Char O’Day – AntiSpam Wizard

AntiSpam Wizard is spam protection for WordPress comments and Contact Form 7 submissions that runs entirely on your own server. There is no external API, no account and no API key: nothing about your visitors leaves your site, the plugin keeps working offline, and it adds no third-party dependency to your privacy policy.

What sets it apart from the cloud-based and the rule-only antispam plugins:

• A classifier that learns from your own moderation. A Naive Bayes model and a cosine-similarity check ship with a seed corpus for ten writing systems (Latin, Cyrillic, CJK, Arabic, Devanagari, Greek, Hebrew, Thai, Bengali, Indic), so a non-English site starts with a working filter, and every Spam / Not Spam decision made anywhere in WordPress trains it further on your site’s own spam.

• A flagged comment stays visible to its author as “awaiting moderation”, and to nobody else, so a real visitor caught by mistake does not post it again.

• Privacy by construction. Raw IP addresses and emails are never stored, only salted hashes; everything the plugin keeps, including training samples, is exportable and erasable per person through the WordPress Privacy tools and removed on uninstall.

• Ten independent checks, each with its own toggle and thresholds, ordered so the cheap bot checks short-circuit first and a typical comment costs a few milliseconds.

Detection checks include:

• Honeypot field for automated bots

• Submit-time validation (too fast)

• Stop words filtering

• Excessive links detection

• Emoji abuse detection

• Unusual spacing patterns

• Multi-language mixing detection

• Duplicate comment detection

• Naive Bayes spam classification with dynamic learning

• Cosine similarity spam detection against known spam samples

• Excluded tokens management to fine-tune text analysis

• Configurable minimum message length to skip heavy checks on very short comments (10 characters by default)

• Contact Form 7 protection — when the Contact Form 7 plugin is active, all enabled checks also run on CF7 submissions via the wpcf7_spam filter; flagged submissions are blocked through CF7’s native spam handling and logged with a form marker (no new storage location)

• Learning from moderation — every Spam / Not Spam decision made anywhere in WordPress (a Comments-screen row action, a bulk action, another antispam plugin, or the plugin’s own Spam Log) trains the classifier automatically

• “Mark as spam” link under each comment on the site for administrators — remove the comment and teach the classifier in one click, from the page where you saw the spam, with no JavaScript

• Flagged comments stay visible to their author — a comment the plugin flags is shown only to the person who wrote it, marked “awaiting moderation” as WordPress does for held comments, so a visitor caught by mistake does not post it again; nobody else sees it, and “Show flagged comments to their author” on the General tab turns it off

All checks are configurable from the WordPress admin panel with collapsible inline help for each setting.

Links

• Website: https://antispamwizard.com/

• Source code and issue tracker: https://github.com/HawkeyePierce89/antispam-wizard

The seed corpus is comment spam and is expected to transfer reasonably to Contact Form 7 submissions, but this is unmeasured; a form-specific corpus is explicit future work.

Translations

AntiSpam Wizard is fully translated into the following languages:

• English (default)

• Spanish (es_ES)

• German (de_DE)

• French (fr_FR)

• Portuguese – Brazil (pt_BR)

• Italian (it_IT)

• Japanese (ja)

• Russian (ru_RU)

• Dutch (nl_NL)

• Turkish (tr_TR)

Privacy

When a comment or Contact Form 7 submission is flagged as spam — by one of the checks, or by you marking a comment as spam while moderating — the plugin stores a short text fragment of the submission, a SHA-256 hash of the submitter’s IP address, and — for Contact Form 7 submissions — a salted SHA-256 hash of the submitter’s email address (never the raw IP or email). The reason the submission was flagged and the checks that triggered are also stored, keyed by comment ID for comments and by email hash for forms.

When a comment is used to train the spam filter — from the Spam Log’s Spam / Ham pills, or by any Spam / Not Spam moderation decision made elsewhere in WordPress — the full text of that comment is stored as a training sample, keyed by both the comment ID and a salted SHA-256 hash of the commenter’s email address (never the raw email), until it is erased through a personal-data erasure request or the plugin is uninstalled.

The email hash is what keeps a training sample reachable by an export or erasure request after the comment it was trained from has been deleted. This data — including training samples — is exportable and erasable per data subject via WordPress’s Privacy tools (Tools → Export/Erase Personal Data). Suggested privacy-policy text covering both comments and form submissions is available under Settings → Privacy in the WordPress admin.

No new storage location is introduced for Contact Form 7; form entries live in the existing spam log option and are removed on uninstall alongside all other plugin data.