Install
This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.
Install straight from GitHub with WP-CLI:
wp plugin install https://github.com/the-sohan/directorist-contact-form-guard/archive/refs/heads/main.zipAn installable WordPress plugin that protects Directorist Contact Owner requests while leaving Directorist core unchanged.
What it does
- Keeps Contact Owner available to visitors who are not logged in.
- Rejects AJAX and REST requests unless the target is a published Directorist listing with an existing owner.
- Enforces the owner's Hide contact form setting on both request paths.
- Checks required contact fields before a request reaches the email handler.
- Limits requests to 10 per client IP and 50 per listing in each UTC hour, shared by AJAX and REST. Counters use hashed IPs and are deleted by a daily cleanup task.
- Honors disabled owner contact notifications on the REST path.
Install
Upload the release ZIP in Plugins → Add New → Upload Plugin, then activate it while Directorist is active. You can also clone this repository into wp-content/plugins/directorist-contact-form-guard and activate it there.
Directorist Google reCAPTCHA can continue protecting the AJAX contact form. The REST route does not display or validate a reCAPTCHA challenge; its independent spam control here is the request limit.
Verification
WP-CLI smoke tests are in tests/rest-contact.php and tests/ajax-contact.php. They intercept all outgoing email, create temporary fixtures, and clean them up after each run. Tested locally with Directorist 8.10.4; verify on staging before use with other versions.