Title: Synth Antispam Author: Synth AI Published: ছেপ্টেম্বৰ 18, 2026 Last modified: ছেপ্টেম্বৰ 18, 2026 --- প্লাগিনৰ সন্ধান কৰক ![](https://ps.w.org/synth-antispam/assets/banner-772x250.png?rev=3702774) ![](https://ps.w.org/synth-antispam/assets/icon.svg?rev=3702774) # Synth Antispam [Synth AI](https://profiles.wordpress.org/synthplatform/)-ৰ দ্বাৰা [ডাউনল’ড কৰক](https://downloads.wordpress.org/plugin/synth-antispam.0.1.0.zip) * [বিশদ বিৱৰণ](https://as.wordpress.org/plugins/synth-antispam/#description) * [পৰ্য্যালোচনা](https://as.wordpress.org/plugins/synth-antispam/#reviews) * [ইনষ্টলেশ্যন](https://as.wordpress.org/plugins/synth-antispam/#installation) * [বিকাশ](https://as.wordpress.org/plugins/synth-antispam/#developers) [সাহায্য](https://wordpress.org/support/plugin/synth-antispam/) ## বৰ্ণনা Synth Antispam connects your site to Synth for WordPress, the hosted AI spam-checking service built on Synth — the same platform that already reads more than three million messages a year. Every comment is judged on what it is trying to sell, not matched against a keyword list you have to keep current, and not scored by code running on your site. To get started: install the plugin, open Settings Synth Antispam and press **Get a site key** — there is nothing to copy by hand. The visitor never waits: the verdict comes back a moment after the comment is submitted, not in the middle of the request. Spam lands in the Spam folder, or in the moderation queue in strict mode. **Nothing is ever deleted.** The plugin never removes a comment and never puts one in Trash, so a comment filed as spam by mistake stays recoverable for as long as you keep it. WordPress’s scheduled cleanup empties Trash, not Spam. #### Why a model instead of a rule list * **Rewording does not help the spammer.** A rule list matches strings, so the spammer edits the string. A model reads the message — and the message is the thing being sold. * **Nothing to maintain.** No keyword lists, no blocklists, no regular expressions to update when the wording shifts. * **Every surface, not just the form.** The comment form, the REST API and XML- RPC are all checked, and so are pingbacks and trackbacks. * **You can see why.** The verdict appears as its own column in the comments list, so a comment in the Spam folder is explainable instead of mysterious. * **Your judgement wins.** A decision you or another moderation plugin already made is left alone. Marking a comment as not-spam sends that correction back and teaches the filter. * **Your site works when ours does not.** If the service is unreachable you choose what happens: publish as usual (the default) or hold for review. Running out of your monthly allowance does not switch the plugin off either. * **Nothing runs on your visitors.** No detection logic on your server, no scripts on your pages, no visitor tracking. Only what a verdict needs is sent, listed field by field under “External services”. You supply one thing: a site key. Until a key is entered the plugin sends no request at all, and comments publish exactly as they would without it. ### External services This plugin is a thin client for the **Synth Antispam classification service**, an external, cloud-hosted processor. It sends each new comment (and pingback or trackback) to that service to obtain a spam verdict, and applies the verdict using WordPress’s own moderation tools (Spam folder or moderation queue — see “Description” above). It also asks that same service for this site’s key when you press **Get a site key**. No request serves any other purpose; the full list is below. The service is operated by LightApps OÜ (Estonia). Its terms and its privacy policy for this plugin — including the controller/processor split described below, where the data is processed, and who else it reaches — are published here: * Terms of Use: https://synth.locker/assets/legal/wordpress-terms-of-use.html * Privacy Policy: https://synth.locker/assets/legal/wordpress-privacy-policy.html * Pricing: https://wordpress.synth.locker/pricing Both legal documents cover the WordPress service specifically. Synth also operates a Telegram service under separate general documents, which do not apply to this plugin. **This is a paid, cloud-hosted service.** Every site that registers is given a starting allotment of checks at no charge, and higher volumes are available on paid subscription tiers above it. Every paid tier applies to one site — a site’s key covers checks made for that site, not a group of sites. Current check volumes and prices are on the pricing page linked above, not in this file: this file ships frozen inside the build and is not corrected between releases, while they change. **Running out of checks does not turn off anything this plugin does.** When a site has used its checks for the current period, the classification service simply stops answering new requests for that site until the period resets — the plugin does not lock, gate, or disable any of its own functionality in response, and it never has: no feature, mode, or setting in this plugin is gated behind a tier or a payment state, at any usage level. Comments continue to be handled by WordPress’s own native moderation tools, the same as whenever the service is briefly unreachable for any other reason. **Every request this plugin can make, in full.** Each one goes to the one service named above and to nothing else — see “Payments” below for the single case where your browser, rather than this plugin, is sent somewhere else: 1. **Submitting a comment for a verdict.** One request per comment, carrying the fields listed below, field by field. 2. **Collecting the verdict.** A verdict is not returned immediately, so the plugin asks for it a short time later. This second request carries **only the identifier the service issued for that comment in step 1, and nothing else — no comment text, no commenter details, nothing about your site. 3. **Reporting a moderator correction — off by default, and it makes no request unless you turn it on. If you switch it on, then when a moderator marks one of our decisions as wrong, the plugin sends the identifier from step 1 together with what the moderator decided (spam or not spam) — and nothing else. This is controlled by the `synth_wp_send_feedback` filter, which ships returning `false`; with no code added to your site, this request never happens. 4. **Asking for a site key — only when you press the button.** **Get a site key** sends one request carrying the plugin version and nothing else: nothing about your site, nothing about a comment or a commenter. It never fires on its own, and only the key is kept from the answer. Your site’s address reaches the service with the first comment it checks — that is the request in step 1, which already carries it, and it is what ties the key to this site. 5. **Checking the remaining allowance — only while an administrator has the settings screen open. Sends your site key and site address, nothing else. Read-only; costs no check. 6. **Starting a purchase — only when you press an upgrade button.** Sends your site key, site address and the option pressed, then takes you to the provider’s own payment page. **No card details reach your site, this plugin, or this service.** **Payments — the only time your browser leaves your site, and only if you press an upgrade button.** Payment is taken by **Stripe** (Stripe Payments Europe, Ltd.), not by us. This plugin sends nothing to Stripe: it asks the Synth Antispam service for a payment page address, checks that the address really is Stripe’s checkout page, then opens it in your browser. What you type there, card details included, goes from your browser to Stripe and reaches neither your site, nor this plugin, nor the Synth Antispam service. Stripe’s own documents govern that page: * Stripe Terms: https://stripe.com/legal * Stripe Privacy Policy: https://stripe.com/privacy Press no upgrade button and Stripe is never involved. Entering a site key is not a subscription step and does not put your site on a plan: no feature, mode, or setting in this plugin is gated behind a tier, a payment state, or a trial. Everything the plugin can do, it does for every configured site. **Nothing is sent until you opt in.** The plugin attaches no comment-checking hooks until both a service address and a site key are set; with either missing it behaves as with no key at all, and the service is never contacted for any comment. Setting that pair — on the Settings Synth Antispam screen, or at network level on multisite— is the act of opting in and is the consent gate; there is no separate checkbox. **Exactly what is sent, field by field.** This list matches the plugin’s request builder field for field — nothing beyond it leaves your site: * `schema_version` — the version of the request format, so the service stays compatible with older and newer plugin versions at once. * `plugin_version` — the installed plugin version, for the same compatibility reason. * `surface` — a fixed label saying the request comes from the comment form (`wp_comment` in this version; a hook for future integrations such as forms outside comments). * `object_type` — `comment`, `pingback`, or `trackback`: the latter two are machine- submitted and the service weighs them differently. * `content.body` — the comment text as submitted, before any of WordPress’s own HTML filtering runs, so a link the filtering would otherwise strip is still visible to the classifier. * `content.author_name` — the display name the commenter typed into the comment form. * `content.author_url` — the website URL the commenter typed into the comment form. On the traffic this plugin was built against, this field carries a very strong share of the spam signal — most of it is not visible in the comment text at all. * `content.author_email_domain` — only the domain part of the commenter’s email address (for example `gmail.com`), used to recognise disposable or throwaway email patterns. **The email address itself is never sent** — see “What is never sent” below. * `content.author_id_hash` — a one-way SHA-256 hash of the commenter’s email address combined with a secret value generated for your site alone (your site’s own “ salt”). It lets the service recognise that two comments on your site came from the same email address without ever receiving that address. Because the salt is unique to your site and known only to it, the same commenter cannot be linked across two sites using this plugin — impossible by construction, not merely disabled. It is a per-site pseudonym, not an anonymised identifier: uninstalling the plugin destroys the salt (see “Retention” below), after which even this site can no longer connect a previously sent hash back to an email address. * `context.author_status` — either `registered` (a logged-in registered user of your site) or `anonymous` (everyone else). Only these two values are ever sent: a commenter who already has an approved comment on your site is trusted and skipped** before** any request is built, so their comment is never sent at all and no status is transmitted for them. * `context.is_reply` — whether the comment is a reply to another comment. * `context.site_locale` — your site’s configured language (for example `en_US`), used as a hint for language-specific handling. * `context.client_ip_status` — `absent` if the request carried no IP address, or` direct` if it did. This tells the service only whether one was present — **the address itself is never sent, in either case** — see “What is never sent” below. The plugin never reconstructs a “real” visitor IP from proxy or CDN forwarding headers: those are only as trustworthy as whoever sent the request, and a site behind a proxy cannot tell the difference. * `context.has_user_agent` — `true` or `false`, whether the browser sent a User- Agent string at all. **The User-Agent string itself is never sent** — see “What is never sent” below. **What is never sent, under any circumstances:** * The commenter’s **full email address** — only the domain (`content.author_email_domain`) and a salted one-way hash (`content.author_id_hash`) ever leave your site. * The commenter’s **IP address** — only the two-value status above (`context.client_ip_status`) leaves your site; the address itself never does. * The commenter’s raw **User-Agent string** — only whether one was present (`context. has_user_agent`) leaves your site. * The post’s title or body, the HTTP referrer, cookies, or any form field other than the comment fields listed above. **Retention.** Two separate things are kept, for two different lengths of time. _The verdict record._ The verdict for each comment is retained by the Synth Antispam service for 24 hours and then expires automatically. That is the record your site collects its verdict from. _The training record._ Separately, the service keeps its own copy of each request your site sends — the comment text and the commenter fields listed above, exactly as sent — together with the verdict its classifier produced and any later correction you make with the **Not spam** / **Spam** buttons in your Comments list. It uses those copies to train and improve the Synth spam-classification models. **These copies are kept indefinitely: they have no expiry date. They are stored as sent — not anonymised, not aggregated, and not reduced to statistics. This applies to every site that uses the service; there is no setting, on this screen or anywhere else, that turns it off. If that is not acceptable for your site, the choice available to you is not to install the plugin. _Deletion on request._ To have your site’s stored copies deleted, write to support@ synth.locker with your site’s address. The service can delete them by site key, so a request covers every copy taken from your site rather than one comment at a time. An operator tool for this deletion is being built alongside this release; until it is in place the deletion is performed by hand on request, and the address above is the route either way. Uninstalling this plugin permanently deletes your site’s secret salt; after that, no author_id_hash it previously sent can be linked back to an email address, by this site or by the service. Uninstalling does **not** by itself delete copies already taken — use the address above for that. Your site key is the one thing deliberately left behind, so that reinstalling the plugin does not cost you the checks attached to it. Tick **Delete the site key when the plugin is deleted** on the settings screen if you want it removed too. **Your own obligations under privacy law** — see “For site owners: your obligations under GDPR and similar privacy laws” in the Frequently Asked Questions above. #### Every address that appears in the source A search of this plugin’s files finds these addresses and no others: * `wp-api.synth.locker` — the Synth Antispam service above. The shipped default; changeable on the settings screen or in `wp-config.php`. **The only address this plugin sends a request to.** * `checkout.stripe.com` — Stripe’s payment page. No request is sent there; the address is present only so the plugin can check that the payment page it was handed really is Stripe’s (see “Payments” above). * `synth.locker` and `wordpress.synth.locker` — the terms, privacy, pricing and plugin home pages linked above. Links for you to follow; nothing is sent to them. * `www.gnu.org` — the GPL licence text. * `your-synth-endpoint.example` and `https://x` — not addresses: a greyed-out example in the empty settings field, and an example inside a code comment. ## স্ক্ৰীনশ্বট [⌊The verdict for every comment, in the Comments list. Each row shows the category the classifier assigned and how sure it was, so a comment in the Spam folder is explainable rather than mysterious — and a mistake is easy to spot and reverse.⌉⌊ The verdict for every comment, in the Comments list. Each row shows the category the classifier assigned and how sure it was, so a comment in the Spam folder is explainable rather than mysterious — and a mistake is easy to spot and reverse.⌉[ The verdict for every comment, in the Comments list. Each row shows the category the classifier assigned and how sure it was, so a comment in the Spam folder is explainable rather than mysterious — and a mistake is easy to spot and reverse. ## ইনষ্টলেশ্যন 1. Install the plugin and activate it. Nothing happens on activation: the plugin attaches no comment hooks and contacts nothing at all until it has been configured. 2. Open Settings Synth Antispam and press **Get a site key**. The button is shown while this site has no key: pressing it asks the Synth Antispam service for a key and stores the key it issues, so there is nothing to copy by hand and no account to create. Nothing about your site is sent when you press it; the key attaches itself to this site the first time it checks a comment. The **Service address** is already filled in with the Synth Antispam service and needs no change. If somebody has already given you a key for this site, paste it into the **Site key** field instead and save; the button is not shown once a key is set, because asking for a second key would revoke the one that works. An install that is never given a key simply stays unconfigured, and that state is safe: see step 5. 3. The address can be overridden if you need a different deployment: change it on the settings screen, or set `define('SYNTH_WP_API_BASE', 'https://…');` in `wp- config.php`. A value set there wins over the stored one, and the field on the settings screen is then shown disabled, naming where its value came from. 4. Press **Test connection**. It reports one of seven distinguishable states — success, no key set, address not configured, invalid or revoked key, key issued to a different domain, monthly quota used up, or service temporarily unreachable — so a misconfiguration can be told apart from an outage before a single comment is sent. 5. Until both fields are set, the plugin does nothing to your comments: no request leaves your site, and every comment is published, held or marked exactly as WordPress and your own comment rules decide, as though the plugin were not installed. “Test connection” in that state reports that the service address has not been configured for this install yet. 6. While you are on that screen, choose the two fallbacks: what happens **when the service is unreachable** (publish the comment — the default — or hold it for review), and what happens **when the monthly check quota is used up** (let your site decide— the default — or hold the comment until the quota resets). Both concern comments the service did not answer for; neither turns off anything this plugin does. **Multisite.** Activating the plugin network-wide requires a network-level site key to be set already: without one, activation is refused with a notice rather than silently doing nothing. Activating it on individual sites is unaffected. Where the network sets an address or a key, that value wins over a single site’s own; where the network leaves the address unset, a site can still set its own. ## সঘনাই উত্থাপিত প্ৰশ্ন ### Does the plugin do anything before I give it a service address and a site key? No. With either one missing it attaches no comment hooks, so there is no code path that could contact the service about a comment, and comments are handled by WordPress and your own comment rules exactly as they would be with the plugin absent. The two exceptions are buttons you press yourself on the settings screen — **Get a site key** and **Test connection** — and each sends a single request because that is what pressing it means. Neither carries anything about a comment or a commenter, and neither is ever triggered on its own. ### Will it delete my comments? Never. It does not delete a comment and does not move one to Trash. A comment it marks as spam goes to the Spam folder and stays there until you empty that folder yourself; WordPress’s own scheduled cleanup does not empty the Spam folder, so there is no deadline after which a mistake becomes unrecoverable. ### Can spam be held for review instead of going to the Spam folder? Yes — set **Moderation mode** to Strict on the settings screen, and the same comments go to the moderation queue instead of the Spam folder. ### What happens if the service is unreachable? Whatever you chose under “When the service is unreachable”: publish the comment ( the default, so a visitor never waits on an outage) or hold it for review. The verdict simply never arrives, and no other behaviour changes. ### What happens when my monthly check quota is used up? The service stops answering new checks for your site until the period resets. Nothing in the plugin is switched off in response — no feature, mode or setting here is gated behind a tier or a payment state, at any usage level. Comments meanwhile follow“ When the monthly check quota is used up”: returned untouched to your site’s own decision (the default), or held until the quota resets. ### What happens to my site key if I delete the plugin? It stays. Deleting the plugin removes everything else it stored here — its settings, the verdicts recorded against your comments, its scheduled task, its local secret value — but the site key is left in place, so installing the plugin again carries straight on with the same key and the same monthly allowance of checks. That is deliberate: the key is stored only on your site, the service keeps a one-way hash of it and cannot hand it back, so discarding it would cost you the checks attached to it and there would be no way to recover them. If you would rather leave nothing behind, tick **Delete the site key when the plugin is deleted** on the settings screen before you delete the plugin. There is no way back from that: you can ask for a new key afterwards, but it starts from nothing. On multisite the network-level key is a separate stored value, and the settings screen does not write it. A network administrator who wants it gone runs this before deleting the plugin: ``` wp site option patch insert synth_wp_settings purge_on_uninstall 1 ``` (`insert` and not `update`: the network value has no such setting in it to begin with, and WP-CLI’s patch update refuses a key that is not already there.) ### Does it override Akismet, or a decision I made by hand? No. A status already set by a moderator or by another moderation plugin is left alone rather than overridden. A comment your site has already refused — because another plugin marked it as spam, or because it hit your disallowed keyword list— is not sent to the service at all. A comment your site merely held for review, through your moderation keyword list, is checked, but is never published over that hold. ### Which comments does it check? Comments, pingbacks and trackbacks, whether submitted through the comment form, the REST API or XML-RPC. Authors who can moderate comments, and authors who already have an approved comment on your site, are recognised as trusted before any request is built — their comments are never sent. ### What is sent to the service? The comment text and a small set of context fields, listed one by one under “External services” below. The commenter’s full email address, IP address and raw User-Agent string are never sent. ### Does it work on multisite? Yes. Per-site activation works as usual; network-wide activation requires a network- level site key to be set first, and is refused with a notice if there is none. ### For site owners: your obligations under GDPR and similar privacy laws If any of your commenters are in the EU/EEA/UK, or another jurisdiction with comparable rules, using this plugin makes the Synth Antispam service a data processor acting on your instructions, while your site remains the data controller for its own comments. That adds to your existing obligations rather than replacing them. In practice: 1. **Tell your visitors.** Your privacy policy should name the Synth Antispam service, state that comment data is sent to it to obtain a spam verdict, and list what is sent — the field list under “External services” below. 2. **Have a lawful basis for sending it.** Spam prevention is commonly treated as a legitimate interest, but that determination is yours to make for your own site and jurisdiction; this is not legal advice. 3. **Reflect retention accurately — both parts of it.** State that verdicts are retained for 24 hours and then expire automatically, **and** that the service keeps its own copy of the comment data and the verdict indefinitely, with no expiry, to train and improve the Synth spam-classification models. The second part is not optional to mention and applies to every site; see “Retention” under “External services” below. If your policy today says only the first part, it understates what happens to your commenters’ data. 4. **Update your policy before this site has a key, not after** — sending begins as soon as a valid key is in place, however it got there. WordPress gives you a built-in place to do this: this plugin registers with the Privacy Policy Guide (Tools Privacy Policy Guide “Synth Antispam”), which inserts ready-to-review text covering the same fields and the same retention terms listed under “External services” below, for you to include in your published policy. If you write your policy by hand instead, here is that same list as a paste-ready paragraph, minus the four fields that describe the request’s shape rather than the commenter or the submission — schema_version, `plugin_version`, `surface` and `object_type`. It is generated from the same manifest as that field list, so it cannot fall behind it or over-claim beyond it: > Synth Antispam sends each comment (and each pingback or trackback) to the Synth > Antispam > classification service — an external processor — to obtain a spam verdict. > What is sent: the comment body; the commenter’s display name; the commenter’s > website URL; the domain part (not the full address) of the commenter’s email address; > a one-way salted hash derived from that email address; whether the commenter is > anonymous or a registered user of this site; whether the comment is a reply; the > site’s language; whether an IP address was present at all, never the address itself; > whether a User-Agent string was present at all, never the string itself. Comments > from people who already have an approved comment on this site are not sent to > the service at all. The commenter’s full email address, IP address and raw User- > Agent string are never sent, in any case. Verdicts are retained by the service > for 24 hours and then expire automatically. Separately from that, the service > keeps its own copy of everything listed above, together with the verdict it produced > and any correction a moderator of this site later makes to that verdict, and uses > those copies to train and improve the Synth spam-classification models. Those > copies are kept indefinitely and have no expiry date; the comment text and the > commenter details above are kept as sent, not anonymised or aggregated. This applies > to every site that uses the service: there is no setting that turns it off. To > have this site’s stored copies deleted, write to support@synth.locker. Uninstalling > this plugin deletes this site’s local secret value, after which any previously > sent hash can no longer be linked back to an email address, by this site or by > the service. Note on the two values above: `context.author_status` carries `anonymous` or `registered` and nothing else, matching the field list under “External services” below. “Returning” and “trusted” are states in the plugin’s own local bookkeeping only — a commenter in either state is recognised before any request is built, so their comment is never sent to the service at all and no status is transmitted for them. A contract test compares this paragraph’s enumeration against the value the plugin code actually assigns, so the two cannot drift apart. This plugin also implements WordPress’s core personal-data **export** and **erase** tools (Tools Export Personal Data / Erase Personal Data), covering the classification records it stores locally on your site. ## পৰ্য্যালোচনা এই প্লাগিনৰ বাবে কোনো পৰ্য্যালোচনা নাই। ## অৱদানকাৰী আৰু বিকাশকাৰীসকল “Synth Antispam” হৈছে মুক্ত উৎসৰ ছফ্টৱেৰ। এইসকল লোকে এই প্লাগিনত অৱদান আগবঢ়াইছে। অৱদানকাৰীসকল * [ Synth AI ](https://profiles.wordpress.org/synthplatform/) [আপোনাৰ ভাষাত “Synth Antispam” অনুবাদ কৰক।](https://translate.wordpress.org/projects/wp-plugins/synth-antispam) ### বিকাশৰ প্ৰতি আগ্ৰহী? [ক’ড ব্ৰাউজ কৰক](https://plugins.trac.wordpress.org/browser/synth-antispam/), [SVN ৰিপজিটৰী](https://plugins.svn.wordpress.org/synth-antispam/) চাওক নাইবা [RSS](https://plugins.trac.wordpress.org/log/synth-antispam/?limit=100&mode=stop_on_copy&format=rss)- দ্বাৰা [বিকাশৰ পঞ্জী](https://plugins.trac.wordpress.org/log/synth-antispam/) ছাবস্ক্ৰাইব কৰক। ## সলনি-পঞ্জী #### 0.1.0 * Plugin scaffold, surface-adapter interface, settings screen, connection test ( T-493). ## মেটা * **0.1.0** সংস্কৰণ * **13 ঘণ্টা আগত** শেষবাৰ আপডে’ট হৈছিল * সক্ৰিয় ইনষ্টলেশ্যন **10টাতকৈ কম** * WordPress-ৰ সংস্কৰণ ** 6.0 বা তাতকৈ ওপৰৰ ** * ইমানলৈকে পৰীক্ষা কৰা হৈছে **7.1.1** * PHP-ৰ সংস্কৰণ ** 8.0 বা তাতকৈ ওপৰৰ ** * ভাষা * [English (US)](https://wordpress.org/plugins/synth-antispam/) * [antispam](https://as.wordpress.org/plugins/tags/antispam/)[comments](https://as.wordpress.org/plugins/tags/comments/) [moderation](https://as.wordpress.org/plugins/tags/moderation/)[spam](https://as.wordpress.org/plugins/tags/spam/) * টেগবোৰ * [উচ্চখাপৰ ভিউ](https://as.wordpress.org/plugins/synth-antispam/advanced/) ## ৰে’টিংবোৰ এতিয়ালৈ কোনো পৰ্য্যালোচনা দাখিল কৰা হোৱা নাই। [Your review](https://wordpress.org/support/plugin/synth-antispam/reviews/#new-post) [সকলো পৰ্য্যালোচনা চাওক](https://wordpress.org/support/plugin/synth-antispam/reviews/) ## অৱদানকাৰীসকল * [ Synth AI ](https://profiles.wordpress.org/synthplatform/) ## সাহায্য কিবা ক’বলগীয়া আছে? সহায় লাগে? [সাহায্যৰ ফ’ৰাম চাওক](https://wordpress.org/support/plugin/synth-antispam/)