Title: QWeb Spam Shield Author: qwebmaster Published: জুলাই 23, 2026 Last modified: আগষ্ট 24, 2026 --- প্লাগিনৰ সন্ধান কৰক ![](https://ps.w.org/qweb-spam-shield/assets/banner-772x250.png?rev=3619777) ![](https://ps.w.org/qweb-spam-shield/assets/icon-256x256.png?rev=3619777) # QWeb Spam Shield [qwebmaster](https://profiles.wordpress.org/qwebmaster/)-ৰ দ্বাৰা [ডাউনল’ড কৰক](https://downloads.wordpress.org/plugin/qweb-spam-shield.1.0.5.zip) * [বিশদ বিৱৰণ](https://as.wordpress.org/plugins/qweb-spam-shield/#description) * [পৰ্য্যালোচনা](https://as.wordpress.org/plugins/qweb-spam-shield/#reviews) * [ইনষ্টলেশ্যন](https://as.wordpress.org/plugins/qweb-spam-shield/#installation) * [বিকাশ](https://as.wordpress.org/plugins/qweb-spam-shield/#developers) [সাহায্য](https://wordpress.org/support/plugin/qweb-spam-shield/) ## বৰ্ণনা QWeb Spam Shield blocks spam across your entire site, not just your contact form, and it does it without a single CAPTCHA. No puzzles for your real visitors, no account, no API key, and no external service. Everything runs on your own server and nothing ever leaves your site. Most anti-spam plugins only watch comments or a single form. QWeb Spam Shield guards every place spam and abuse actually get in: * Every form: Gravity Forms, Contact Form 7, WPForms, Fluent Forms, Elementor Pro Forms, Ninja Forms and Formidable, plus a universal wp_mail catch-all that automatically covers any other form plugin * WordPress comments and WooCommerce product reviews * User registration, so fake and bot sign-ups are stopped before an account is ever created * WooCommerce checkout, with card-testing (carding) defenses that stop attackers from validating stolen cards on your store with waves of fake orders, and running up your payment processing fees * Your outbound email: the built-in Mail Guard rate-limits the mail your own site sends, so a hacked form or a runaway plugin cannot blast thousands of messages and wreck your domain’s sending reputation No CAPTCHA, ever. Your visitors never see a checkbox, a puzzle, or a “click all the crosswalks” challenge. Detection runs invisibly in the background, so genuine customers sail through and only spam is stopped. How it decides (fast, all local): * Content signals: links in messages, gibberish, non-Latin scripts (French, German, and Spanish accents are allowed), marketing-pitch phrasing, and banned keywords matched on whole words * Identity signals: disposable-email domains (a bundled list of about 7,900), missing MX records with typo tolerance, and role accounts * Behavioral signals: honeypot, submission timing, and per-email or per-IP velocity for repeat offenders Built for site owners: * A grouped spam log. A 1,000-request attack is one counted row, not 1,000, so your day-to-day spam stays visible. It is auto-cleaned by age and a row cap. * Conservative by design. Genuine customer questions are not hard-blocked. Borderline submissions are held for review, never silently lost, and can be re-delivered. * Comments use WordPress moderation (spam folder or moderation queue), so nothing is destroyed. * GDPR friendly: IP anonymization, configurable retention, and support for Tools then Export or Erase Personal Data. Privacy: QWeb Spam Shield makes no external HTTP requests. It does not phone home, and it does not require a license, account, or third-party service. Need even stronger protection? Meet QWeb Spam Shield AI This free plugin is fully functional on its own and always will be. QWeb Spam Shield AI is the premium edition for sites that want the strongest protection possible. It layers a managed AI engine and a cross-site defense network on top of everything above: * Managed AI tiebreaker. A purpose-built AI reviews only the borderline submissions the rules engine is unsure about, so you catch more real spam without ever blocking a genuine customer. There is no API key to buy or configure. It is included with your license. * AI review of held submissions. Every held message is re-checked against your own business context, and real customer inquiries are released automatically. False positives drop close to zero, completely hands-off. * Cross-site pattern network. The instant spam is confirmed on any protected site, every other licensed site is protected from it too, so your site benefits from attacks aimed at everyone else. * Sharper detection that keeps improving, tuned continuously on live spam across the whole network. * Faster, fully automatic updates delivered straight to your dashboard. * Priority support from the team that builds it. Get QWeb Spam Shield AI at https://qwebspamshield.com ### Source code and build tools The plugin ships all of its source. The only compiled asset is the React admin app in admin/build/, generated from the human-readable source included in admin/src/ with the official WordPress build tooling: 1. Run `npm install` in the plugin root (uses package.json, @wordpress/scripts). 2. Run `npm run build`. This regenerates admin/build/index.js and style-index.css. Everything else (PHP, the frontend honeypot script in assets/js/, CSS) is plain, unminified source. The bundled disposable-email-domain list in data/ comes from the public domain disposable-email-domains project (github.com/disposable-email- domains). ## স্ক্ৰীনশ্বট [⌊Dashboard: spam blocked, held, and allowed at a glance, with recent activity and sources.⌉⌊Dashboard: spam blocked, held, and allowed at a glance, with recent activity and sources.⌉[ Dashboard: spam blocked, held, and allowed at a glance, with recent activity and sources. [⌊Activity log: every inbound and outbound decision, with the reason it was flagged.⌉⌊ Activity log: every inbound and outbound decision, with the reason it was flagged .⌉[ Activity log: every inbound and outbound decision, with the reason it was flagged. [⌊Detection settings: tune the fast, multi-layer rules engine and the score thresholds.⌉⌊ Detection settings: tune the fast, multi-layer rules engine and the score thresholds .⌉[ Detection settings: tune the fast, multi-layer rules engine and the score thresholds. [⌊Integrations: turn protection on per form plugin, comments, registration, and WooCommerce.⌉⌊Integrations: turn protection on per form plugin, comments, registration, and WooCommerce.⌉[ Integrations: turn protection on per form plugin, comments, registration, and WooCommerce. [⌊Mail Guard: rate-limit outbound email, auto-ban flooders, and hold overflow for review.⌉⌊Mail Guard: rate-limit outbound email, auto-ban flooders, and hold overflow for review.⌉[ Mail Guard: rate-limit outbound email, auto-ban flooders, and hold overflow for review. [⌊Spam patterns: signatures the plugin learned from spam blocked on your own site.⌉⌊ Spam patterns: signatures the plugin learned from spam blocked on your own site.⌉[ Spam patterns: signatures the plugin learned from spam blocked on your own site. [⌊Privacy: review digests, data retention, and GDPR export and erase options.⌉⌊Privacy: review digests, data retention, and GDPR export and erase options.⌉[ Privacy: review digests, data retention, and GDPR export and erase options. [⌊Setup wizard: confirm protection is live and which forms are covered.⌉⌊Setup wizard: confirm protection is live and which forms are covered.⌉[ Setup wizard: confirm protection is live and which forms are covered. ## ইনষ্টলেশ্যন 1. Upload the plugin to /wp-content/plugins/, or install it from Plugins then Add New, and activate it. 2. That is it. Protection is on by default with safe settings. Review and tune it under Spam Shield. ## সঘনাই উত্থাপিত প্ৰশ্ন ### Does it need an account or API key? No. It runs entirely on your server with no account, no API key, and no external calls. ### Will it block real customers? It is tuned to avoid that. Genuine product, order, and shipping questions pass through. Only high-confidence spam is filed away, and borderline submissions are held for review rather than deleted. ### Does it cover my form plugin? Gravity Forms, Contact Form 7, WPForms, Fluent Forms, Elementor Pro Forms, Ninja Forms, and Formidable Forms have dedicated integrations. Any other form plugin is still covered by the universal wp_mail catch-all. ### Does it work with WooCommerce? Yes. It covers product reviews and both the classic and block (Store API) checkout, with card-testing defenses. High-Performance Order Storage (HPOS) is supported. ### Is my data sent anywhere? No. The plugin makes no external requests and stores everything locally, with optional IP anonymization and content retention limits. ## পৰ্য্যালোচনা এই প্লাগিনৰ বাবে কোনো পৰ্য্যালোচনা নাই। ## অৱদানকাৰী আৰু বিকাশকাৰীসকল “QWeb Spam Shield” হৈছে মুক্ত উৎসৰ ছফ্টৱেৰ। এইসকল লোকে এই প্লাগিনত অৱদান আগবঢ়াইছে। অৱদানকাৰীসকল * [ qwebmaster ](https://profiles.wordpress.org/qwebmaster/) [আপোনাৰ ভাষাত “QWeb Spam Shield” অনুবাদ কৰক।](https://translate.wordpress.org/projects/wp-plugins/qweb-spam-shield) ### বিকাশৰ প্ৰতি আগ্ৰহী? [ক’ড ব্ৰাউজ কৰক](https://plugins.trac.wordpress.org/browser/qweb-spam-shield/), [SVN ৰিপজিটৰী](https://plugins.svn.wordpress.org/qweb-spam-shield/) চাওক নাইবা [RSS](https://plugins.trac.wordpress.org/log/qweb-spam-shield/?limit=100&mode=stop_on_copy&format=rss)- দ্বাৰা [বিকাশৰ পঞ্জী](https://plugins.trac.wordpress.org/log/qweb-spam-shield/) ছাবস্ক্ৰাইব কৰক। ## সলনি-পঞ্জী #### 1.0.5 * Fixed: the Fluent Forms integration scored every submission twice. Fluent Forms fires both its modern validation filter and a legacy alias for the same submission, so each visitor counted double toward velocity limits, the log grew two rows per submission, and the second scoring run could cross a block threshold the first run did not. The integration now scores once per submission and replays that outcome on the duplicate call. #### 1.0.4 * Fixed: the Fluent Forms integration could silently reject genuine submissions. The scoring pipeline was fed Fluent Forms’ own framework fields, so the random- hex form nonce tripped the gibberish heuristic on every submission, and the resulting error was attached to that hidden field so the visitor saw no response. Framework fields are now excluded from scoring, only a hard block rejects the form (borderline submissions are held for review instead), and a block error now shows on the first visible field. * Changed: weak signals alone never hard-block. Soft heuristics (lone junk tokens, low-count velocity, a single link) could stack past the block threshold with no actual spam content. A hard block now requires at least one strong signal; anything weaker is held for review, so the message stays recoverable. #### 1.0.3 * Hardening: every PHP file now carries a direct-access guard. 95 files had none, so requesting one directly ran its top-level code instead of exiting. * Build: the packaging script now excludes .DS_Store and asserts both that exclusion and the direct-access guards, so neither can come back. #### 1.0.2 * Removed development files from the package (.github) and removed the Mail Guard development simulator from the plugin entirely. #### 1.0.1 * Hardened database queries and input handling following plugin review feedback. Regex patterns are length-capped and unsafe shapes are refused before evaluation. #### 1.0.0 * First public release. Multi-layer rules engine. Integrations for Gravity Forms, Contact Form 7, WPForms, Fluent Forms, Elementor, Ninja Forms, Formidable, comments, registration, and WooCommerce (classic and block checkout). Universal wp_mail catch-all. Mail Guard outbound throttle. Grouped spam log. Held-submission review and re-delivery. GDPR export and erase. No external calls. ## মেটা * **1.0.5** সংস্কৰণ * **6 দিন আগত** শেষবাৰ আপডে’ট হৈছিল * সক্ৰিয় ইনষ্টলেশ্যন **10টাতকৈ কম** * WordPress-ৰ সংস্কৰণ ** 5.8 বা তাতকৈ ওপৰৰ ** * ইমানলৈকে পৰীক্ষা কৰা হৈছে **7.1** * PHP-ৰ সংস্কৰণ ** 7.4 বা তাতকৈ ওপৰৰ ** * ভাষা * [English (US)](https://wordpress.org/plugins/qweb-spam-shield/) * [antispam](https://as.wordpress.org/plugins/tags/antispam/)[contact form](https://as.wordpress.org/plugins/tags/contact-form/) [no captcha](https://as.wordpress.org/plugins/tags/no-captcha/)[spam](https://as.wordpress.org/plugins/tags/spam/) [woocommerce](https://as.wordpress.org/plugins/tags/woocommerce/) * টেগবোৰ * [উচ্চখাপৰ ভিউ](https://as.wordpress.org/plugins/qweb-spam-shield/advanced/) ## ৰে’টিংবোৰ এতিয়ালৈ কোনো পৰ্য্যালোচনা দাখিল কৰা হোৱা নাই। [Your review](https://wordpress.org/support/plugin/qweb-spam-shield/reviews/#new-post) [সকলো পৰ্য্যালোচনা চাওক](https://wordpress.org/support/plugin/qweb-spam-shield/reviews/) ## অৱদানকাৰীসকল * [ qwebmaster ](https://profiles.wordpress.org/qwebmaster/) ## সাহায্য কিবা ক’বলগীয়া আছে? সহায় লাগে? [সাহায্যৰ ফ’ৰাম চাওক](https://wordpress.org/support/plugin/qweb-spam-shield/)