內容簡介
QWeb Spam Shield 是一款全面防範垃圾郵件的外掛，能夠保護整個網站免受垃圾訊息侵擾，而不需要使用 CAPTCHA。它運行於您的伺服器上，確保所有資料不會外流，並有效攔截各種形式的垃圾訊息。
【主要功能】
• 支援多種表單插件，包括 Gravity Forms 和 Contact Form 7
• 阻擋 WordPress 評論及 WooCommerce 產品評價中的垃圾訊息
• 防止假帳號註冊，確保用戶真實性
• 提供 WooCommerce 結帳過程中的信用卡測試防護
• 內建郵件保護，限制網站發送的郵件數量
• GDPR 友好，支援 IP 匿名化及個人資料管理
外掛標籤
開發者團隊
原文外掛簡介
QWeb Spam Shield blocks spam across your entire site, not just your contact form, and it does it without a single CAPTCHA. No puzzles for your real visitors, no account, no API key, and no external service. Everything runs on your own server and nothing ever leaves your site.
Most anti-spam plugins only watch comments or a single form. QWeb Spam Shield guards every place spam and abuse actually get in:
Every form: Gravity Forms, Contact Form 7, WPForms, Fluent Forms, Elementor Pro Forms, Ninja Forms and Formidable, plus a universal wp_mail catch-all that automatically covers any other form plugin
WordPress comments and WooCommerce product reviews
User registration, so fake and bot sign-ups are stopped before an account is ever created
WooCommerce checkout, with card-testing (carding) defenses that stop attackers from validating stolen cards on your store with waves of fake orders, and running up your payment processing fees
Your outbound email: the built-in Mail Guard rate-limits the mail your own site sends, so a hacked form or a runaway plugin cannot blast thousands of messages and wreck your domain’s sending reputation
No CAPTCHA, ever. Your visitors never see a checkbox, a puzzle, or a “click all the crosswalks” challenge. Detection runs invisibly in the background, so genuine customers sail through and only spam is stopped.
How it decides (fast, all local):
Content signals: links in messages, gibberish, non-Latin scripts (French, German, and Spanish accents are allowed), marketing-pitch phrasing, and banned keywords matched on whole words
Identity signals: disposable-email domains (a bundled list of about 7,900), missing MX records with typo tolerance, and role accounts
Behavioral signals: honeypot, submission timing, and per-email or per-IP velocity for repeat offenders
Built for site owners:
A grouped spam log. A 1,000-request attack is one counted row, not 1,000, so your day-to-day spam stays visible. It is auto-cleaned by age and a row cap.
Conservative by design. Genuine customer questions are not hard-blocked. Borderline submissions are held for review, never silently lost, and can be re-delivered.
Comments use WordPress moderation (spam folder or moderation queue), so nothing is destroyed.
GDPR friendly: IP anonymization, configurable retention, and support for Tools then Export or Erase Personal Data.
Privacy:
QWeb Spam Shield makes no external HTTP requests. It does not phone home, and it does not require a license, account, or third-party service.
Need even stronger protection? Meet QWeb Spam Shield AI
This free plugin is fully functional on its own and always will be. QWeb Spam Shield AI is the premium edition for sites that want the strongest protection possible. It layers a managed AI engine and a cross-site defense network on top of everything above:
Managed AI tiebreaker. A purpose-built AI reviews only the borderline submissions the rules engine is unsure about, so you catch more real spam without ever blocking a genuine customer. There is no API key to buy or configure. It is included with your license.
AI review of held submissions. Every held message is re-checked against your own business context, and real customer inquiries are released automatically. False positives drop close to zero, completely hands-off.
Cross-site pattern network. The instant spam is confirmed on any protected site, every other licensed site is protected from it too, so your site benefits from attacks aimed at everyone else.
Sharper detection that keeps improving, tuned continuously on live spam across the whole network.
Faster, fully automatic updates delivered straight to your dashboard.
Priority support from the team that builds it.
Get QWeb Spam Shield AI at https://qwebspamshield.com
Source code and build tools
The plugin ships all of its source. The only compiled asset is the React admin app
in admin/build/, generated from the human-readable source included in admin/src/
with the official WordPress build tooling:
Run npm install in the plugin root (uses package.json, @wordpress/scripts).
Run npm run build. This regenerates admin/build/index.js and style-index.css.
Everything else (PHP, the frontend honeypot script in assets/js/, CSS) is plain,
unminified source. The bundled disposable-email-domain list in data/ comes from the
public domain disposable-email-domains project (github.com/disposable-email-domains).
