內容簡介
Gecka Antispam 是一款有效防止垃圾留言的 WordPress 外掛，支援多種表單如評論、註冊及 WooCommerce 等，無需使用 CAPTCHA，簡化使用者體驗，並確保所有資料僅在伺服器內處理，保障隱私。
【主要功能】
• 防止垃圾留言，無需 CAPTCHA
• 自動學習垃圾訊息，提升過濾效果
• 支援多種表單，包括 WooCommerce 和 Contact Form 7
• 提供詳細的統計數據與日誌記錄
• 保障使用者隱私，無資料外洩
外掛標籤
開發者團隊
原文外掛簡介
Gecka Antispam stops spam on comments, login, registration, WooCommerce, Contact Form 7, Gravity Forms, ACF front-end forms and the forms you wrote yourself. There is no captcha: a visitor fills the form and sends it, nothing more. The checks run on your server, and no service outside the site reads what your visitors write.
How it catches bots
Most spam bots post without loading the page, fill in every field they find, or type random letters where a name goes. Each protected form carries:
a signed timestamp: a form sent faster than anybody types, or days after it was shown, is refused
a honeypot, a field people never see and bots fill in
checks on what was typed: a name or a one-word message made of random letters, a message of too few words, a user agent no browser sends
A bot caught gets an error page. A person caught by mistake gets the same page, with a link back, and sends again: nothing is lost silently.
A filter that learns from you
Bots that load the page and fill the form like a person get past the checks of the form. For those, the plugin ships gecka/spamfilter, a statistical filter that rates every message from 0 to 100 % spam, trained on your own site: each time you mark a comment, a Flamingo message or a Gravity Forms entry as spam, or as legitimate, it learns. From 95 % a message is refused, from 75 % it goes to the spam queue, from 55 % it is flagged for review, and below that it passes. The thresholds are yours to set, and one click has it learn, in one go, everything already moderated on the site.
The filter compares what it learnt with background tables that tell a common word from a rare one, in each language of your site. It needs 20 spam texts and 10 legitimate ones before it rates anything, and its counters age, so the spam of today outweighs the campaigns of past years. It needs the intl and mbstring extensions of PHP, which most hosts provide.
Everything stays on your site
Nothing of the submissions leaves your server, no cookie is set, and no name, email address or IP address of a sender is kept. The only requests the plugin makes download the background tables of the filter, see External services. A paragraph for your privacy policy is offered under Settings > Privacy.
See what it does
Security > Statistics: the submissions checked, accepted and caught over 7, 30, 90 or 365 days, by form and by check; with the Gecka Geolocation plugin, by country and by network, with their flags and logos, the address itself never being read nor kept
Security > Journal: every refused submission, to review, learn from or delete, kept 30 days
A dashboard widget for the last seven days, an Antispam column in the comments and in Flamingo with the rating of each message, and Site Health tests of the tables, the daily task and the filter
Protected forms
WordPress: comments, login, registration, lost password, and the network registration of a multisite
WooCommerce: classic checkout, product reviews, My account login, registration and lost password, the login of the app authorization screen
Contact Form 7: every form, or only the forms holding the [gecka_antispam] tag
Gravity Forms: every form, or only the forms holding the Antispam field
ACF, ACF Pro and Secure Custom Fields: every front-end form, or only the forms whose acf_form() arguments hold 'gecka_antispam' => true
Your own forms, with two functions, gecka_antispam_fields() and gecka_antispam_check(): see the developer documentation
The checkout block and the payment buttons of WooCommerce take other routes and are not covered.
Privacy
The plugin keeps daily counts of the submissions it checks, counts on hashes of the words of the subject and message of the texts marked as spam or not spam, and the subject and message of the submissions refused, until 30 days after the text was last sent. A refused message may hold personal details the sender wrote in it, and its subject is what the form cites as its subject: a field of the sender cited there, a phone number for instance, is kept with it. Words a sender typed in a message, a phone number in a signature for one, enter the counts as hashes and cannot be erased for one person.
The statistical filter is gecka/spamfilter, under the AGPL-3.0-or-later.
External services
The plugin downloads the background tables of the statistical filter from the releases of the spamfilter-backgrounds project on GitHub (https://github.com/Gecka-Apps/spamfilter-backgrounds): the manifest of the latest release, then the table of each language wanted, about 1 MB each. Nothing is downloaded before an administrator allows it with the “Download the background tables” button, which the plugins screen, the settings and Site Health point to. From then on it does so when the languages setting changes, from the button of the statistical filter tab, and once a week from its daily task, while the statistical filter is on; unticking the box under the languages stops it. The requests send nothing but what any download sends, the IP address of the server among it, under a user agent naming the plugin; nothing of the site, its visitors or its submissions. GitHub terms of service: https://docs.github.com/en/site-policy/github-terms/github-terms-of-service, privacy statement: https://docs.github.com/en/site-policy/privacy-policies/github-general-privacy-statement. The gecka_antispam_background_updates filter returning false stops the downloads.
Development
The plugin is developed on GitHub, where bugs can be reported and changes suggested: https://github.com/Gecka-Apps/wordpress-plugin-gecka-antispam. Questions on using it are welcome in the support forum.
