Title: Spamify – Elastic Spam Shield Author: Spamify Published: 1.9.2026 Last modified: 20.10.2026 --- Hae lisäosia ![](https://ps.w.org/spamify/assets/banner-772x250.png?rev=3675662) ![](https://ps.w.org/spamify/assets/icon.svg?rev=3675590) # Spamify – Elastic Spam Shield [Spamify](https://profiles.wordpress.org/arslanwp/) [Lataa](https://downloads.wordpress.org/plugin/spamify.1.2.0.zip) [Live Preview](https://fi.wordpress.org/plugins/spamify/?preview=1) * [Tiedot](https://fi.wordpress.org/plugins/spamify/#description) * [Arvostelut](https://fi.wordpress.org/plugins/spamify/#reviews) * [Asennus](https://fi.wordpress.org/plugins/spamify/#installation) * [Kehitys](https://fi.wordpress.org/plugins/spamify/#developers) [Tuki](https://wordpress.org/support/plugin/spamify/) ## Kuvaus Spamify is a lightweight, self-contained email spam and validation plugin for WordPress forms. It scores every submitted email address and blocks or flags the ones that look fake, invalid, or abusive — without sending your visitors’ data to any tracking service. It never sends your data to the plugin author or to any analytics or tracking service, and it does not require an account or a licence key. One optional feature — live mailbox verification — reaches out to the recipient’s own mail server, and it is** on by default** — you can turn it off under Settings Advanced Filters (see _External Services_ below). **Detection layers:** * **Syntax** – Validates the email format and catches gibberish, keyboard-mash, and obviously fake addresses. Runs locally, always on. * **SMTP mailbox verification** _(on by default)_ – Connects to the recipient domain’s mail server and asks whether the mailbox exists. No message is ever sent. * **Behavior & bot signals** – Scores mouse, scroll, keyboard and focus activity, a headless-browser (automation) check, keystroke rhythm, and a JavaScript challenge— all collected locally from the page the visitor already loaded, with no network calls or third-party service involved. **Bot protection & security (all local, all free):** * **Honeypot & timing** – Hidden decoy fields plus a minimum form-fill time catch automated submissions. * **Rate limiting** – Throttle how many submissions a single IP can make within a rolling window. * **CAPTCHA** _(optional)_ – Invisible Cloudflare Turnstile or Google reCAPTCHA v3, using your own free provider keys. * **Allowlist** – Always let trusted domains, exact email addresses, or IP / CIDR ranges through. * **Hide login** _(optional)_ – Move wp-login.php to an address of your choice and serve a 404 (or a redirect) at the old one **and at /wp-admin/** (WordPress normally bounces logged-out visitors from /wp-admin/ to the login screen, which would give the secret address away), so brute-force bots have nothing to hammer. Every login, logout, lost-password and registration link — including the ones inside WordPress emails — is rewritten for you. Multisite compatible: each site in a network keeps its own address, subdirectory installs get the slug under their own folder, and a single `SPAMIFY_HIDE_LOGIN_SLUG` constant in wp-config. php can enforce one address network-wide. **Privacy & administration:** * **GDPR tools** – Automatic daily log purge by retention window, plus optional IP anonymisation. * **Site Health** – Built-in WordPress Site Health checks for logging, DNS, and mailbox verification. * **Setup wizard** – A guided first-run wizard to get protected in about a minute. * **Dashboard & logs** – See what was blocked, flagged, and allowed, with per-day charts, plus a WP Dashboard widget showing today’s and this week’s figures at a glance. * **Review Queue** – Every currently-flagged submission — comments, registrations, profile changes, and every connected form — in one screen, instead of scattered across the native Comments/Users screens. * **Timeline** – Look up one email address or IP and see its full chronological history across every zone, with the evidence behind every hit. * **Digest reports** – A daily, weekly, or monthly summary email, optionally with a CSV report (totals, source breakdown, top offending domains) attached. **Supported forms:** * WordPress core (registration, comments, profile update, lost password, multisite signup) * Contact Form 7 * WPForms * Jetpack Forms * Elementor Forms ### Upgrade to Pro Spamify is free forever on WordPress.org — everything described above runs standalone, with no account, licence key, or nag screens required. **[Spamify Pro](https://spamify-pro.github.io/)** adds the rest of the detection engine and site-wide protection tools for busier or higher-traffic sites: * **Disposable domain blocking** – 100,000+ throwaway and temporary-inbox providers, refreshed automatically. * **IP threat intel & DNSBL** – matches the sender’s IP against aggregated abuse feeds and DNS blocklists. * **VPN / proxy / Tor detection** – flags anonymised traffic from VPNs, open proxies, Tor exit nodes and datacenter ranges. * **Content analysis** – link stuffing, spam keywords, homoglyph and Unicode obfuscation. * **Behavioural reputation** – per-sender history layered on top of honeypot and timing. * **Custom rules** – your own if-this-then-that logic on any field or signal. * **Network firewall** – VPN/Tor/ASN blocking with escalating temporary bans. * **Geo report & country blocking** – a world map of where blocked spam comes from, powered by a free offline database. * **Uptime monitor & deliverability tools** – scheduled URL checks, bulk email- list verification, and an SPF/DKIM/DMARC checker. * **More integrations** – WooCommerce, Gravity Forms, Ninja Forms, Fluent Forms, newsletter opt-ins, and a universal connector for any form. Plans start at $49/year for up to 3 sites, with Agency and Lifetime options for larger portfolios. **[Buy Spamify Pro ](https://spamify-pro.github.io/#pricing)** ### External Services Two features can connect to an external service. SMTP mailbox verification is ** on by default** (you can turn it off under Settings Advanced Filters); CAPTCHA verification stays off until you enable it and add your own provider keys. Neither sends any data to the plugin author. **1. SMTP mailbox verification (on by default)** When you turn on _SMTP Verification_ (Settings Advanced Filters), the plugin opens a direct connection to the mail server (MX host) of the **recipient email address’s own domain** and performs an SMTP handshake to check whether the mailbox exists. What is sent: the email address being validated, sent only to that address’s own mail provider, and only at the moment a form containing that address is submitted or checked. No email message is ever sent, and no data is sent to the plugin author or to any third-party service. Because each address is verified against its own provider’s server, there is no single service, account, terms of service, or privacy policy involved. Turn this feature off under Settings Advanced Filters if you prefer that submitted addresses are never contacted. _Outbound-port connectivity probe._ Many hosts block outbound port 25, which makes mailbox verification impossible. To detect this, the plugin makes a one-off TCP connection to a well-known public mail server — by default Google’s inbound MX, ` gmail-smtp-in.l.google.com` on port 25 — and closes it immediately **without sending any data**. Only a yes/no ”is port 25 open” result is kept (cached for up to a week). This probe runs when SMTP verification is enabled, and when you open the Advanced settings tab or the Tools Site Health screen (so the status can be shown). No personal data is transmitted. You can change or disable the probe host with the `spamify_port25_probe_host` filter. **2. CAPTCHA verification (optional, disabled by default)** If you enable CAPTCHA (Settings Bot Protection) and enter your own provider keys, the visitor’s CAPTCHA token is sent to your chosen provider’s verification endpoint so the provider can confirm the visitor is human: * **Cloudflare Turnstile** – token sent to `https://challenges.cloudflare.com/turnstile/ v0/siteverify`. Terms: https://www.cloudflare.com/website-terms/ — Privacy: https:// www.cloudflare.com/privacypolicy/ * **Google reCAPTCHA v3** – token sent to `https://www.google.com/recaptcha/api/ siteverify`. Terms: https://policies.google.com/terms — Privacy: https://policies. google.com/privacy Only the CAPTCHA token and the visitor IP are sent, only on form submission, and only if you have configured a provider. This feature is off until you supply keys. ## Kuvankaappaukset [[ [[ [[ [[ [[ [[ [[ [[ ## Asennus 1. Upload the `spamify` folder to the `/wp-content/plugins/` directory, or install it through the Plugins screen in WordPress. 2. Activate the plugin through the **Plugins** menu in WordPress. 3. Open **Spamify** in the admin menu and follow the setup wizard to configure protection. ## UKK ### Does this plugin send any data to your servers? No. Spamify never contacts the plugin author’s servers, and it sends no data to any analytics or tracking service. It runs on your own site. The only outbound connections are those described in _External Services_ — SMTP mailbox verification and its port- 25 connectivity probe (verification is on by default; you can turn it off under Settings Advanced Filters), and CAPTCHA verification (off until you add your own keys). ### Is SMTP verification required? No. It is on by default, but you can turn it off under Settings Advanced Filters. The plugin still validates syntax and protects your forms with the honeypot, timing, rate-limiting, allowlist, and CAPTCHA features without it. ### Which PHP version is required? PHP 7.4 or higher. ### Why are some submissions marked ”unverifiable”? Many hosts block outbound port 25, and many mail servers greylist or use catch-all addresses, so a mailbox cannot always be confirmed. By default these are flagged for review rather than blocked; you can change this in Settings. ### Is there a Pro version? Yes. [Spamify Pro](https://spamify-pro.github.io/) adds the rest of the detection engine (disposable-domain blocking, IP threat intel, VPN/Tor detection, content analysis, custom rules), a network firewall, a geo report, deliverability tools, and integrations for WooCommerce, Gravity Forms, Ninja Forms and Fluent Forms. The free version on WordPress.org is fully functional on its own and is not a limited trial. See [spamify-pro.github.io](https://spamify-pro.github.io/) or **[Buy Spamify Pro](https://spamify-pro.github.io/#pricing)**. ### I hid my login page and locked myself out. What now? Add `define( 'SPAMIFY_HIDE_LOGIN_DISABLE', true );` to your wp-config.php. wp-login. php works normally again, and you can change or switch off the setting from Protection Hide login. ### Does hiding the login work on multisite? Yes. Every site in the network sets its own address on its own Protection screen, and on a subdirectory network the address lives under that site’s folder (example. com/team/secret-login/). To use one address everywhere, add `define( 'SPAMIFY_HIDE_LOGIN_SLUG',' secret-login' );` to wp-config.php. wp-signup.php and wp-activate.php stay reachable so registration and activation keep working. The feature needs pretty permalinks. ## Arvostelut There are no reviews for this plugin. ## Avustajat & Kehittäjät “Spamify – Elastic Spam Shield” perustuu avoimeen lähdekoodiin. Seuraavat henkilöt ovat osallistuneet tämän lisäosan kehittämiseen. Avustajat * [ Spamify ](https://profiles.wordpress.org/arslanwp/) * [ Muhammad Arslan ](https://profiles.wordpress.org/wparslan/) [Käännä “Spamify – Elastic Spam Shield” omalle kielellesi.](https://translate.wordpress.org/projects/wp-plugins/spamify) ### Oletko kiinnostunut kehitystyöstä? [Browse the code](https://plugins.trac.wordpress.org/browser/spamify/), check out the [SVN repository](https://plugins.svn.wordpress.org/spamify/), or subscribe to the [development log](https://plugins.trac.wordpress.org/log/spamify/) by [RSS](https://plugins.trac.wordpress.org/log/spamify/?limit=100&mode=stop_on_copy&format=rss). ## Muutosloki #### 1.2.0 (2026-10-16) * Added German (de_DE), Spanish (es_ES), and French (fr_FR) translations covering the admin screens and the visitor-facing form messages. * Per-zone rate-limit overrides — give a specific zone (e.g. comments) its own, independent submission budget instead of sharing the global limit. * Honeypot and ”submitted too fast” detections can now be set to flag-for-review instead of always hard-blocking (Settings > Bot Protection). * SMTP mailbox checks that get a temporary/greylisting response now get one automatic re-check a few minutes later, instead of caching the inconclusive result for a full hour. * A ”Hide Login Attempts” stat card now appears on the Dashboard when Hide Login is enabled, showing today’s and this week’s denied probes against the real login address. * Spam Scan: a new ”Review candidates” filter surfaces accounts the scan reports as clean but that have prior flagged or blocked activity on file — a signal that would otherwise be buried in individual evidence rows. * ”Send test digest now” button (Settings > Alerts & Logging) previews the digest email immediately, regardless of the digest toggle or how quiet the period has been. * ”Run GDPR purge now” button applies the configured retention window immediately instead of waiting for the nightly automatic purge. * The Review Queue’s ”Dismiss all” clears every currently-filtered flagged submission in one action instead of one at a time. * The onboarding wizard’s ”Zones” step now pre-checks a form-plugin zone only when that plugin is actually active on the site, instead of defaulting every zone on regardless of what’s installed. * Fixed: the honeypot’s ”submitted too quickly” message never actually appeared to a blocked visitor — a text-matching bug always fell back to the generic blocked message instead. * Fixed: a domain with no mail server at all (no MX or A record) was only flagged, never blocked, even though this is a more certain ”cannot receive email” signal than an explicit SMTP rejection, which was already hard-blocked. * Fixed: the Real-Time Check Mode setting offered ”fast” and ”full” as separate choices that were actually identical; the redundant option has been removed ( existing sites already set to ”full” are unaffected). * Fixed: the settings written on first activation could silently differ from ”Reset to Defaults” on the same install (e.g. the IP-anonymisation and log-retention defaults disagreed) — both now come from the same single source. **Internal / Maintenance** – The Dashboard’s stat-cards row was extracted into its own class to keep the Dashboard page under the project’s per-file size limit.– The Spam Scan results table gained a new indexed column (DB schema v15) to support the ”Review candidates” filter above — upgrades automatically on activation, no action needed. #### 1.1.0 **New Features** – The Activity screen’s banner now appears on every tab (Log, Review Queue, Timeline, and any Pro-contributed section), not just the Log tab. – A loading indicator now shows for every AJAX action and full page navigation/refresh across the admin screens. **Security Fixes** – Re-audited every AJAX endpoint to confirm nonce verification and capability checks are in place. **Other Fixes** – Flag Threshold and Block Threshold now behave distinctly on real form submissions. Previously, ”Strict — reject unverified on submit” (on by default) escalated any score at or above the Flag Threshold straight to a hard block, so the Block Threshold had no real effect and the Review Queue never received real submissions. Flag Threshold now genuinely means ”allow, but mark for review”; only the Block Threshold rejects. – The admin banner is now light instead of dark, matching the rest of the admin UI. **Internal / Maintenance** – Internal code-quality refresh. Every source file is now under 400 lines, large admin pages and engine layers were split into focused, single-responsibility files, and the admin stylesheet was broken into per-screen partials — no behaviour or settings change. – JavaScript is now internationalised through the standard `wp.i18n` API (with `wp_set_script_translations`), so every user-facing string in the browser is translatable; all named callbacks, added file- level documentation, and no anonymous functions remain. #### 1.0.1 * New Feature: Continuous Spam Scan — retro-scanning legacy accounts/comments now survives a page reload or navigating away instead of stopping, and Pause/Resume picks up exactly where it left off rather than starting over. * New Feature: Behavior & Bot Signals detection layer — scores headless/automation- browser detection, keystroke rhythm, mouse/keyboard/focus activity, and a JavaScript challenge, all collected locally on every form with no third-party service involved. * New Feature: Review Queue — every currently-flagged submission across comments, registrations, profile changes, and every connected form, in one screen instead of scattered across the native Comments/Users screens. * New Feature: Visual ”why was this blocked” Timeline per IP/email — chronological history of every hit from that address across all zones. * New Feature: A ”Spamify” dashboard widget on the core WP dashboard (wp-admin/ index.php) — today’s and this week’s blocked/flagged counts at a glance, no need to visit the plugin page. * New Feature: Digest emails can now be sent daily, weekly, or monthly, optionally with a CSV summary report (totals, source breakdown, top offending domains) attached. * Fix: The Activity Log’s ”Delete entry” button did not actually delete the log row. * Fix: The Spam Scan page’s ”no offline Tor/ASN dataset” notice rendered as a garbled, unreadably narrow box instead of a normal banner. #### 1.0.0 * Initial release. * Feature: Hide login — serve wp-login.php from a custom address and answer the old one, plus /wp-admin/ for logged-out visitors, with the theme’s 404 page, a home-page redirect, or a URL of your choice. All generated login/logout/lost- password/registration links are rewritten automatically. * Multisite: per-site login addresses, subdirectory-network aware matching, network- level links resolve against the main site, and an optional `SPAMIFY_HIDE_LOGIN_SLUG` constant enforces one address across the whole network. * Major: syntax validation, optional SMTP mailbox verification (off by default), honeypot & timing, per-IP rate limiting, allowlist, invisible CAPTCHA (bring your own keys), GDPR log tools, Site Health checks, and a setup wizard. Integrations for WordPress core forms, Contact Form 7, WPForms, Jetpack Forms, and Elementor Forms. ## Metatiedot * Version **1.2.0** * Last updated **7 päivää sitten** * Active installations **Fewer than 10** * WordPress version ** 5.8 or higher ** * Tested up to **7.1.3** * PHP version ** 7.4 or higher ** * Language * [English (US)](https://wordpress.org/plugins/spamify/) * Tags * [anti-spam](https://fi.wordpress.org/plugins/tags/anti-spam/)[contact form](https://fi.wordpress.org/plugins/tags/contact-form/) [email validation](https://fi.wordpress.org/plugins/tags/email-validation/)[protection](https://fi.wordpress.org/plugins/tags/protection/) [spam](https://fi.wordpress.org/plugins/tags/spam/) * [Edistynyt näkymä](https://fi.wordpress.org/plugins/spamify/advanced/) ## Arvosanat No reviews have been submitted yet. [Your review](https://wordpress.org/support/plugin/spamify/reviews/#new-post) [See all reviews](https://wordpress.org/support/plugin/spamify/reviews/) ## Avustajat * [ Spamify ](https://profiles.wordpress.org/arslanwp/) * [ Muhammad Arslan ](https://profiles.wordpress.org/wparslan/) ## Tuki Onko sinulla jotain sanottavaa? Tarvitsetko apua? [Tukifoorumi](https://wordpress.org/support/plugin/spamify/)