AccessNow Spam Eater is a free WordPress plugin that stops contact form spam without a CAPTCHA: no puzzles for your visitors, no account, and nothing sent to an outside service. Version 2.4 is the biggest update yet. It protects the WooCommerce Checkout block against card-testing bots, covers twelve more form plugins, and lets you add rules of your own, all still checked on your own site.
Download 2.4 from the AccessNow Spam Eater page. It is on its way to the WordPress.org plugin directory; until it is listed there, that page is the place to get it.
First, a fix: contact forms that were refused
My brother told me Spam Eater wasn’t stopping the spam on his contact form. The real problem was worse. Clean and Simple Contact Form passes every message through WordPress’s comment spam filter so it can use Akismet, and Spam Eater’s comment check treated those messages as comments with missing fields. With Comment Forms switched on, every message was refused, real ones included. wpDiscuz comments had the same problem.
Spam Eater now only checks real comments and reviews there, and protects Clean and Simple Contact Form and wpDiscuz properly, each with its own setting. If you use either one, please update.
WooCommerce: the Checkout block and card-testing bots
New shops use WooCommerce’s Checkout block, and card-testing bots don’t even load it: they post orders straight to WooCommerce’s Store API to try stolen card numbers. Spam Eater now checks those orders too, while Apple Pay, Google Pay and other express payment buttons keep working. It also protects the Pay for Order form and the account details form in My Account.
Twelve more form plugins
Spam Eater now protects Jetpack Forms, Kadence Forms, WS Form, JetFormBuilder, SureForms, Everest Forms, MailPoet, Brevo, wpDiscuz, MemberPress, Paid Memberships Pro and GiveWP, which makes 34 form, shop and membership plugins in all. WS Form, Everest Forms, JetFormBuilder and MailPoet were taken out in 2.2 because Spam Eater couldn’t check them properly. Each one is now checked where the plugin checks its own submissions.
Your own rules, kept on your own site
- Words and patterns to block. Some spam is typed by people, and no bot check stops that. List the words, links or patterns that give it away. What people type is checked as it arrives and never stored or logged.
- Throwaway email addresses. Turn away sign-ups and messages from about 9,000 disposable email services. The list comes with the plugin, so no address is ever looked up online. It is off until you turn it on.
- Always allow, always block. Let your office through every check, or refuse an address or range you name. Like automatic blocks, a blocked address can still log in, so nobody can lock you out of your own site.
Your own words, patterns and throwaway email addresses has the details.
Slow down password guessing
Bots that guess passwords try the same username over and over. Switch on Slow down password guessing and, after five failed logins in a row for one username from one address, that pair has to wait 30 seconds, then longer each time, up to 15 minutes. A successful login clears it, and nobody else is affected. Slowing down password guessing.
See it working
- A spam summary on the Dashboard, with the last 30 days of refused spam, and an optional weekly email. Only daily counts are kept.
- Test this form as a bot. Administrators see a button under each protected form that sends it the way a simple bot would and tells you whether Spam Eater refused it. Nothing is sent and nothing is counted.
- WP-CLI commands for statistics, blocked addresses, settings and your IP lists, for anyone looking after many sites.
Get it
AccessNow Spam Eater is free, with no cookies, no tracking and no calls to outside services. Download it from the AccessNow Spam Eater page, where you can also see how it compares with Akismet, CleanTalk and other anti-spam plugins. New to it? Start with Getting started: choose which forms to protect, or, for a shop, WooCommerce: checkout, express payments and password resets.
