AntiSpam Wizard
A free WordPress plugin that stops spam in your comments and Contact Form 7 submissions.
It runs entirely on your own server: no external services, no accounts, no API keys, nothing leaves your site. Ten configurable checks, from a simple honeypot to a Naive Bayes classifier, catch bots and spammers before they reach your moderation queue.
Free software, GPL-2.0-or-later. Requires WordPress 6.4 or newer and PHP 8.1 or newer.
Why AntiSpam Wizard
Offline-first
All detection runs on your server. There are no external API calls, no accounts and no API keys, so the plugin keeps working offline and adds no third-party dependency to your privacy policy.
Privacy by design
When something is flagged, the plugin stores a short text fragment, a SHA-256 hash of the IP address and, for Contact Form 7, a salted SHA-256 hash of the email. Raw IPs and emails are never stored. Everything is exportable and erasable with the built-in WordPress Privacy tools and removed completely on uninstall.
Works without JavaScript
Every check, including the bot checks, works with JavaScript disabled. The bot checks fail open: a cached page or a stripped form field can never cause a legitimate visitor to be flagged.
10 checks, each one configurable
Checks run in order and stop at the first hit. The two bot checks go first so most automated spam never reaches the heavier analysis. Every check can be switched off and tuned from the admin panel.
Honeypot
A hidden field real visitors never see; bots that fill it are caught immediately.
Submit time
A signed timestamp in the form; submissions that arrive impossibly fast are spam.
Stop words
Your own blocklist with exact and substring matching, import and export included.
Links
More URLs than you allow is a classic spam signature.
Emoji
Emoji abuse beyond a configurable count.
Spacing
Unusual whitespace patterns used to evade filters.
Multi-language
Suspicious mixing of writing systems in a single comment.
Duplicate
The same text posted repeatedly from the same source within a time window.
Naive Bayes
A text classifier trained on a bundled corpus covering 10 writing systems, and on the samples you mark as spam or ham.
Cosine similarity
Compares each comment against known spam samples with an adjustable threshold.
How it works
1. A submission arrives
A comment goes through WordPress’s own approval filter; a Contact Form 7 submission goes through CF7’s spam filter. On regular page views the plugin only renders two hidden form fields and one small stylesheet.
2. Checks run in order
Each enabled check inspects the submission and the pipeline stops at the first spam verdict. A typical comment takes well under a millisecond once the classifier cache is warm.
3. Spam is logged, you stay in control
Flagged comments land in the spam queue with the reason recorded. From the Spam Log you can mark entries as spam or ham, and the classifier retrains on your samples automatically.
Contact Form 7, covered
When the Contact Form 7 plugin is active, all enabled checks also run on form submissions, including the honeypot and submit-time bot checks. Flagged submissions are blocked through CF7’s native spam handling and logged with a form marker. One toggle, no other configuration.
Speaks your language
The admin interface ships in English plus nine translations: Spanish, German, French, Brazilian Portuguese, Italian, Japanese, Russian, Dutch and Turkish. Detection itself covers 10 writing systems out of the box, so non-English sites are protected from day one.
Requirements and licence
WordPress 6.4 or newer, PHP 8.1 or newer. Tested up to WordPress 7.1. Licensed under GPL-2.0-or-later.
Free and Pro Cloud
AntiSpam Wizard is free and stays free. Pro Cloud is an optional paid subscription we are building on top of it: you turn it on with a key in the plugin settings, and nothing leaves your site unless you do.
Free
Available now
- Ten configurable checks, from a honeypot to a Naive Bayes classifier
- Contact Form 7 submissions protected with the same checks
- Runs entirely on your own server, no external API
- Learns from your own spam and ham samples
- WordPress Privacy API support: export and erase per person
- Nine translations shipped
- GPL-2.0-or-later, free forever
Pro Cloud
In development
Planned price: $10 / €10 per site per month. Final pricing is set at launch.
AI second opinion
Comments and form submissions the local checks cannot decide are sent to a cloud model with the page context; it can also veto a local block to cut false positives. Works for languages the local corpus does not cover.
Sender and link reputation
The SHA-256 hashes the plugin already computes for IPs and emails, plus the domains of any links, are checked against aggregated reputation sources. Raw addresses never leave your site.
More forms and WooCommerce
WPForms, Gravity Forms, Fluent Forms, Ninja Forms, Formidable and Elementor forms; WooCommerce reviews and registrations; user registrations, bbPress and BuddyPress.
Retro-scan
Run the moderation queue and old comments through every check, review the report, delete in bulk.
Get notified when Pro Cloud launches
One email when Pro Cloud is ready, nothing else. Confirm your address by clicking the link we send you.
This form is protected by AntiSpam Wizard. We store your address only to send that one email; the link in the email removes it, and unconfirmed sign-ups are deleted after 7 days.
Frequently asked questions
Does the plugin send my data to external servers?
No. All spam detection runs entirely on your own server. There are no external API calls, no accounts, no API keys, and nothing leaves your site. This also means the plugin keeps working offline and adds no third-party dependency to your privacy policy.
What personal data does it store?
When a submission is flagged as spam, the plugin stores a short text fragment, a SHA-256 hash of the IP address, and, for Contact Form 7 submissions, a salted SHA-256 hash of the email address. Raw IPs and emails are never stored. All of it is exportable and erasable via the built-in WordPress Privacy tools, and removed completely on uninstall.
Does it work with contact forms?
Yes, with Contact Form 7. When CF7 is active, all enabled checks run on form submissions and flagged ones are blocked through CF7’s native spam handling. No configuration is needed beyond a single toggle; without CF7 the plugin simply protects comments as usual.
Does it require JavaScript?
No. All checks, including the bot checks, work with JavaScript disabled, and the bot checks are designed to fail open: a cached page or a stripped form field can never cause a legitimate visitor to be flagged.
Will it slow down my site?
No. On regular page views the plugin only renders two hidden form fields and enqueues one small stylesheet; no detection runs. The full check pipeline runs only when a comment or form is actually submitted, and takes well under a millisecond on a typical comment once the classifier cache is warm. Because everything runs locally, there is no blocking round-trip to an external API on every comment.
Can it learn from my site’s spam?
Yes. You can mark comments as spam or ham from the Spam Log, and the Bayesian classifier retrains on your samples automatically. The bundled seed corpus covers 10 writing systems (Latin, Cyrillic, CJK, Arabic, and more), so detection works for non-English sites out of the box.
Does it block all spam?
No. No spam filter catches everything, and no filter is free of false positives. AntiSpam Wizard is provided as is, without warranty of any kind, under the GPL-2.0-or-later licence. Use it at your own risk, and keep an eye on the Spam Log and the moderation queue.
See it in action
This site runs AntiSpam Wizard. Leave a comment on the 1.0.0 announcement and it goes through the same 10 checks you get on your own site.