Stops spam before it reaches form handlers or email. Every triggered email (admin notice and autoresponder) is suppressed.
WordPress Plugin by Monday Digital
Stop contact form spam before it reaches your inbox.
MDL Spam Filter blocks spam contact-form submissions server-side — before any form handler, email, or third-party log ever sees them.
Keyword filtering, honeypot, rate limiting, a language guard, and optional AI detection. No CAPTCHA, no visitor friction.
Available Now
Free Forever
No API Required
Server-Side Blocking
AI-Optional (BYOK)
GPL-2.0+
WordPress
6.2+
PHP
7.4+
Tested up to
WordPress 7.0.2
Contact Form 7
Optional
WPForms
Optional
Gravity Forms
Optional
- Detection approach
- Keywords + optional AI
- Blocking layer
- Server-side, before any handler
- Form integrations
- CF7, WPForms, Gravity, Ninja, Elementor, HTML
Quick Start
Protecting your forms in under five minutes
Install and activate the plugin, then open the MDL Spam Filter menu → Settings. Choose a detection mode — Keywords, AI, or both. For AI detection, pick a provider (Anthropic, OpenAI, or custom) and enter your API key. Optionally, under Form targeting, limit scanning to specific forms by id, class, or name.
- Install and activate the plugin, then open the MDL Spam Filter menu.
- Under Settings → Protection, confirm protection is on and choose what blocked senders see (silent discard or a blocked message).
- Pick a detection mode — Keywords, AI, or both.
- If using AI, enter your provider API key under Settings → AI engine (or define it in
wp-config.php). - Set a central notification address under Settings → Notifications and send a test email.
- Optionally scope scanning to specific forms under Form targeting.
Overview
Why this plugin exists
Contact-form spam wastes time, pollutes form-plugin entries, and floods inboxes and email logs. Most tools add a CAPTCHA that punishes real visitors, or filter after the submission is already stored and emailed.
MDL Spam Filter scans front-end submissions on the server before any form handler runs — when a submission is spam, no email is sent (including the admin "new submission" notification and any autoresponder) and nothing is written to your form plugin's entries or email log. You choose whether blocked submissions are recorded in the plugin's own private log.
Works across your entire WordPress form stack
- Form-agnostic — inspects any POST carrying an email, or recognisably from a supported form plugin, with no per-plugin setup
- Contact Form 7, WPForms, Gravity Forms, Ninja Forms, Elementor forms, and plain HTML forms
- AJAX and REST submissions get a proper response, so the submit spinner never hangs
Core Features
Why teams choose this for production WordPress sites
200+ built-in keywords in collapsible categories (pharma, SEO outreach, scams, gambling, and more), each toggleable, plus unlimited custom keywords and regex patterns with per-keyword hit counters.
Anthropic, OpenAI, or a custom OpenAI-compatible provider (bring your own key); verdicts constrained to a strict yes/no with structured JSON where supported.
Keep built-in rules, write your own plain-language rules, or combine both. A "Generate rules with AI" assistant drafts rules from a description of your business.
When the AI provider is unreachable, fall back to a keyword scan so an outage never silently lets spam through.
Honeypot field and minimum-submit-time check. Zero cost, and fail open for no-JS and cached visitors.
Optional per-visitor submission cap that throttles floods before any AI call is ever made.
Block chosen languages/alphabets or allow only chosen ones, plus an always-on trap for Latin/Cyrillic look-alike tricks (e.g. "vіаgra"). Accented Latin languages are never affected.
By email address, domain, or IP, with one-click Block/Allow sender on Filter Log and Review rows.
Hold keyword/AI-flagged submissions before anything is stored or emailed. View, Accept (email to admin), or Block, plus turn a phrase into a keyword.
7/30/90-day period picker, daily chart, trend deltas, method breakdown, top senders/pages, drill-through to a pre-filtered log, system-health card, setup checklist, and CSV export.
One central address with per-alert overrides and multi-recipient pickers, a send-test button, and an optional weekly digest.
Private opt-in log in a dedicated table, submitter IP stored as a one-way hash, sensitive fields excluded, and automatic retention cleanup.
No CAPTCHA, no third-party JS/CSS/fonts. AI is entirely optional and only calls the provider you configure.
Use Cases
When this plugin makes sense
Cut foreign-language and out-of-scope spam from your contact forms without a CAPTCHA.
A consistent server-side filter across many client sites and any form plugin.
Rate limiting and bot traps absorb bursts before they cost an AI call or hit your inbox.
Sites that want LLM-grade spam classification on their own API key, with a keyword safety net when the provider is down.
Technical Specifications
Deployment-ready at a glance
| Current version | 1.0.0 |
|---|---|
| Requires WordPress | 6.2 or higher |
| Tested up to | 7.0.2 |
| Requires PHP | 7.4 or higher |
| Detection modes | Keywords, AI, or both |
| AI providers | Anthropic, OpenAI, custom OpenAI-compatible (BYOK) |
| Form integrations | Contact Form 7, WPForms, Gravity Forms, Ninja Forms, Elementor, HTML forms |
| External API calls | Only when AI detection is enabled or the rule assistant is used |
| Logging | Private plugin table, hashed IP, opt-in, auto-retention (default 90 days) |
| Blocking layer | Server-side, before any form handler runs |
| License | GPL-2.0+ |
| Author | Monday Digital Lab |
Pricing & Licensing
Free and open source from day one
MDL Spam Filter is free and open source from day one, licensed GPL-2.0+ with no premium tier and no recurring fees. AI detection is optional and uses your own provider API key — you pay only your provider, never us.
Product Screens
A visual tour of the plugin workflow
Dashboard
Setup checklist, 7/30/90-day period picker, trend deltas, blocked-submission chart, and system-health card.
Settings
WooCommerce-style sections, detection mode, and AI provider options.
Notifications
One central address, per-notification toggles and overrides with a tag-style multi-email picker and a send-test button.
Keywords
Built-in keywords grouped by category with search and per-group toggles, plus your own custom keywords.
Filter Log
Search, filters, date sorting, expandable excerpts, bulk delete, and CSV export.
Review queue
Flagged submissions held before anything is stored or emailed; accept, block, or turn a phrase into a keyword.
Changelog
Initial release highlights
- Server-side spam blocking before any form handler or email
- Keyword detection with 200+ categorised built-in keywords, custom keywords, and regex patterns
- Optional AI detection via Anthropic, OpenAI, or a custom OpenAI-compatible provider (BYOK)
- Custom AI detection rules with a "Generate rules with AI" assistant and templates
- Keyword fallback when the AI provider is unavailable
- Honeypot, minimum-submit-time, and per-visitor rate limiting
- Language guard with allow-list / block-list modes and Latin/Cyrillic look-alike trap
- Allow / deny lists by email, domain, or IP with one-click sender actions
- Review queue holding flagged submissions before storage or email
- Analytics dashboard with period picker, trends, system health, and CSV export
- Central notifications with per-alert overrides, multi-recipient pickers, and weekly digest
- Private hashed-IP logging with automatic retention cleanup and an activity audit log
- Settings and keywords import/export (API keys never exported)
Documentation Snapshot
First-run flow for site owners
- Install and activate the plugin, then open the MDL Spam Filter menu.
- Under Settings → Protection, confirm protection is on and choose what blocked senders see (silent discard or a blocked message).
- Pick a detection mode — Keywords, AI, or both.
- If using AI, enter your provider API key under Settings → AI engine (or define it in
wp-config.php). - Set a central notification address under Settings → Notifications and send a test email.
- Optionally scope scanning to specific forms under Form targeting.
Operational notes
- The plugin fails open on any AI/network error, so legitimate mail is never blocked by a provider outage — the optional keyword fallback keeps the gate closed anyway.
- Deterministic bot blocks (rate limit, deny list, honeypot, minimum submit time, language guard) are always blocked immediately and never enter the review queue.
- Sensitive fields (passwords, tokens, card numbers, CVV, account/routing numbers) are excluded from AI, scanning, and the stored log.
- Blocked submissions are stored only in the plugin's own table, only if logging is enabled, and are pruned daily past the retention period (default 90 days).
Support & Updates
Clear expectations for maintenance and help
- Updates are delivered through the normal WordPress update flow now that the plugin is live on WordPress.org.
- Support is handled through the WordPress.org support forum and Monday Digital Lab.
- Releases follow a stability-first philosophy — the free plugin ships fully featured, and core spam-blocking quality is never gated.
- Production-ready defaults: the review queue and fail-open behaviour are on by default.
Quick trust cues
No premium upsells
No external API calls
WordPress update flow
Production-ready defaults
FAQ
Common questions from plugin users
Yes — it scans any POST with an email address, or one carrying a recognised form plugin's identifier (Contact Form 7, WPForms, Gravity Forms, Ninja Forms, and similar), so it works with most form plugins and plain HTML forms with no extra setup. AJAX/REST forms get a proper response, so the spinner doesn't hang.
No. Keyword detection needs no external service. An API key is only needed if you enable AI detection.
Your choice — "silently discard" shows the form's normal success message (bots get no signal), or "show a blocked message" displays a clear flagged-as-spam notice.
In "AI only" mode the plugin falls back to a keyword scan by default, so spam isn't silently let through. In "Keywords, then AI" mode the keyword scan always runs first, so an outage never opens the gate.
Yes — built-in rules, your own plain-language rules, or both. The "Generate rules with AI" assistant drafts rules from a short description of your business.
Yes — the language guard blocks (or allows only) chosen languages/alphabets and catches Latin/Cyrillic look-alike tricks. It detects the alphabet, not the exact language; for per-language policy, use an AI custom rule.
Yes — add emails, domains, or IPs to the allow or deny list, or use the one-click Block/Allow sender action on Filter Log and Review rows.
Only when AI detection is enabled, or when an admin uses the rule assistant — see External Services. Sensitive fields (passwords, tokens, card numbers, etc.) are always excluded.
Never included in a settings export. For maximum safety, define them in wp-config.php (MDLSF_ANTHROPIC_API_KEY / MDLSF_OPENAI_API_KEY / MDLSF_CUSTOM_API_KEY); a defined constant overrides and hides the stored option.
Only in the plugin's own database table, and only if you enable logging — never in your form plugin's entries or email log. Rows older than the retention period (default 90 days) are pruned daily.
Yes — CSV export on the Filter Log, and JSON settings and keywords import/export on the Import/Export page (API keys never exported).
Related Links
Explore more in the Lab catalog
See the wider plugin directory and compare release posture, update style, and deployment fit.
Review release highlights and Lab release history in one place.
Why server-side filtering beats a plugin that calls an external API on every submission — with query counts from 12 benchmarked plugins.
The conditional asset loading work on a form-heavy store, and why CAPTCHA scripts are part of the payload problem.