Spam stops at your forms, not your inbox.
SpamShield Pro protects WordPress forms, comments and registrations with a risk engine that runs on your own server. Add the cloud checks when you want authoritative email validation and language detection.
- 0data sent off your server by default
- 72,000+disposable domains offline
- 176languages in the cloud
Try the cloud checks
Every submission gets screened before it lands.
Many small signals add up to one risk score per submission. You choose the threshold, or switch to block-on-any-signal mode, and tune every weight.
| Submission | What SpamShield sees | Result |
|---|---|---|
| jane@mailinator.com | Disposable email. Caught by the offline list of 72,000+ domains; unknown domains go to the cloud check on Pro. | BLOCKED |
| "Boost your rankings with AI…" | AI-written SEO outreach. Detected by the AI-content and outreach-pattern checks. | BLOCKED |
| ' OR 1=1 -- | Injection attempt. SQL, XSS, command, path traversal, SSRF and SSTI patterns are flagged. | BLOCKED |
| 12 signups in 30 s | Velocity and bots. Rate limits per IP, email and form, plus headless-browser and keystroke signals. | BLOCKED |
| Message in Russian on an English-only site | Language filter. Local detection for 40+ languages, or 176 languages with the cloud check. | HELD |
| priya@company.in | Real visitor. Clean reputation, real mail server, human typing pattern. | ACCEPTED |
- Contact Form 7
- WPForms
- Gravity Forms
- Ninja Forms
- Forminator
- Elementor Pro
- Ultimate Member
- ProfilePress
- WordPress comments
- WordPress registration
Free protects every site. Pro adds the cloud.
The free plugin is complete on its own and never contacts an external service. Pro adds two hosted checks that fall back to the offline engine on any error, quota limit or expiry.
| Feature | Free | Pro |
|---|---|---|
| Offline engine (runs on your server) | ||
| Risk scoring with configurable weights, binary mode | Yes | Yes |
| Offline disposable-email list (72,000+), role and free-provider checks | Yes | Yes |
| Local language detection (40+ languages) | Yes | Yes |
| Injection, bot and headless-browser detection | Yes | Yes |
| AI-generated content and AI-SEO outreach detection | Yes | Yes |
| Velocity limits, reputation scoring, VPN / proxy / Tor and new-domain checks | Yes | Yes |
| Honeypot, country blocking, block and allow lists | Yes | Yes |
| SignupSentry: registration risk, request firewall, login hardening, file-integrity scan | Yes | Yes |
| Cloud and extras | ||
| Email Validation API: disposable, invalid and risky domains the offline list doesn't know | — | Yes |
| Language Detection API: 176 languages, used first with local fallback | — | Yes |
| Daily data-feed updates and on-demand "Update now" | — | Yes |
| Unlimited workflow automation, larger custom lists, longer analytics history | — | Yes |
Protected in three steps.
Install the plugin
From WordPress.org, or upload the ZIP under Plugins → Add New.
Protection starts at once
The offline engine works immediately. Tune the weights and integrations under SpamShield Pro → Settings.
Turn on the cloud (Pro)
Activate your license and the API key fills itself in. Your usage for both checks shows up in your dashboard here.
Pick the volume you need.
Pro plans are billed yearly and include both cloud checks. Each check has its own monthly quota, which resets on the day you activated.
Bought SpamShield on CodeCanyon? Your plugin works fully offline. Choose any plan above to add the cloud checks, then paste the license key under API Settings.
Questions
Does the free version send my form data anywhere?
No. All free detection runs on your server. The two cloud checks are off by default and only used when you enable them with a Pro license.
What happens if the cloud is down or my quota runs out?
SpamShield falls back to the offline engine automatically. Your site stays protected and visitors never see an error. We email you at 80% of a quota and when one is used up.
What counts towards my quota?
One email check per submitted address the offline list doesn't already recognise, and one language check per message sent to the cloud. Both quotas reset monthly on your activation date.
What if my renewal payment fails?
Cloud checks keep working for 3 days after expiry while you update your card. After that the offline engine carries on alone.
Which form plugins are supported?
Contact Form 7, WPForms, Gravity Forms, Ninja Forms, Forminator, Elementor Pro, Ultimate Member, ProfilePress, and core WordPress comments and registration.
What data do the cloud checks receive?
Only the submitted email address (email check) or message text (language check), with your license key. Nothing is stored beyond usage counts. See the privacy policy.