Spamify is a lightweight, self-contained email spam and validation plugin for WordPress forms. It scores every submitted email address and blocks or flags the ones that look fake, invalid, or abusive \u2014 without sending your visitors' data to any tracking service.<\/p>\n\n
Out of the box the plugin runs entirely on your own server. It never sends your data to the plugin author or to any analytics or tracking service, and it does not require an account or a licence key. One optional feature \u2014 live mailbox verification \u2014 reaches out to the recipient's own mail server, and it is turned off by default<\/strong> (see External Services<\/em> below).<\/p>\n\n Detection layers:<\/strong><\/p>\n\n Bot protection & security (all local, all free):<\/strong><\/p>\n\n Privacy & administration:<\/strong><\/p>\n\n Supported forms:<\/strong><\/p>\n\n Spamify is free forever on WordPress.org \u2014 everything described above runs standalone, with no account, licence key, or nag screens required.<\/p>\n\n Spamify Pro<\/a><\/strong> adds the rest of the detection engine and site-wide protection tools for busier or higher-traffic sites:<\/p>\n\n Plans start at $49\/year for up to 3 sites, with Agency and Lifetime options for larger portfolios. Buy Spamify Pro \u2192<\/a><\/strong><\/p>\n\n Spamify is self-contained by default. Two optional<\/strong> features connect to an external service only after you explicitly enable and configure them. Neither sends any data to the plugin author, and neither is active on a fresh install.<\/p>\n\n 1. SMTP mailbox verification (optional, disabled by default)<\/strong><\/p>\n\n When you turn on SMTP Verification<\/em> (Settings \u2192 Advanced Filters), the plugin opens a direct connection to the mail server (MX host) of the recipient email address's own domain<\/strong> and performs an SMTP handshake to check whether the mailbox exists. What is sent: the email address being validated, sent only to that address's own mail provider, and only at the moment a form containing that address is submitted or checked. No email message is ever sent, and no data is sent to the plugin author or to any third-party service. Because each address is verified against its own provider's server, there is no single service, account, terms of service, or privacy policy involved. Leave this feature off if you prefer that submitted addresses are never contacted.<\/p>\n\n Outbound-port connectivity probe.<\/em> Many hosts block outbound port 25, which makes mailbox verification impossible. To detect this, the plugin makes a one-off TCP connection to a well-known public mail server \u2014 by default Google's inbound MX, 2. CAPTCHA verification (optional, disabled by default)<\/strong><\/p>\n\n If you enable CAPTCHA (Settings \u2192 Bot Protection) and enter your own provider keys, the visitor's CAPTCHA token is sent to your chosen provider's verification endpoint so the provider can confirm the visitor is human:<\/p>\n\n Only the CAPTCHA token and the visitor IP are sent, only on form submission, and only if you have configured a provider. This feature is off until you supply keys.<\/p>\n\n\n No. Spamify never contacts the plugin author's servers, and it sends no data to any analytics or tracking service. It runs on your own site. The only outbound connections are those described in External Services<\/em> \u2014 SMTP mailbox verification and its port-25 connectivity probe (verification is off by default), and CAPTCHA verification (off until you add your own keys).<\/p><\/dd>\n No. It is off by default. The plugin still validates syntax and protects your forms with the honeypot, timing, rate-limiting, allowlist, and CAPTCHA features without it.<\/p><\/dd>\n PHP 7.4 or higher.<\/p><\/dd>\n Many hosts block outbound port 25, and many mail servers greylist or use catch-all addresses, so a mailbox cannot always be confirmed. By default these are flagged for review rather than blocked; you can change this in Settings.<\/p><\/dd>\n Yes. Spamify Pro<\/a> adds the rest of the detection engine (disposable-domain blocking, IP threat intel, VPN\/Tor detection, content analysis, custom rules), a network firewall, a geo report, deliverability tools, and integrations for WooCommerce, Gravity Forms, Ninja Forms and Fluent Forms. The free version on WordPress.org is fully functional on its own and is not a limited trial. See spamify-pro.github.io<\/a> or Buy Spamify Pro<\/a><\/strong>.<\/p><\/dd>\n Add Yes. Every site in the network sets its own address on its own Protection screen, and on a subdirectory network the address lives under that site's folder (example.com\/team\/secret-login\/). To use one address everywhere, add \n
\n
SPAMIFY_HIDE_LOGIN_SLUG<\/code> constant in wp-config.php can enforce one address network-wide.<\/li>\n<\/ul>\n\n\n
\n
Upgrade to Pro<\/h3>\n\n
\n
External Services<\/h3>\n\n
gmail-smtp-in.l.google.com<\/code> on port 25 \u2014 and closes it immediately without sending any data<\/strong>. Only a yes\/no \"is port 25 open\" result is kept (cached for up to a week). This probe runs when SMTP verification is enabled, and when you open the Advanced settings tab or the Tools \u2192 Site Health screen (so the status can be shown). No personal data is transmitted. You can change or disable the probe host with the spamify_port25_probe_host<\/code> filter.<\/p>\n\n\n
https:\/\/challenges.cloudflare.com\/turnstile\/v0\/siteverify<\/code>. Terms: https:\/\/www.cloudflare.com\/website-terms\/ \u2014 Privacy: https:\/\/www.cloudflare.com\/privacypolicy\/<\/li>\nhttps:\/\/www.google.com\/recaptcha\/api\/siteverify<\/code>. Terms: https:\/\/policies.google.com\/terms \u2014 Privacy: https:\/\/policies.google.com\/privacy<\/li>\n<\/ul>\n\n\n
spamify<\/code> folder to the \/wp-content\/plugins\/<\/code> directory, or install it through the Plugins screen in WordPress.<\/li>\n\n
Does this plugin send any data to your servers?<\/h3><\/dt>\n
Is SMTP verification required?<\/h3><\/dt>\n
Which PHP version is required?<\/h3><\/dt>\n
Why are some submissions marked \"unverifiable\"?<\/h3><\/dt>\n
Is there a Pro version?<\/h3><\/dt>\n
I hid my login page and locked myself out. What now?<\/h3><\/dt>\n
define( 'SPAMIFY_HIDE_LOGIN_DISABLE', true );<\/code> to your wp-config.php. wp-login.php works normally again, and you can change or switch off the setting from Protection \u2192 Hide login.<\/p><\/dd>\nDoes hiding the login work on multisite?<\/h3><\/dt>\n
define( 'SPAMIFY_HIDE_LOGIN_SLUG', 'secret-login' );<\/code> to wp-config.php. wp-signup.php and wp-activate.php stay reachable so registration and activation keep working. The feature needs pretty permalinks.<\/p><\/dd>\n\n<\/dl>\n\n\n1.0.0<\/h4>\n\n
\n
SPAMIFY_HIDE_LOGIN_SLUG<\/code> constant enforces one address across the whole network.<\/li>\n