內容簡介
AccessNow Spam Eater 是一款有效阻擋機器人提交的外掛，能夠保護網站表單不被垃圾郵件侵擾。它不需要使用 CAPTCHA，並在伺服器端進行多重檢查，確保真實訪客的順利提交。
【主要功能】
• 隱藏欄位檢查，防止機器人填寫
• JavaScript 令牌檢查，攔截不執行 JS 的機器人
• 時間檢查，拒絕快速提交的表單
• 互動檢查，確保用戶有實際操作
• 自訂垃圾郵件過濾詞彙，實時檢查提交內容
• 登入表單專用的隱藏欄位檢查
外掛標籤
開發者團隊
原文外掛簡介
Spam Eater quietly checks every protected form submission and blocks the ones sent by bots. Real visitors never see a puzzle or a CAPTCHA, and nothing is sent to an outside service.
Each submission goes through up to four checks:
Honeypot – a hidden field that people never see, but bots fill in.
JavaScript token – set by a small script, so bots that don’t run JavaScript are caught.
Timing – forms sent within three seconds of loading, or from a page that is too old, are rejected.
Interaction – a mouse, keyboard, touch or scroll event must have happened on the page. The visitor then gets their own interaction token from your site; it is never in the page, so a bot can’t copy it, and each one only passes a few submissions.
Login forms only use the honeypot check, so password managers and visitors without JavaScript can still log in.
IP addresses that keep filling in the hidden honeypot field are blocked for a while (5 times and 24 hours by default, both adjustable). While blocked, an address can’t send any protected form. It can still log in, so a shared address can never lock you out of your own site.
Also included, all running on your own server
Your own words and patterns to block, for spam that people type by hand: words, links or regular expressions, checked in memory as the form arrives and never stored.
Turn away throwaway email addresses, using a list of disposable email domains that comes with the plugin, so no address is ever sent anywhere to be checked.
Always allow and Always block lists of IP addresses and ranges (CIDR, IPv4 and IPv6).
Slow down password guessing: repeated failed logins for one username from one address wait a little longer each time, without ever locking out the real owner.
A spam summary on the Dashboard with the last 30 days, and an optional weekly email.
Test a form as a bot: administrators get a button under each protected form that sends it as a bot would and reports whether Spam Eater refused it.
WP-CLI commands for statistics, unblocking, settings and the allow and block lists.
The optional extras are off until you turn them on.
Protected forms
WordPress comments, login, registration and lost password forms (and plugins that use them, such as Theme My Login and WooCommerce reviews)
WooCommerce classic checkout and Checkout block, including card-testing bots that post to the Store API (express payment buttons keep working), Pay for Order, and My Account login, registration, lost password and account details
Contact Form 7, Gravity Forms, WPForms, Formidable Forms, Fluent Forms, Ninja Forms, Forminator, HTML Forms, QuForm, Clean and Simple Contact Form, Jetpack Forms, Kadence Forms, WS Form, JetFormBuilder, SureForms and Everest Forms
Elementor Pro forms, Bricks Builder forms and the Beaver Builder contact form
bbPress, BuddyPress (and BuddyBoss, Youzify), Ultimate Member, UsersWP, wpDiscuz, MemberPress and Paid Memberships Pro
MC4WP (Mailchimp for WordPress), MailPoet, Brevo, Easy Digital Downloads checkout and GiveWP (option-based donation forms)
Your own forms, through three developer functions (see the FAQ)
Each integration can be turned off under Settings → Spam Eater. Integrations only load when the matching plugin is active, and the small script only loads on pages that show a protected form.
Privacy
No cookies, no tracking and no calls to outside services.
What people type into forms is never stored.
The IP block list keeps a one-way hash of each address plus an anonymised version for display, and entries expire automatically.
The spam log is off by default. When turned on, it records only the time, reason, page and an anonymised IP address, and keeps entries for 30 days.
The spam summary keeps only daily counts per reason: no addresses or contents.
The login throttle (off by default) keeps a keyed hash of the address and username of failed logins, for an hour at most.
Addresses you type into Always allow, Always block and Trusted proxies are kept as you typed them.
Suggested text is added to Settings → Privacy for your privacy policy.
Credits
Disposable email domains: the disposable-email-domains project, https://github.com/disposable-email-domains/disposable-email-domains, CC0 1.0 Universal.
Check engine (includes/engine/): Spam Eater for PHP forms, https://github.com/scratchy-76/spam-eater-php, by AccessNow, MIT licence (GPL-compatible).
