內容簡介
Onsite Spam Guard 是一款專為阻擋網站表單垃圾郵件而設計的外掛，支援 WordPress 評論、Contact Form 7、WooCommerce 產品評論等多種表單，無需第三方服務或 CAPTCHA，保護措施隱形且高效。
【主要功能】
• 隱藏的蜜罐欄位，防止機器人提交
• 重複提交檢測，拒絕相同內容
• 提交速度限制，過快提交將被拒絕
• 伺服器簽名，確保表單來源
• 連結數量限制，標記過多 URL 的提交
• 關鍵字過濾，拒絕特定詞彙的提交
外掛標籤
開發者團隊
原文外掛簡介
Onsite Spam Guard blocks spam on the forms your visitors actually use — WordPress comments, Contact Form 7, WooCommerce product reviews, Jetpack contact forms and WP Job Manager job submissions, plus account registration and BuddyPress private messages if you want them — without sending anything to a third-party service, requiring an API key, or putting a CAPTCHA in front of your users.
Protection is built from a pipeline of independent guards. Each guard is a small, focused check (a hidden honeypot field, a submit-speed gate, a keyword filter, and so on). Every enabled guard looks at every submission, and one objection is enough to block it; the log records every guard that objected, so you can see exactly why. Every guard can be toggled and tuned from a single settings page — for the whole site, or form by form — and every block can be logged for review.
Spam guards
Honeypot — a hidden field that bots fill in but humans never see.
Duplicate detection — rejects identical submissions sent within a short window.
Time gate — rejects submissions completed faster than a human could plausibly type.
Signature — requires a server-signed token proving the form was served by this site, deterring automated cross-site posting.
Rate limit (optional) — throttles repeated submissions from the same sender within a short window, keyed on the logged-in user when there is one and the connection IP otherwise.
Link limit — flags submissions that contain too many URLs.
Keyword block — rejects submissions matching a configurable blocklist of words or phrases.
Behavioral analysis (optional) — scores mouse movement, clicks, and time on page to spot bot-like interaction.
Why you might choose it
No external services. Nothing leaves your site. No accounts, no API keys, no per-submission fees.
No CAPTCHA. Protection is invisible to legitimate visitors.
Try before you enforce. Monitor mode records what would have been blocked without blocking anything, for the whole site or a single form, and the Per-form tab sums up what enforcing a form would catch before you switch it on.
Tuned per form. A contact form can be stricter about links than a comment thread, and a form such as a job listing starts with limits that suit it.
Allowlist. Trusted IPs, CIDR ranges, email addresses, and email domains bypass every guard.
Logging with retention. Blocked submissions are recorded in a dedicated table with a paginated admin viewer, and old entries are pruned automatically on a schedule you control.
Privacy-aware. The plugin registers suggested privacy-policy text describing exactly what it records.
Modern, dependency-free code. PHP 8.2+, vanilla front-end JavaScript (no jQuery), and no runtime third-party libraries.
Works with
WordPress comments (always).
WooCommerce product reviews (when WooCommerce is active).
Jetpack contact form blocks (when Jetpack is active).
WP Job Manager job submissions (when WP Job Manager is active).
Contact Form 7 forms (when Contact Form 7 is active).
BuddyPress private messages (when BuddyPress is active; off by default).
Account registration forms — WordPress, WooCommerce My Account and BuddyPress signup (off by default).
