About this plugin
ZBounce Email Validator checks email addresses submitted through selected forms using the ZBounce email verification service.
The plugin is free and open source. External verification requires a paid ZBounce credit package. html and enter the API key received after checkout in Settings > ZBounce Email.
There is no separate paid plugin edition or local license activation.
API use requires a saved key and accepted service agreement. Automatic form checks are separately disabled until explicitly enabled. The plugin does not use the public demo endpoint or fall back to a free service when a key fails.
By default, the plugin rejects addresses reported by the API as invalid, disposable, or having no mailbox. Catch-all and undecided mailbox results are not automatically rejected. Verification cannot guarantee delivery or prevent every spam submission; use it alongside your existing form protections.
Integrations:
* Contact Form 7.
* WooCommerce classic checkout and Checkout Block.
* WordPress registration.
* Selected Gravity Forms, WPForms and Ninja Forms forms.
Results are cached locally for a configurable 1–168 hours (24 hours by default). Unknown mailbox results and API failures are not cached or presented as confirmed mailboxes. Your accepted-results policy determines whether those submissions pass; the default policy allows them.
The [zbounce_email_validator] shortcode provides a standalone tester for logged-in administrators only. It is not a public widget that can consume your credits anonymously.
External services
net/) for remote email verification.
After saving an API key and accepting the service agreement, administrators can run manual email checks. Automatic form checks additionally require enabling Automatic form verification. net/v1/fast-verify, with the API key in the X-API-Key HTTP header.
Paused automatic checks do not read cached decisions or block forms.
net/v1/me. That request does not include an email address and does not run a verification.
Requests are made from the WordPress server over HTTPS. The service receives the server’s network address and normal HTTP request metadata. The plugin does not include other form fields, names, passwords, payment details or the visitor’s IP address in its API payload.
API keys are not exposed to frontend JavaScript.
The API key is stored in WordPress options. Cached results, including checked email addresses, are stored in the site’s WordPress database. Expired cache entries are ignored on reads and removed during subsequent writes; expiration is not a promise of immediate physical deletion.
WordPress personal-data export and erasure tools include this local verification cache. These tools do not request new checks or erase data held by the external service. Deactivation preserves settings and cache; deletion of the plugin removes them.
Site owners are responsible for informing their visitors about this external processing. Review the service policies before enabling checks:
html
html
html
Verification policy
Choose accepted results in Settings: valid, risky (accept-all), disposable, invalid format, no-mail domain, missing mailbox, unknown, and API unavailable. Checked results pass. Native form format checks still apply.
Defaults allow valid, risky, unknown and API unavailable; other results are rejected. SMTP uncertainty is distinct from API connection/key/balance failure. Rules re-evaluate cached results immediately.
Unknown and failed checks are not cached.
WooCommerce Checkout Block validates the billing email server-side when an order is submitted, before payment. Intermediate checkout draft updates do not trigger verification. Classic checkout remains supported.