Spamify – Elastic Spam Shield

Descripción

Spamify is a lightweight, self-contained email spam and validation plugin for WordPress forms. It scores every submitted email address and blocks or flags the ones that look fake, invalid, or abusive — without sending your visitors’ data to any tracking service.

Out of the box the plugin runs entirely on your own server. It never sends your data to the plugin author or to any analytics or tracking service, and it does not require an account or a licence key. One optional feature — live mailbox verification — reaches out to the recipient’s own mail server, and it is turned off by default (see External Services below).

Detection layers:

• Syntax – Validates the email format and catches gibberish, keyboard-mash, and obviously fake addresses. Runs locally, always on.
• SMTP mailbox verification (optional, off by default) – Connects to the recipient domain’s mail server and asks whether the mailbox exists. No message is ever sent.

Bot protection & security (all local, all free):

• Honeypot & timing – Hidden decoy fields plus a minimum form-fill time catch automated submissions.
• Rate limiting – Throttle how many submissions a single IP can make within a rolling window.
• CAPTCHA (optional) – Invisible Cloudflare Turnstile or Google reCAPTCHA v3, using your own free provider keys.
• Allowlist – Always let trusted domains, exact email addresses, or IP / CIDR ranges through.
• Hide login (optional) – Move wp-login.php to an address of your choice and serve a 404 (or a redirect) at the old one and at /wp-admin/ (WordPress normally bounces logged-out visitors from /wp-admin/ to the login screen, which would give the secret address away), so brute-force bots have nothing to hammer. Every login, logout, lost-password and registration link — including the ones inside WordPress emails — is rewritten for you. Multisite compatible: each site in a network keeps its own address, subdirectory installs get the slug under their own folder, and a single SPAMIFY_HIDE_LOGIN_SLUG constant in wp-config.php can enforce one address network-wide.

Privacy & administration:

• GDPR tools – Automatic daily log purge by retention window, plus optional IP anonymisation.
• Site Health – Built-in WordPress Site Health checks for logging, DNS, and mailbox verification.
• Setup wizard – A guided first-run wizard to get protected in about a minute.
• Dashboard & logs – See what was blocked, flagged, and allowed, with per-day charts.

Supported forms:

• WordPress core (registration, comments, profile update, lost password, multisite signup)
• Contact Form 7
• WPForms
• Jetpack Forms
• Elementor Forms

Upgrade to Pro

Spamify is free forever on WordPress.org — everything described above runs standalone, with no account, licence key, or nag screens required.

Spamify Pro adds the rest of the detection engine and site-wide protection tools for busier or higher-traffic sites:

• Disposable domain blocking – 100,000+ throwaway and temporary-inbox providers, refreshed automatically.
• IP threat intel & DNSBL – matches the sender’s IP against aggregated abuse feeds and DNS blocklists.
• VPN / proxy / Tor detection – flags anonymised traffic from VPNs, open proxies, Tor exit nodes and datacenter ranges.
• Content analysis – link stuffing, spam keywords, homoglyph and Unicode obfuscation.
• Behavioural reputation – per-sender history layered on top of honeypot and timing.
• Custom rules – your own if-this-then-that logic on any field or signal.
• Network firewall – VPN/Tor/ASN blocking with escalating temporary bans.
• Geo report & country blocking – a world map of where blocked spam comes from, powered by a free offline database.
• Uptime monitor & deliverability tools – scheduled URL checks, bulk email-list verification, and an SPF/DKIM/DMARC checker.
• More integrations – WooCommerce, Gravity Forms, Ninja Forms, Fluent Forms, newsletter opt-ins, and a universal connector for any form.

Plans start at $49/year for up to 3 sites, with Agency and Lifetime options for larger portfolios. Buy Spamify Pro →

External Services

Spamify is self-contained by default. Two optional features connect to an external service only after you explicitly enable and configure them. Neither sends any data to the plugin author, and neither is active on a fresh install.

1. SMTP mailbox verification (optional, disabled by default)

When you turn on SMTP Verification (Settings → Advanced Filters), the plugin opens a direct connection to the mail server (MX host) of the recipient email address’s own domain and performs an SMTP handshake to check whether the mailbox exists. What is sent: the email address being validated, sent only to that address’s own mail provider, and only at the moment a form containing that address is submitted or checked. No email message is ever sent, and no data is sent to the plugin author or to any third-party service. Because each address is verified against its own provider’s server, there is no single service, account, terms of service, or privacy policy involved. Leave this feature off if you prefer that submitted addresses are never contacted.

Outbound-port connectivity probe. Many hosts block outbound port 25, which makes mailbox verification impossible. To detect this, the plugin makes a one-off TCP connection to a well-known public mail server — by default Google’s inbound MX, gmail-smtp-in.l.google.com on port 25 — and closes it immediately without sending any data. Only a yes/no «is port 25 open» result is kept (cached for up to a week). This probe runs when SMTP verification is enabled, and when you open the Advanced settings tab or the Tools → Site Health screen (so the status can be shown). No personal data is transmitted. You can change or disable the probe host with the spamify_port25_probe_host filter.

2. CAPTCHA verification (optional, disabled by default)

If you enable CAPTCHA (Settings → Bot Protection) and enter your own provider keys, the visitor’s CAPTCHA token is sent to your chosen provider’s verification endpoint so the provider can confirm the visitor is human:

• Cloudflare Turnstile – token sent to https://challenges.cloudflare.com/turnstile/v0/siteverify. Terms: https://www.cloudflare.com/website-terms/ — Privacy: https://www.cloudflare.com/privacypolicy/
• Google reCAPTCHA v3 – token sent to https://www.google.com/recaptcha/api/siteverify. Terms: https://policies.google.com/terms — Privacy: https://policies.google.com/privacy

Only the CAPTCHA token and the visitor IP are sent, only on form submission, and only if you have configured a provider. This feature is off until you supply keys.