About this plugin
Spambargo is a simple anti-spam plugin for WordPress site owners, agencies and website builders. It helps block unwanted form submissions, comments and WooCommerce spam without requiring a third-party CAPTCHA service or complicated setup.
It works with Elementor Pro Forms, Contact Form 7, JetFormBuilder, Ninja Forms, WooCommerce registration and checkout, WooCommerce Checkout Blocks, WordPress comments, and eligible generic lead forms.
Common spam terms are pre-filled on fresh installs. Review and adjust the rules for your audience. The most useful controls are shown first, while technical options stay under Advanced settings.
What can Spambargo block?
- Messages containing blocked words or phrases.
- Messages with too many links.
- Visitors from selected countries (when a supported geolocation source is available).
- Visitors whose preferred browser languages match selected language codes.
- Disposable and suspicious email addresses.
- Forms submitted unrealistically fast.
- Repeated submissions from the same visitor.
- Specific email addresses and email domains.
- Specific IP addresses and IPv4 or IPv6 network ranges.
- Messages written mostly in capital letters.
- Clearly suspicious phone number patterns when the optional phone check is enabled.
- Additional automated spam using optional browser-token and math-challenge checks.
Supported forms and integrations
- Elementor Pro Forms.
- Contact Form 7.
- JetFormBuilder.
- Ninja Forms.
- WooCommerce registration and classic checkout.
- WooCommerce Checkout Blocks.
- WordPress comments.
- Eligible generic HTML lead forms using a best-effort browser-side pre-check.
Native integrations validate submissions on the server. Generic forms without a native integration use a browser-side pre-check and require a native or custom server-side integration for protection against direct POST requests.
Simple to set up
- Dashboard statistics and the main protection settings are available on one screen.
- Blocked words and phrases, link limits, email checks and automatic limits appear first.
- Country and browser-language selectors support searching, multiple choices, flags and comma-separated codes.
- Spam keywords are populated by default on new installs, without overwriting existing settings.
- Advanced technical controls stay collapsed until you need them.
- A searchable spam log helps you understand what was blocked and why.
How protection works
Spambargo combines several lightweight checks instead of relying on a single CAPTCHA:
- Literal blocked-word and phrase rules with case-insensitive matching.
- Link-count and email-pattern checks.
- Honeypot and minimum submission-time checks.
- Atomic minute and hourly rate limits with IPv6 network grouping.
- Manual email, domain, IP and CIDR block lists.
- Optional phone validation, math challenge and temporary signed browser correlation token.
- Trusted-proxy handling for forwarded visitor IP addresses.
- Automatic log retention, streamed CSV export and batched email or webhook notifications.
Spambargo runs its checks locally on the WordPress site by default and does not require a CAPTCHA service operated by a third party.
Privacy
Spambargo does not send data to a service operated by the plugin author. All checks run on the site server by default.
When a submission is blocked, the plugin may store the IP address, email address, form identifier, block reason, optional content snippet and optional verified fingerprint hash. The content snippet can be disabled and logs are cleaned according to the configured retention period.
Optional browser correlation collects coarse screen-size buckets, timezone, language, platform, CPU-core count and touch capability. The server combines them with a random per-session identifier and returns a signed hash token stored in browser sessionStorage for up to eight hours. Raw attributes are not written to the spam log.
Administrators should update their privacy notice as required by applicable law. Spambargo integrates with WordPress personal-data export and erasure tools and adds suggested text to the Privacy Policy Guide.
When a webhook URL is configured, batched blocked-submission data is sent to that administrator-selected endpoint. This is the only optional external data transfer performed by the plugin.