About this plugin
A CAPTCHA proves the sender is a human being. It does not stop a human being
whose job is to send sales pitches through other people’s contact forms. If you
run a small business in Japan, that is most of what arrives in your inbox.
Robse Form Guard reads each submission and scores its wording. Japanese
business-to-business sales boilerplate — 貴社, ご担当者様, 初期費用,
導入実績 and the like — is language a private customer asking about your work
simply does not use. When enough of it piles up in one message, the submission
is stopped.
Blocked submissions are kept, and can be forwarded to you. Each blocked
submission is saved in a history on your own site (Settings > Robse Form Guard >
History) for 30 days by default, with the reason, the score and the words that
matched. With forwarding turned on (the default), it is also emailed in full to
the site administrator or an address you choose. The history shows whether
each email went out, and can send any entry again, so a copy is not lost when
your site cannot send mail. The visitor is shown a phone number or address you
choose, so a real customer caught by mistake can still reach you.
What it checks
- A honeypot. A field a person cannot see and a script fills in.
- Too fast. A form sent within a few seconds of being shown (3 by
default) was not typed by a person. Cached pages are never caught by this.
- A rate limit. Repeated submissions from one address in a short time.
- The wording. Each keyword carries points; the submission is stopped when
the total reaches the score you set. The starting list and every weight are
editable, and you can add your own words. Forms of address and greetings
(貴社, ご担当者様, と申します, 弊社 and so on) are written by companies asking
for a quote as well as by salespeople, so a message that matches only those
is never stopped: something being sold, or a link, has to be there too.
The wording is compared after folding the ways a word can be written:
full-width and half-width letters, upper and lower case, and spaces or
invisible characters slipped into a word (ＳＥＯ, seo, 御 社) all count.
Links are found in http(s)://, www. com/page forms, but a
visitor’s own email address is never counted as a link.
Try it before you trust it
A new installation starts in watch only: it records, and emails you, what
it would have blocked while letting everything through. Run that for a week,
look at the History tab, then turn blocking on. Sites that used an earlier
version keep the mode they had.
Which form plugins
- Contact Form 7
- Snow Monkey Forms
It sits alongside reCAPTCHA, Akismet or Turnstile rather than replacing them:
those stop machines, this stops people who are paid to write to you.
For Japanese sites
The keyword list is Japanese and the plugin is aimed at Japanese-language
sites. On a site in another language, replace the list with your own wording
under Settings.
Privacy
When a submission is stopped (or, in watch-only mode, would have been), the
plugin stores its full contents, the time and the submitting IP address in a
database table of its own ( {prefix}robse_form_guard_log ). Entries are deleted
automatically after the number of days set on the settings screen (30 by
default, at most 5,000 entries), and can be deleted by hand at any time. The
history can be turned off. It is included in WordPress’s personal data export
and erasure tools, matched by the email address in the submission, and the
plugin suggests wording for your privacy policy.
When forwarding is turned on (the default), the same contents are emailed to
the address configured on the settings screen, which defaults to the site’s
own administration email address. That email is sent by WordPress from the
site itself. No data is transmitted to the plugin author or to any third
party, and the plugin makes no outbound network requests.
The rate limit stores a hashed form of the submitting IP address in a
transient, which expires on its own within the window you configure. The
too-fast check adds a hidden field holding the time the form was shown and a
signature; nothing about the visitor is stored for it.
Uninstalling the plugin removes its settings and the history table.