. Both are off by default, and the message of a form is never sent in either case.
• No captcha. Real visitors fill in the form as usual.
• Suspicious enquiries are still delivered. They are written to the log with the reasons. False positives remain possible; the optional local quarantine helps you review blocked enquiries.
• Works with page caches. The fields are added by a small script in the browser, the token is only requested when a visitor starts filling in a form.

How it decides

Each submission collects points from several independent checks:

• A hidden field that only bots fill in.
• A signed token that proves a real browser loaded the page. The server measures how long filling in the form took, the browser cannot fake it.
• A small computing task that the browser solves in the background while the visitor fills in the form (proof of work). Visitors do not notice it, a bot has to pay for it with computing time on every submission. A token can only be used a few times.
• Whether the visitor used mouse, keyboard or touch, whether a longer text was typed without a single correction, and whether the browser is remote-controlled. Only the fact is noted, never which keys, how often or when.
• Missing browser language or browser headers, script user agents.
• Links, stop words and text in an unexpected script or language.
• Advertising in the name or signature: a web address in the name field, or a text that ends with a link carrying the sender’s own name.
• Whether the e-mail domain exists at all (DNS lookup, only when it can change the decision).
• Too many submissions from the same address, or with the same e-mail domain, in a short time.

Below the suspicion threshold a submission is accepted. Suspicious submissions are delivered and written to the log. Only from the block threshold on is a submission rejected, with a clear message to the visitor. Newsletter sign-ups are rejected from the suspicion threshold on, because a suspicious sign-up would add a fake contact to the list.

The plugin protects from the moment you activate it, there is nothing to switch on. If the log ever shows a real enquiry among the blocked ones, allow the sender with one click or raise the block threshold.

Features

• WordPress comments: blocked comments go to the spam folder, suspicious ones to moderation. Commenters who already have an approved comment get a bonus, so regulars are not held back
• Pingbacks and trackbacks are checked as well, without the browser checks they cannot pass. Pingbacks from your own site are left alone
• Elementor Pro forms
• Fluent Forms
• Contact Form 7
• Ninja Forms
• Booking Calendar (the booking form of the plugin “Booking Calendar”)
• WPForms
• Forminator
• MetForm
• Jetpack contact form
• Gravity Forms (tested with version 3.1.3, including multi-page and Ajax forms)
• WordPress registration (wp-login.php?action=register, on multisite wp-signup.php): a blocked registration creates no account, a suspicious one is created and logged
• WooCommerce registration on the My account page, with the same rules. The checkout is left alone on purpose
• Mailchimp for WordPress (MC4WP) sign-up forms: a blocked sign-up is not sent to Mailchimp. Unsubscribing is never blocked
• MailerLite sign-up forms created in the official MailerLite plugin: a blocked sign-up is not sent to MailerLite. Forms and pop-ups that MailerLite serves from its own servers cannot be checked by any plugin on your site
• Protects right after activation, with adjustable thresholds
• Log of suspicious and blocked submissions with the reasons, counters for the last 30 days
• Your own stop words, an allowlist and a block list for IP addresses, ranges and e-mail domains. An allowed IP address always passes. An allowed e-mail domain only passes when a real browser sent the form and the hidden field is empty, because anyone can type a domain
• Allow or block a sender with one click in the log. IP addresses from these buttons expire after 30 days, free mail domains are never allowed as a whole
• Optional: check the IP address of the sender at StopForumSpam. Off by default, only the IP address is sent, and it can only be switched on together with a confirmation that your privacy policy mentions it
• Optional: report bots that fill in the hidden field to StopForumSpam, with your own API key. Off by default, a separate switch with its own confirmation. A report contains IP address, e-mail address and name, never the message
• The admin bar shows administrators how many submissions were blocked in the last 30 days. Can be switched off in the settings
• Dashboard widget with the numbers of the last 30 days and a small chart of blocked submissions per day
• Protection overview and Site Health show detected integrations and disabled or unsupported protection. They do not prove that every form is protected or that mail was delivered.
• Guided function test for administrators: check a normal submission and a block in your own browser. Tests are marked in the log, excluded from statistics and WebCare reports, never stored in the quarantine and never checked or reported at StopForumSpam. A normal test can trigger the real form actions. The test ends after 15 minutes; other visitors are unaffected.
• Optional quarantine: keeps blocked submissions for 14 days on your own server, so no genuine enquiry is lost when the check gets it wrong. Off by default, needs your confirmation that the privacy policy mentions it. At most 200 submissions are kept. Fields that look like passwords, payment details or uploads are left out, recognised by their name, their type and their value. Switching it off or deactivating the plugin deletes what is stored. Works with the personal data export and erasure tools of WordPress
• Optional, for customers of blueforce WebCare: sends the daily counters to their WebCare account, so the numbers appear in the monthly report. Off by default, needs a site key, your consent and your confirmation that your privacy policy mentions it. Only numbers are sent, never IP addresses, senders or contents. The key unlocks nothing in the plugin
• Suggested text for your privacy policy
• Translation-ready. German is included for Germany (informal and formal) and for Switzerland (formal and informal)
• Removes all its data when you delete it

For developers

• bf_spam_signals receives all signals before scoring, for example to add a block list.
• bf_spam_checked fires after every decision, with the result, the form and the IP address.
• bf_spam_trusted_proxies (or the constant BF_SPAM_TRUSTED_PROXIES) adds your own proxies or load balancers, as addresses or ranges. Cloudflare and private addresses are trusted already.
• bf_spam_client_ip overrides the visitor address as a last resort.
• bf_spam_skip_selector leaves forms matching a CSS selector alone.
• bf_spam_site_languages sets the languages your site expects enquiries in, as two-letter codes. An empty array switches the language check off.
• bf_spam_mail_domain_lookup replaces the DNS lookup, for example in tests.
• bf_spam_registration_message changes the message shown when a registration is blocked.
• bf_spam_signup_message changes the answer sent when a newsletter sign-up is blocked.
• bf_spam_pow_bits sets the difficulty of the computing task in bits (default 19, 0 switches it off, each bit doubles the work).
• bf_spam_sfs_min_frequency sets from how many reports at StopForumSpam an address counts as known (default 3).
• bf_spam_sfs_report has the last word on whether a sender is reported to StopForumSpam. Return false to prevent it.
• Add data-bf-spam-skip to a form to leave it out.

This plugin is an independent project by Blueforce Digital Solutions. It is not affiliated with Elementor, Fluent Forms, Contact Form 7, Ninja Forms, Booking Calendar, WPForms, Forminator, MetForm, Jetpack, Gravity Forms, WooCommerce, Mailchimp, Mailchimp for WordPress or MailerLite. Product names are used only to describe compatibility.

Privacy

By default nothing a visitor writes leaves your server. The only outside request is a DNS lookup of the e-mail domain (not the address), through the name server of your hosting, and only when the result can change the decision. For suspicious and blocked submissions the IP address and the domain of the e-mail address are stored for up to 30 days, then deleted automatically, also on sites where WP-Cron rarely runs. If you allow or block a sender with a button in the log, the IP address is kept for a further 30 days and an allowed e-mail domain until you remove it. Message texts, names and full e-mail addresses are not stored, unless you switch on the optional quarantine: it keeps blocked submissions on your own server for 14 days, so you can read them in the log. A suggested text for your privacy policy is added under Settings, Privacy.

If you switch on the optional StopForumSpam check, the IP address of the sender is sent to stopforumspam.com when a form is submitted. If you switch on the optional reporting, the IP address, the e-mail address and the name of a bot that filled in the hidden field are sent to stopforumspam.com and published there. The message of a form is never sent. See External services below.

If you connect the plugin to blueforce WebCare, the daily counters are sent to care.blueforce.ch once a day: numbers only, no IP addresses, no senders, no contents. See External services below.

External services

This plugin can connect to StopForumSpam (https://www.stopforumspam.com), a service that collects the addresses of known spammers. There are two separate functions. Both are optional and off by default, and each can only be switched on in the settings together with its own confirmation that your privacy policy mentions it.

1. Checking the sender. When it is switched on, the plugin sends the IP address of the sender to https://api.stopforumspam.org/api each time a protected form or comment is submitted, to learn whether the address has been reported as a spammer. Nothing else is sent: no message, no name, no e-mail address. The answer is remembered for one day, so the same address is not sent again within that time. Nothing is sent for page views, for senders on your allowlist, or when a submission is already blocked for another reason. If the service does not answer, the submission is treated as if the check were off.

2. Reporting spammers. When it is switched on and you have entered your own API key from StopForumSpam, the plugin sends a report to https://www.stopforumspam.com/add when a submission is blocked because the hidden field was filled in, a field that human visitors never see, and the submission shows at least one more sign of a bot (for example no JavaScript, no interaction or a remote-controlled browser). The second sign is required because an autofill tool could fill the hidden field for a real visitor: that submission is blocked, but not reported. The report contains the IP address, the e-mail address and the name or user name entered in the form, a fixed sentence as evidence, and your API key. StopForumSpam requires these three details for a report and publishes reported entries in its database. The message is never sent. Nothing is reported for a mere suspicion, for senders on your allowlist, for logged-in users, for private addresses, or when the form has no name or no e-mail address. Each address is reported at most once a day. The plugin does not store the reported name or e-mail address. When you open the settings page with a key entered, the plugin asks StopForumSpam once whether the key is valid. That request contains only the key, and the result is shown as a green or red light next to the key field.

The data belongs to StopForumSpam and is used under its terms: usage terms, license, privacy policy.

This plugin can also connect to blueforce WebCare (https://blueforce.ch/webcare), the website maintenance service of the author of this plugin. The connection is optional and off by default. It is only useful for customers of that service: their monthly maintenance report then shows how many spam submissions were blocked. The plugin protects in exactly the same way with or without it, the connection unlocks no function.

Sending the daily counters to blueforce WebCare. When you have entered the site key from your WebCare account and ticked both boxes in the settings (your consent, and your confirmation that your privacy policy mentions the transfer), the plugin sends a request to https://care.blueforce.ch/open/spam-report.php once a day. It contains, for each day since the last confirmed transfer, the date and three numbers (accepted, suspicious and blocked submissions), the version of this plugin, the day counting started on your site and the number of entries in the quarantine, if it is switched on. The request is signed with your site key, and the number of your site in WebCare is sent along. Nothing else is sent: no IP addresses, no senders, no e-mail addresses, no message texts. Nothing is sent while the connection is switched off, and never while a form is submitted. If the service does not answer, the plugin tries again the next day. The settings page shows what is sent, when the last transfer succeeded and whether the last attempt failed.

The service is provided by Blueforce Digital Solutions: terms, privacy policy.