Breakwater

By Anchor Hosting. Spam protection for WordPress comments, registrations and contact forms. No API keys, no accounts, no setup: activate it and every supported form is covered.

Requires PHP 8.1+ (on older PHP it shows an admin notice and stays off) and WordPress 6.0+.

What it checks

Each submission is scored. At 5 points it is spam (breakwater_threshold).

Fleet list. A host can store a list of hashes its other sites have seen (breakwater_reputation, via Breakwater\Reputation::store() or wp breakwater reputation --import=<file>); Breakwater scores against it and ignores it once it is 7 days old. On Anchor Hosting, CaptainCore builds it from every site's verdicts and pushes it during the daily sync. Only one-way hashes travel; a "Not spam" on any site takes a sender off the list. Without a list, the fleet signals simply never fire.

The proof of work is stateless and cache-safe: the page carries only the endpoint URL, the browser fetches a signed challenge from /wp-json/breakwater/v1/challenge when someone first touches a field, and each solution is accepted once. The signing key is derived from the site's own salts, so every site has its own and nothing is shared.

The proof travels in hidden fields added to the form and, as a fallback, in two first-party cookies (bw_token, bw_meta; SameSite=Lax, 12 hours). The cookies matter for form plugins that post their own payload instead of the form's inputs (Ninja Forms, Constant Contact, MailPoet).

Logged-in users who can edit posts or moderate comments are never checked (breakwater_skip).

When it gets one wrong

Nothing is ever lost on CleanTalk-style servers: every held submission stays on the site.

• Daily digest. Submissions that were stopped go out once a day to whoever receives that form's notifications (Gravity Forms notifications, CF7's mail recipient, WPForms notifications; the site admin otherwise), each with a Deliver link. The link opens a confirmation page whose button sends it on, so mail scanners that open links cannot deliver anything. Obvious bots (honeypot filled, no browser, forged proof of work, automated browser, script injection) are counted but not listed. Turn it off with define( 'BREAKWATER_DIGEST', false ); or the breakwater_digest_enabled filter; wp breakwater digest [--dry-run] sends it now.
• "Not spam" counts, wherever it is clicked: the Breakwater log, a Deliver link, Gravity Forms' Not Spam, or approving a spam comment. The sender is trusted on that site for a year (a -10 signal, so a bot borrowing the address still trips the honeypot or browser checks), a Gravity Forms entry or comment is taken out of Spam, and the correction is reported to the fleet so the sender leaves the shared reputation list.
• Retrying is safe. A person sending the same message again after being refused is not counted against: their own earlier attempt never feeds the repeat or busy-IP signals.

Integrations

wp breakwater integrations wp breakwater digest [--dry-run] lists them and which ones are on the site. Adapters live in src/Adapters/, one class each, extending Adapter and listed in Registry (filter: breakwater_adapters).

Every spam submission keeps its full payload in the Breakwater log (Tools → Breakwater) for 30 days. Forms without a spam folder get an "Email to admin" action, so a false positive is never lost. Passwords and card fields are redacted before anything is stored.

Modes

• Automatic (default): monitor while CleanTalk is active, protect otherwise.
• Protect: act on spam.
• Monitor: check and log everything, stop nothing. Verdicts from CleanTalk or Akismet are logged next to ours for comparison.
• Off

Pin a mode fleet-wide with define( 'BREAKWATER_MODE', 'monitor' );.

Single-file mu-plugin

For hosts deploying across many sites, Breakwater builds into one self-contained file: every class in bracketed namespace blocks, with the script, admin stylesheet, mark and disposable-domain list embedded (src/Assets.php serves them from the bundle instead of from files).

php bin/build-mu-plugin.php                       # → dist/breakwater.php
php bin/mu-deploy-script.php --mode=monitor       # → dist/deploy-mu.sh (embeds the build)
php bin/mu-deploy-script.php --remove             # → dist/remove-mu.sh

deploy-mu.sh runs in a site's web root (for example captaincore ssh <sites> --script=dist/deploy-mu.sh --parallel=20 --label). Per site it:

• skips anything that isn't WordPress, runs PHP older than 8.1 (the file would not parse), or has the regular plugin active;
• writes mu-plugins/breakwater.php atomically after checking its sha256;
• sets the mode given with --mode only on sites that have never had one (--force-mode sets it everywhere);
• loads WordPress to confirm Breakwater boots, and removes the file again if it doesn't;
• prints one line: BREAKWATER|<home>|installed|<version> <mode> (or skip / failed with the reason).

remove-mu.sh takes the file out and keeps the site's settings and log. When both the mu-plugin and the regular plugin are present, the mu-plugin loads first and the plugin stands aside.

WP-CLI

wp breakwater status [--days=30] [--format=json]
wp breakwater integrations
wp breakwater log [--verdict=spam] [--source=gravityforms] [--limit=20] [--format=json]
wp breakwater check --content="..." --email=... [--name=...]

Tests

# The original eight forms (Gravity Forms, CF7 + Flamingo, WPForms, Elementor Pro, comments, registration, WooCommerce)
PLAYWRIGHT=/path/to/node_modules/playwright node tests/browser.mjs https://protect.localhost
python3 -I tests/nojs.py https://protect.localhost

# Any page with a form: fills fields by type, skips honeypots a person can't see
WP_PATH=/site/public node tests/forms.mjs https://site.localhost /page-a/ /page-b/

# Kadence Advanced Form through its AJAX handler
WP_PATH=/site/public FORM_ID=44 node tests/kadence.mjs https://site.localhost

tests/setup/forms-site.php builds a form for each free plugin (Jetpack in offline mode, Ninja, Fluent, MC4WP, Formidable, Forminator, MailPoet, Constant Contact, Kadence, Ultimate Member) on a sandbox site: wp eval-file tests/setup/forms-site.php. The sandbox also needs MailPoet's per-IP throttle off (mailpoet_subscription_limit_enabled), since every test persona shares one IP. Divi and Avada are tested on their own sites with a contact form module / a fusion_form set to AJAX.

tests/backtest/ replays the fleet's labelled submissions through the checker (see its README).