Need Honest Opnions on A plugin i wrote Spamify

Muhammad Arslan Yousaf — Thu, 29 Oct 2026 10:57:19 +0000

What is Spamify?

Spamify is a lightweight, self-contained email spam and validation plugin for WordPress forms. It scores every submitted email address and blocks or flags the ones that look fake, invalid, or abusive — without sending your visitors' data to any tracking service.

It never sends your data to the plugin author or to any analytics or tracking service, and it does not require an account or a licence key. One optional feature — live mailbox verification — reaches out to the recipient's own mail server. It is on by default, and you can turn it off under Settings → Advanced Filters.

Get Spamify on WordPress.org

Detection layers

Syntax – Validates the email format and catches gibberish, keyboard-mash, and obviously fake addresses. Runs locally, always on.
SMTP mailbox verification (on by default) – Connects to the recipient domain's mail server and asks whether the mailbox exists. No message is ever sent.
Behavior & bot signals – Scores mouse, scroll, keyboard and focus activity, a headless-browser (automation) check, keystroke rhythm, and a JavaScript challenge — all collected locally from the page the visitor already loaded, with no network calls or third-party service involved.

Bot protection & security (all local, all free)

Honeypot & timing – Hidden decoy fields plus a minimum form-fill time catch automated submissions.
Rate limiting – Throttle how many submissions a single IP can make within a rolling window.
CAPTCHA (optional) – Invisible Cloudflare Turnstile or Google reCAPTCHA v3, using your own free provider keys.
Allowlist – Always let trusted domains, exact email addresses, or IP / CIDR ranges through.
Hide login (optional) – Move wp-login.php to an address of your choice and serve a 404 (or a redirect) at the old one and at /wp-admin/, so brute-force bots have nothing to hammer. (WordPress normally bounces logged-out visitors from /wp-admin/ to the login screen, which would give the secret address away.) Every login, logout, lost-password and registration link — including the ones inside WordPress emails — is rewritten for you.
- Multisite compatible: each site in a network keeps its own address, subdirectory installs get the slug under their own folder, and a single constant in wp-config.php can enforce one address network-wide:

define( 'SPAMIFY_HIDE_LOGIN_SLUG', 'my-secret-login' );

Privacy & administration

GDPR tools – Automatic daily log purge by retention window, plus optional IP anonymisation.
Site Health – Built-in WordPress Site Health checks for logging, DNS, and mailbox verification.
Setup wizard – A guided first-run wizard to get protected in about a minute.
Dashboard & logs – See what was blocked, flagged, and allowed, with per-day charts, plus a WP Dashboard widget showing today's and this week's figures at a glance.
Review Queue – Every currently-flagged submission — comments, registrations, profile changes, and every connected form — in one screen, instead of scattered across the native Comments/Users screens.
Timeline – Look up one email address or IP and see its full chronological history across every zone, with the evidence behind every hit.
Digest reports – A daily, weekly, or monthly summary email, optionally with a CSV report (totals, source breakdown, top offending domains) attached.

Supported forms

WordPress core (registration, comments, profile update, lost password, multisite signup)
Contact Form 7
WPForms
Jetpack Forms
Elementor Forms

Upgrade to Pro

Spamify is free forever on WordPress.org — everything described above runs standalone, with no account, licence key, or nag screens required.

Spamify Pro adds the rest of the detection engine and site-wide protection tools for busier or higher-traffic sites:

Disposable domain blocking – 100,000+ throwaway and temporary-inbox providers, refreshed automatically.
IP threat intel & DNSBL – Matches the sender's IP against aggregated abuse feeds and DNS blocklists.
VPN / proxy / Tor detection – Flags anonymised traffic from VPNs, open proxies, Tor exit nodes and datacenter ranges.
Content analysis – Link stuffing, spam keywords, homoglyph and Unicode obfuscation.
Behavioural reputation – Per-sender history layered on top of honeypot and timing.
Custom rules – Your own if-this-then-that logic on any field or signal.
Network firewall – VPN/Tor/ASN blocking with escalating temporary bans.
Geo report & country blocking – A world map of where blocked spam comes from, powered by a free offline database.
Uptime monitor & deliverability tools – Scheduled URL checks, bulk email-list verification, and an SPF/DKIM/DMARC checker.
More integrations – WooCommerce, Gravity Forms, Ninja Forms, Fluent Forms, newsletter opt-ins, and a universal connector for any form.

I'd love your honest feedback. What would make you install (or not install) a plugin like this? Drop a comment below.

wordpress.org