About this plugin
DigitaleZen AntiSpam Shield for CF7 protects Contact Form 7 submissions without adding a CAPTCHA or requiring form-tag configuration.
Its checks run through Contact Form 7’s supported spam API and include:
- An automatic, visually hidden honeypot.
- A site-signed form token with a minimum submission time.
- Per-IP and per-email rate limiting.
- A local adaptive blacklist that learns site-HMAC email/IP identities only from high-confidence spam signals.
- Matching against migrated or locally supplied domain, username, and keyword rules.
- Contact Form 7 spam-log integration for every local decision.
Blocked-event data is stored in private WordPress database tables. The default privacy mode stores masked email and IP values together with site-specific HMAC identifiers. Events are removed automatically after 30 days by default; administrators can select a retention period from 1 to 365 days.
The local reputation threshold is deliberately conservative. Learned entries expire after 90 days without new evidence, and administrators can reset all learned reputation after a suspected false positive. The signed JSON blacklist is rebuilt locally with an atomic replacement and a verified database fallback.
It contains no plaintext email or IP address.
The dashboard provides local event totals, a text-accessible chart summary, protected CSV export, local-blacklist status, privacy controls, and optional weekly email reports. Weekly reports are disabled by default.
0 installation, it first stores a checksum-verified private backup of known legacy files, imports compatible log and blacklist data, and only then removes those files from the public uploads directory. The original private migration backups remain available for administrator-controlled deletion.
Privacy
Blocked events are stored locally in WordPress database tables and are subject to the configured retention period. The plugin registers exporters and erasers with the WordPress personal-data tools and adds suggested privacy-policy text under Settings > Privacy.
The reputation table and signed local JSON use site-specific HMAC values for email and IP identities. Those values cannot be reused as a shared cross-site blacklist. The JSON is placed in a randomized plugin directory with Apache/IIS deny rules and a blocking index file; the verified database copy remains the runtime fallback.
CSV exports are available only to administrators, require a WordPress nonce, and neutralize spreadsheet formula prefixes.
External services
This plugin does not use an external blacklist, CAPTCHA, analytics endpoint, CDN asset, or other external service. All detection, learning, storage, JSON generation, and scheduled cleanup run on the site that installed the plugin.