WPCoreTools Disposable Email Guard

This plugin refuses sign-ups, comments, checkouts, and form submissions when the email address belongs to a disposable, burner, or temp-mail service. All checks run on your own server against domain lists that ship inside the plugin file — no email address is ever sent to a third-party service, and the plugin does not contact any external server in its default configuration.

Five well-known community-maintained disposable-email lists are bundled as snapshots. Two are active out of the box (around 13,000 unique domains combined); three larger lists are available as opt-in for stricter coverage (around 98,000 unique domains with all five). An optional auto-update from the upstream GitHub URLs is also available, off by default.

What it detects

• Disposable and burner addresses (default ON) — Mailinator, YOPmail, Guerrilla Mail, 10minutemail, Temp-Mail, and similar services.

• Anonymous / privacy mail (default OFF) — Proton Mail, Tutanota, Mailbox.org, Posteo, StartMail, SimpleLogin, addy.io, DuckDuckGo Email Protection, Firefox Relay, Apple Hide My Email. Off by default because plenty of legitimate paying customers prefer these services.

• Plus-addressing aliases (default OFF) — [email protected] style sub-addresses.

• Dead and no-MX domains (default OFF) — typos like gnail.com, parked or expired domains. One DNS lookup per new domain, then cached.

• Custom block and allow rules with wildcard patterns: *@spammer.com, *@*.ru, spam*@*.

Where it checks

WordPress core:

• Registration form

• Profile email change

• Comment author email (off by default)

• Programmatic user creation ( wp_insert_user, REST API, WP-CLI, other plugins)

• Lost-password form

• Multisite signup form

WooCommerce:

• Customer registration

• Checkout (billing email)

• My Account → Edit Account email change

• Product reviews

• Coupon application — refuse coupons when the billing email is on a blocklist (anti-abuse safety net)

Form plugins:

• Contact Form 7 — built-in, no configuration needed

• Gravity Forms — built-in, no configuration needed

• Any other form plugin via the wpcdeg_check filter (one line of PHP from your form’s email-validation hook)

Three modes

• Block — reject the submission with a clear error message.

• Flag — let the submission through, but tag the user / comment / order with wpcdeg_flagged meta so you can review them in a list. Pairs with WooCommerce auto-hold and coupon refusal.

• Log only — record matches in the detection log without rejecting or tagging anything. Useful for a dry-run before turning enforcement on.

Domain lists

Five bundled snapshots are available, each toggled independently:

• disposable-email-domains (MIT) — ON by default, ~9,900 domains.

• 7c/fakefilter — ON by default, ~4,900 domains.

• groundcat/disposable-email-domain-list (MIT) — opt-in, ~21,000 domains.

• wesbos/burner-email-providers (MIT) — opt-in, ~27,000 domains.

• disposable/disposable-email-domains (MIT) — opt-in, ~98,000 domains.

txt ) and is loaded from disk; no network call is required for any of them to function.

If you want the snapshots refreshed on a schedule from their GitHub raw URLs, an optional auto-update feature is available. It is off by default. See “External services” below for what is contacted and what is sent.

Tools

• Stats dashboard with a 14-day activity chart, per-reason breakdown, and top detected domains.

• WP Dashboard widget with the same at-a-glance summary.

• Detection log with date / reason / context filters and CSV export.

• Optional periodic email digest, daily or weekly.

• CSV / TXT bulk import for the blocklist and the allowlist.

• Settings JSON export and import for moving configuration between sites.

• WP-CLI: wp wpcdeg refresh / test / stats / log / sources / clear-log.

• HPOS and Cart/Checkout Blocks compatibility declarations.

Privacy

• No email address is ever sent to a third-party service.

• The plugin does not contact any external server in its default configuration.

• If you enable the optional auto-update feature (or click the manual “Update now” button), the plugin issues HTTPS GET requests to raw.githubusercontent.com for the source URLs you have selected. The request body is empty, the User-Agent is WPCoreToolsDisposableEmailGuard/<version>, and no email addresses, user data, or your site URL are transmitted. Full disclosure under “External services” below.

• The detection log stores the email address, domain, reason, and IP address locally for admin review. Retention is configurable from 7 to 365 days (default 90); a daily WP-Cron job purges older rows.

• On uninstall, all data is deleted only if you turned on the “Delete data on uninstall” setting.

External services

This plugin can optionally contact one external service. No request is ever made automatically in the default configuration: the recurring auto-update is off by default and must be explicitly enabled via the setup wizard or the Lists tab (Settings → WPCoreTools Disposable Email Guard → Lists → “Auto-update from upstream sources”), and the manual “Update now” button only ever fetches at the moment you click it.

GitHub (raw.githubusercontent.com)

• What it is: GitHub serves the raw source files of five public, community-maintained lists of disposable-email domains. The plugin downloads only the list files; nothing else.

• What it is used for: Refreshing the bundled snapshots of the disposable-email lists you have selected, so your active blocklist stays current between plugin releases.

• When data is sent: In exactly two cases. (1) Scheduled: when the “Auto-update from upstream sources” setting is enabled, WP-Cron fetches the enabled source URLs on the schedule you configure (hourly / twice-daily / daily / weekly). While that setting is off, the recurring cron contacts nothing at all. (2) Manual: when you click the “Update now” / “Refresh now” button (or run wp wpcdeg refresh ), a one-time fetch of the enabled sources runs immediately — the click itself is the consent, so this works regardless of the auto-update setting.

• What is sent: One HTTPS GET request per enabled source URL. The request body is empty. The User-Agent is WPCoreToolsDisposableEmailGuard/<plugin-version>. No email addresses, user data, IP information beyond what GitHub’s CDN normally logs, or your site URL are transmitted.

• Where the requests go (the same addresses are stored in plain text in the plugin’s data/source-urls.json ):

• https://raw.githubusercontent.com/disposable-email-domains/disposable-email-domains/main/disposable_email_blocklist.conf

• https://raw.githubusercontent.com/7c/fakefilter/main/txt/data.txt

• https://raw.githubusercontent.com/groundcat/disposable-email-domain-list/master/domains.txt

• https://raw.githubusercontent.com/wesbos/burner-email-providers/master/emails.txt

• https://raw.githubusercontent.com/disposable/disposable-email-domains/master/domains.txt

• Service operator: GitHub, Inc.

• Terms of service: https://docs.github.com/en/site-policy/github-terms/github-terms-of-service

• Privacy statement: https://docs.github.com/en/site-policy/privacy-policies/github-general-privacy-statement

If you would rather not contact GitHub at all, leave “Auto-update from upstream sources” off (its default state). The bundled snapshots provide full functionality offline.

g. an internal threat-feed URL or a private gist). Those URLs follow exactly the same rules as the built-in sources: fetched by the recurring schedule only while auto-update is enabled, and by the “Update now” button when you click it.

They are entirely under your control.