WE Spamfighterin

Contributors: webentwicklerin
Tags: spam, contact-form-7, comments, ai, openai, spam-protection, security, form-protection
Requires at least: 6.0
Tested up to: 6.9
Requires PHP: 8.0
Stable tag: 1.5.3
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Advanced spam protection for WordPress using AI-powered and heuristic detection.

Description

Protects Contact Form 7 forms and WordPress comments from spam submissions with intelligent analysis. Works with or without OpenAI - includes local heuristic detection for cost-effective spam filtering.

Features

🤖 Multi-Layer Spam Detection

• Heuristic Detection (Local, Free): Advanced local spam detection without external APIs
  • Link analysis (URL shorteners, suspicious domains, excessive links)
  • Character pattern detection (repeated characters, ALL CAPS, mixed case spam)
  • Known spam phrase detection (multi-language)
  • Email pattern analysis (suspicious providers, random patterns)
  • Referrer analysis (missing referrer, suspicious referrer domains, URL shorteners)
  • User agent analysis (bot detection, missing user agent, suspicious patterns)
  • Content length analysis (very short or extremely long content detection)
  • Mixed script detection (different character sets like Cyrillic + Latin)
  • Unicode anomalies (zero-width characters, control characters, homoglyphs)
  • Numbers/letters only detection (content containing only numbers or letters)
  • IP address in content (IP addresses found in text, not URLs)
• Language Detection (Local, Free): Automatically detects and flags submissions in different languages
  • Works without OpenAI using heuristic language detection
  • Can use OpenAI's language detection when available
  • Configurable score boost for language mismatches
• AI-Powered Detection (Optional): OpenAI integration for advanced analysis
  • Uses GPT-4o-mini (or other OpenAI models) to analyze form submissions and comments
  • Detects spam patterns, AI-generated content, SEO spam, and suspicious links
  • Only called when needed (cost-efficient: local checks run first)
• Smart Detection Order: Heuristic → Language → OpenAI (saves API costs)
  • Local checks run first (instant, free)
  • OpenAI only called for uncertain cases
  • Plugin works completely without OpenAI
• Configurable Thresholds: Adjustable spam score thresholds for each detection method

📋 Form Integration

• Contact Form 7: Full integration with Contact Form 7 plugin
  • Submission Logging: Unlike CF7 (which doesn't store submissions by default), this plugin logs all CF7 form submissions for review and analysis
  • Spam Protection: Blocks spam submissions before they reach your inbox
• WordPress Comments: Native WordPress comment spam protection
• Automatic Blocking: Blocks spam submissions before they reach your inbox
• Custom Messages: Configurable "Thank you" message for blocked spam submissions (default: "Thank you for your message.")

📊 Dashboard & Analytics

• Submission Log: View all Contact Form 7 submissions (comments are managed by WordPress)
  • Unique Feature: CF7 doesn't store submissions by default - this plugin adds submission logging as a bonus feature
• Spam Analytics: Track spam detection statistics for CF7 forms
• Comment Spam Stats: View spam comment count from WordPress (with link to comment management)
• Filtering: Filter submissions by spam status (via tabs)
• Submission Details: View full submission data, spam scores, and detection reasoning
• Activity Log (Optional): Track important plugin events and operations
  • View recent activities (weekly summaries, table maintenance, email notifications, etc.)
  • Automatic cleanup (max 100 entries, respects log retention days)
  • Manual clear option
  • Only shows when enabled in settings
  • Email notification tracking (daily/weekly summary emails sent/failed)

🎨 User Experience

• Smart Form Disabling: Automatically disables form fields after submission (success, failure, or spam)
• Visual Feedback: Clear visual distinction between active and disabled form fields
• Accessibility: Maintains screen reader compatibility and ARIA attributes
• Performance Optimized: Minified CSS/JS in production, inline CSS for faster loading

🔒 Security & Privacy

• Database Storage: All submissions are logged in secure database tables
• IP Tracking: Optional IP address and user agent logging
• Multi-site Support: Full WordPress multisite compatibility
• Secure API Keys: API keys can be stored in wp-config.php for better security
• GDPR/Privacy (OpenAI only): When OpenAI is active, personal data is sent to OpenAI (USA)
  • Configurable privacy passage on the privacy policy page (filter, manual shortcode/block, or none)
  • Optional form notice at comment and CF7 forms
  • Suggested text for the Privacy Policy Guide (Settings → Privacy)
  • Shortcode [we_spamfighter_privacy] for manual placement

⚡ Performance

• Caching: Intelligent caching of database queries
• Optimized Assets: Minified CSS/JS in production environments
• Non-blocking Scripts: JavaScript loads in footer for better page performance
• Efficient Database Queries: Optimized queries with proper indexing

Requirements

• WordPress: 6.0 or higher
• PHP: 8.0 or higher
• OpenAI API Key: Optional - enables AI-powered detection. Plugin works fully with local heuristic detection only.
• Contact Form 7: Optional, for form protection (version 6.0+ recommended)

Installation

Via WordPress Admin

1. Download the plugin ZIP file
2. Go to Plugins → Add New → Upload Plugin
3. Upload the ZIP file
4. Click Activate Plugin

Via FTP/File Manager

1. Upload the we-spamfighter folder to /wp-content/plugins/
2. Go to Plugins in WordPress admin
3. Find WE Spamfighterin and click Activate

Via Composer

composer require gbyat/we-spamfighter

Configuration

1. OpenAI API Key Setup

Option 1: Via WordPress Settings (Recommended for testing)

1. Go to WE Spamfighterin → Settings
2. Enter your OpenAI API key in the OpenAI API Key field
3. Click Save Changes

Option 2: Via wp-config.php (Recommended for production) Add this line to your wp-config.php file:

define('WE_SPAMFIGHTER_OPENAI_KEY', 'your-api-key-here');

This method is more secure as the API key is not stored in the database.

2. Plugin Settings

Navigate to WE Spamfighterin → Settings (organized in tabs) to configure:

General Tab

• Enable Contact Form 7 Protection: Toggle CF7 spam detection
• Enable Comments Protection: Toggle comment spam detection
• Auto-Mark Pingbacks/Trackbacks: Automatically mark pingbacks/trackbacks as spam
• Mark Different Language as Spam: Automatically flag submissions in different languages
• Language Mismatch Score Boost: Amount to increase spam score when language doesn't match (0.1 - 1.0, default: 0.3)
• Spam Blocked Message: Custom message displayed to users when spam is detected (default: "Thank you for your message.")

Heuristic Detection Tab

• Enable Heuristic Detection: Use local spam detection (works without OpenAI)
• Heuristic Spam Threshold: Threshold for heuristic detection (0.0 - 1.0, default: 0.6)
• Enable Link Check: Enable suspicious link detection (enabled by default when heuristic detection is active)
• Enable Character Pattern Check: Enable character pattern detection (enabled by default when heuristic detection is active)
• Enable Spam Phrase Check: Enable known spam phrase detection (enabled by default when heuristic detection is active)
• Enable Email Pattern Check: Enable email pattern detection (enabled by default when heuristic detection is active)
• Enable Referrer Check: Enable referrer analysis (missing or suspicious referrer detection, enabled by default when heuristic detection is active)
• Enable User Agent Check: Enable user agent analysis (bot and suspicious user agent detection, enabled by default when heuristic detection is active)
• Enable Content Length Check: Enable content length analysis (very short or extremely long content, enabled by default when heuristic detection is active)
• Enable Mixed Script Check: Enable mixed script detection (different character sets like Cyrillic + Latin, enabled by default when heuristic detection is active)
• Enable Unicode Anomalies Check: Enable Unicode anomalies detection (zero-width characters, control characters, homoglyphs, enabled by default when heuristic detection is active)
• Enable Numbers/Letters Only Check: Enable detection of content containing only numbers or only letters (enabled by default when heuristic detection is active)
• Enable IP Address in Content Check: Enable detection of IP addresses in content (not in URLs, enabled by default when heuristic detection is active)

Note: When you enable Heuristic Detection, all individual checks are automatically activated by default. You can disable specific checks if needed. When Heuristic Detection is disabled, all checks are automatically deactivated as well.

OpenAI Tab

• Enable OpenAI Detection: Enable/disable AI-powered spam detection (optional)
• OpenAI API Key: Enter your OpenAI API key
• OpenAI Model: Choose the OpenAI model (default: gpt-4o-mini)
• AI Spam Threshold: Adjust spam score threshold (0.0 - 1.0, default: 0.7). Higher values mean fewer submissions are flagged as spam (less strict). Lower values mean more submissions are flagged as spam (more strict).

Notifications Tab

• Notification Email: Email address for spam notifications
• Notification Type: Choose frequency (none, immediate, daily, weekly)

Privacy Tab (GDPR/DSGVO)

These options only take effect when OpenAI is enabled and an API key is configured.

• Privacy passage on privacy policy page: How to include the privacy passage
  • Filter: Append automatically to the configured privacy policy page (default)
  • Manual: Use shortcode [we_spamfighter_privacy] or block for manual placement
  • None: Do not add (at your own risk)
• Form notice: Show a notice at comment and CF7 forms when OpenAI is active (default: enabled)

The plugin provides suggested privacy policy text under Settings → Privacy in WordPress admin. The passage explains that form data may be transmitted to OpenAI (USA) for spam checking, based on legitimate interest (Art. 6(1)(f) GDPR) and Standard Contractual Clauses.

Maintenance Tab

• Log Retention: Days to keep logs (default: 30)
• Keep Data on Uninstall: Option to preserve data when uninstalling
• Enable Activity Log: Optional activity logging to track important plugin events (e.g., weekly summaries sent, table maintenance). When enabled, adds an "Activity Log" menu item under WE Spamfighterin for viewing events and provides a clear button in the Maintenance tab.
• Enable GitHub Updates: Optional automatic updates from GitHub releases. ⚠️ Activate at your own risk - Updates will be installed automatically without additional confirmation. Disabled by default for security.

3. Contact Form 7 Integration

The plugin automatically integrates with Contact Form 7 when:

• Contact Form 7 is installed and active
• Contact Form 7 protection is enabled in settings

No additional configuration is required for basic functionality.

Important Note: Contact Form 7 does not store form submissions by default. This plugin adds this functionality as a bonus feature - all CF7 form submissions (spam and legitimate) are logged in the plugin's database for review, analysis, and spam detection tracking.

4. Comments Integration

WordPress comment spam protection works when:

• Comments protection is enabled in settings
• Heuristic detection and/or OpenAI detection is enabled

Important: Comments are NOT saved in the plugin's database. They are handled by WordPress's native comment system:

• Spam comments are marked as spam and stored in WordPress
• You can manage spam comments in Comments → Spam in WordPress admin
• The plugin dashboard shows the spam comment count with a link to WordPress comment management
• Only Contact Form 7 submissions are stored in the plugin's database
• Detection works with or without OpenAI (local heuristic detection is available)

Usage

Viewing Submissions

1. Go to WE Spamfighterin → Dashboard
2. View all Contact Form 7 submissions in the main table (comments are managed by WordPress)
   • Note: CF7 doesn't store submissions by default - this plugin logs them for you
3. Use tabs to filter submissions by spam status (Normal Mails / Spam)
4. Click on a submission to view detailed information
5. View spam comment count in statistics (with link to WordPress comment management)

Managing Spam

Contact Form 7 Submissions

• Mark as Spam: Manually mark a CF7 submission as spam
• Mark as Not Spam: Mark a false positive as legitimate
• Delete Submissions: Remove unwanted submissions from the database

WordPress Comments

• Manage in WordPress: Spam comments are managed in Comments → Spam in WordPress admin
• Spam Count: View spam comment count in the plugin dashboard statistics
• Direct Link: Click on spam comment count to go to WordPress comment management