Title: QWeb Spam Shield Author: qwebmaster Published: Hulyo 23, 2026 Last modified: Setyembre 10, 2026 --- Maghanap ng mga plugin ![](https://ps.w.org/qweb-spam-shield/assets/banner-772x250.png?rev=3619777) ![](https://ps.w.org/qweb-spam-shield/assets/icon-256x256.png?rev=3619777) # QWeb Spam Shield Ni [qwebmaster](https://profiles.wordpress.org/qwebmaster/) [I-download](https://downloads.wordpress.org/plugin/qweb-spam-shield.1.1.0.zip) * [Mga Detalye](https://tl.wordpress.org/plugins/qweb-spam-shield/#description) * [Mga Review](https://tl.wordpress.org/plugins/qweb-spam-shield/#reviews) * [Pag-install](https://tl.wordpress.org/plugins/qweb-spam-shield/#installation) * [Development](https://tl.wordpress.org/plugins/qweb-spam-shield/#developers) [Suporta](https://wordpress.org/support/plugin/qweb-spam-shield/) ## Deskripsyon QWeb Spam Shield blocks spam across your entire site, not just your contact form, and it does it without a single CAPTCHA. No puzzles for your real visitors, no account, no API key, and no external service. Everything runs on your own server and nothing ever leaves your site. Most anti-spam plugins only watch comments or a single form. QWeb Spam Shield guards every place spam and abuse actually get in: * Every form: Gravity Forms, Contact Form 7, WPForms, Fluent Forms, Elementor Pro Forms, Ninja Forms and Formidable, plus a universal wp_mail catch-all that automatically covers any other form plugin * WordPress comments and WooCommerce product reviews * User registration, so fake and bot sign-ups are stopped before an account is ever created * WooCommerce checkout, with card-testing (carding) defenses that stop attackers from validating stolen cards on your store with waves of fake orders, and running up your payment processing fees * Your outbound email: the built-in Mail Guard rate-limits the mail your own site sends, so a hacked form or a runaway plugin cannot blast thousands of messages and wreck your domain’s sending reputation No CAPTCHA, ever. Your visitors never see a checkbox, a puzzle, or a “click all the crosswalks” challenge. Detection runs invisibly in the background, so genuine customers sail through and only spam is stopped. How it decides (fast, all local): * Content signals: links in messages, gibberish, non-Latin scripts (French, German, and Spanish accents are allowed), marketing-pitch phrasing, and banned keywords matched on whole words * Identity signals: disposable-email domains (a bundled list of about 7,900), missing MX records with typo tolerance, and role accounts * Behavioral signals: honeypot, submission timing, and per-email or per-IP velocity for repeat offenders Built for site owners: * A grouped spam log. A 1,000-request attack is one counted row, not 1,000, so your day-to-day spam stays visible. It is auto-cleaned by age and a row cap. * Conservative by design. Genuine customer questions are not hard-blocked. Borderline submissions are held for review, never silently lost, and can be re-delivered. * Comments use WordPress moderation (spam folder or moderation queue), so nothing is destroyed. * GDPR friendly: IP anonymization, configurable retention, and support for Tools then Export or Erase Personal Data. Privacy: QWeb Spam Shield makes no external HTTP requests. It does not phone home, and it does not require a license, account, or third-party service. Need even stronger protection? Meet QWeb Spam Shield AI This free plugin is fully functional on its own and always will be. QWeb Spam Shield AI is the premium edition for sites that want the strongest protection possible. It layers a managed AI engine and a cross-site defense network on top of everything above: * Managed AI tiebreaker. A purpose-built AI reviews only the borderline submissions the rules engine is unsure about, so you catch more real spam without ever blocking a genuine customer. There is no API key to buy or configure. It is included with your license. * AI review of held submissions. Every held message is re-checked against your own business context, and real customer inquiries are released automatically. False positives drop close to zero, completely hands-off. * Cross-site pattern network. The instant spam is confirmed on any protected site, every other licensed site is protected from it too, so your site benefits from attacks aimed at everyone else. * Sharper detection that keeps improving, tuned continuously on live spam across the whole network. * Faster, fully automatic updates delivered straight to your dashboard. * Priority support from the team that builds it. Get QWeb Spam Shield AI at https://qwebspamshield.com ### Source code and build tools The plugin ships all of its source. The only compiled asset is the React admin app in admin/build/, generated from the human-readable source included in admin/src/ with the official WordPress build tooling: 1. Run `npm install` in the plugin root (uses package.json, @wordpress/scripts). 2. Run `npm run build`. This regenerates admin/build/index.js and style-index.css. Everything else (PHP, the frontend honeypot script in assets/js/, CSS) is plain, unminified source. The bundled disposable-email-domain list in data/ comes from the public domain disposable-email-domains project (github.com/disposable-email- domains). ## Mga Screenshot [⌊Dashboard: spam blocked, held, and allowed at a glance, with recent activity and sources.⌉⌊Dashboard: spam blocked, held, and allowed at a glance, with recent activity and sources.⌉[ Dashboard: spam blocked, held, and allowed at a glance, with recent activity and sources. [⌊Activity log: every inbound and outbound decision, with the reason it was flagged.⌉⌊ Activity log: every inbound and outbound decision, with the reason it was flagged .⌉[ Activity log: every inbound and outbound decision, with the reason it was flagged. [⌊Detection settings: tune the fast, multi-layer rules engine and the score thresholds.⌉⌊ Detection settings: tune the fast, multi-layer rules engine and the score thresholds .⌉[ Detection settings: tune the fast, multi-layer rules engine and the score thresholds. [⌊Integrations: turn protection on per form plugin, comments, registration, and WooCommerce.⌉⌊Integrations: turn protection on per form plugin, comments, registration, and WooCommerce.⌉[ Integrations: turn protection on per form plugin, comments, registration, and WooCommerce. [⌊Mail Guard: rate-limit outbound email, auto-ban flooders, and hold overflow for review.⌉⌊Mail Guard: rate-limit outbound email, auto-ban flooders, and hold overflow for review.⌉[ Mail Guard: rate-limit outbound email, auto-ban flooders, and hold overflow for review. [⌊Spam patterns: signatures the plugin learned from spam blocked on your own site.⌉⌊ Spam patterns: signatures the plugin learned from spam blocked on your own site.⌉[ Spam patterns: signatures the plugin learned from spam blocked on your own site. [⌊Privacy: review digests, data retention, and GDPR export and erase options.⌉⌊Privacy: review digests, data retention, and GDPR export and erase options.⌉[ Privacy: review digests, data retention, and GDPR export and erase options. [⌊Setup wizard: confirm protection is live and which forms are covered.⌉⌊Setup wizard: confirm protection is live and which forms are covered.⌉[ Setup wizard: confirm protection is live and which forms are covered. ## Pag-install 1. Upload the plugin to /wp-content/plugins/, or install it from Plugins then Add New, and activate it. 2. That is it. Protection is on by default with safe settings. Review and tune it under Spam Shield. ## FAQ ### Does it need an account or API key? No. It runs entirely on your server with no account, no API key, and no external calls. ### Will it block real customers? It is tuned to avoid that. Genuine product, order, and shipping questions pass through. Only high-confidence spam is filed away, and borderline submissions are held for review rather than deleted. ### Does it cover my form plugin? Gravity Forms, Contact Form 7, WPForms, Fluent Forms, Elementor Pro Forms, Ninja Forms, and Formidable Forms have dedicated integrations. Any other form plugin is still covered by the universal wp_mail catch-all. ### Does it work with WooCommerce? Yes. It covers product reviews and both the classic and block (Store API) checkout, with card-testing defenses. High-Performance Order Storage (HPOS) is supported. ### How is the free edition different from QWeb Spam Shield AI? The free edition is the complete local rules engine: every form integration, comments and reviews, registration, classic and block WooCommerce checkout with card-testing and identity-velocity defenses, Mail Guard for outbound mail, held-for-review with re-delivery, and GDPR export and erase. It makes no external requests and needs no account. Spam Shield AI adds the managed AI tiebreaker for borderline submissions, AI review of held items against your own business profile, the cross-site pattern network, an optional Cloudflare Turnstile rescue challenge, country blocking, the weekly protection report, automatic updates and priority support. ### Is my data sent anywhere? No. The plugin makes no external requests and stores everything locally, with optional IP anonymization and content retention limits. ## Mga Review Wala pang reviews para sa plugin na ito. ## Mga Contributor at Developer Ang “QWeb Spam Shield” ay open source software. Ang mga sumusunod na tao ay nag- ambag sa plugin na ito. Mga Contributor * [ qwebmaster ](https://profiles.wordpress.org/qwebmaster/) [Isalin ang “QWeb Spam Shield” sa iyong wika.](https://translate.wordpress.org/projects/wp-plugins/qweb-spam-shield) ### Interesado sa development? [Tingnan ang code](https://plugins.trac.wordpress.org/browser/qweb-spam-shield/), i-check ang [SVN repository](https://plugins.svn.wordpress.org/qweb-spam-shield/), o mag-subscribe sa [development log](https://plugins.trac.wordpress.org/log/qweb-spam-shield/) sa pamamagitan ng [RSS](https://plugins.trac.wordpress.org/log/qweb-spam-shield/?limit=100&mode=stop_on_copy&format=rss). ## Changelog #### 1.1.0 * Added: identity velocity for WooCommerce checkout. Card-testing attacks now rotate through residential proxies with a fresh IP and a fresh email on every order, which per-IP and per-email limits cannot see. The plugin now also counts orders that share one billing identity (name, street and postcode) and orders whose email reduces to the same stem once digits are stripped, and refuses the identity once it repeats. Refused identities go on a checkout blocklist (wp qweb-asai checkout-blocklist). Known customers are exempt. * Added: store-wide burst detection with an optional hard ceiling (off by default). * Added: the checkout defense thresholds are editable under Settings > Integrations. * Fixed: an order put on hold by the payment gateway counted as a returning customer and exempted that email from every checkout limit. Only paid orders older than a day count now, and a card-gateway hold counts toward failed-payment velocity. * Added: a one-time request for a review after the plugin has blocked fifty spam submissions. #### 1.0.6 * Fixed: the weekly country-database refresh could end in a fatal error. The free edition does not include the downloader that task calls, and the task did not check before calling it. Sites that had the task left over from a previous install would see the error in their cron run. The task now exits quietly when the downloader is not present. #### 1.0.5 * Fixed: the Fluent Forms integration scored every submission twice. Fluent Forms fires both its modern validation filter and a legacy alias for the same submission, so each visitor counted double toward velocity limits, the log grew two rows per submission, and the second scoring run could cross a block threshold the first run did not. The integration now scores once per submission and replays that outcome on the duplicate call. #### 1.0.4 * Fixed: the Fluent Forms integration could silently reject genuine submissions. The scoring pipeline was fed Fluent Forms’ own framework fields, so the random- hex form nonce tripped the gibberish heuristic on every submission, and the resulting error was attached to that hidden field so the visitor saw no response. Framework fields are now excluded from scoring, only a hard block rejects the form (borderline submissions are held for review instead), and a block error now shows on the first visible field. * Changed: weak signals alone never hard-block. Soft heuristics (lone junk tokens, low-count velocity, a single link) could stack past the block threshold with no actual spam content. A hard block now requires at least one strong signal; anything weaker is held for review, so the message stays recoverable. #### 1.0.3 * Hardening: every PHP file now carries a direct-access guard. 95 files had none, so requesting one directly ran its top-level code instead of exiting. * Build: the packaging script now excludes .DS_Store and asserts both that exclusion and the direct-access guards, so neither can come back. #### 1.0.2 * Removed development files from the package (.github) and removed the Mail Guard development simulator from the plugin entirely. #### 1.0.1 * Hardened database queries and input handling following plugin review feedback. Regex patterns are length-capped and unsafe shapes are refused before evaluation. #### 1.0.0 * First public release. Multi-layer rules engine. Integrations for Gravity Forms, Contact Form 7, WPForms, Fluent Forms, Elementor, Ninja Forms, Formidable, comments, registration, and WooCommerce (classic and block checkout). Universal wp_mail catch-all. Mail Guard outbound throttle. Grouped spam log. Held-submission review and re-delivery. GDPR export and erase. No external calls. ## Meta * Bersyon **1.1.0** * Huling na-update **1 linggo ang nakalipas** * Mga aktibong installation **Wala pang 10** * Bersyon ng WordPress ** 5.8 o mas bago ** * Sinubukan hanggang **7.1.1** * Bersyon ng PHP ** 7.4 o mas bago ** * Wika * [English (US)](https://wordpress.org/plugins/qweb-spam-shield/) * Mga Tag * [antispam](https://tl.wordpress.org/plugins/tags/antispam/)[contact form](https://tl.wordpress.org/plugins/tags/contact-form/) [no captcha](https://tl.wordpress.org/plugins/tags/no-captcha/)[spam](https://tl.wordpress.org/plugins/tags/spam/) [woocommerce](https://tl.wordpress.org/plugins/tags/woocommerce/) * [Advanced View](https://tl.wordpress.org/plugins/qweb-spam-shield/advanced/) ## Mga Rating No reviews have been submitted yet. [Ang iyong review](https://wordpress.org/support/plugin/qweb-spam-shield/reviews/#new-post) [Tingnan lahat ng mga review](https://wordpress.org/support/plugin/qweb-spam-shield/reviews/) ## Mga Contributor * [ qwebmaster ](https://profiles.wordpress.org/qwebmaster/) ## Suporta May gusto kang sabihin? Kailangan ng tulong? [Tingnan ang support forum](https://wordpress.org/support/plugin/qweb-spam-shield/)