Anti-Spam Guard for Better Messages

No. The plugin hooks directly into the Better Messages message pipeline. Without Better Messages active, the guard does nothing.

Detection modules can always start in Log only mode so you can see what they catch before enabling blocking. The detection rules are tested against both suspicious and legitimate input. Threshold based modules such as duplicate detection and new account limits are designed around behaviour that differs from normal member activity.

No. The plugin primarily focuses on logged-in users. Messages sent by guests or in group chats are not covered.

You can use the admin alert e mails and the [BMSG] entries in your PHP error log. With WP_DEBUG enabled, this is normally wp-content/debug.log. Neither contains message content.

The contact filter detected the phone number and the phone action is set to Block. Hard blocking only applies to accounts younger than the minimum contact age; accounts past that age are logged and alerted but allowed through (with the two step confirmation for e mail and phone when that module is on). You can change the phone action to Log only or Off under Contact Filter.

No. This case is included in the automated test suite.

The guard only runs on the private message send path. Counters use transients and store hashes rather than message text. Age lookups are cached per request and the front end script only loads when a relevant module is enabled.

Logs and alert e mails contain information about the detected signal but never the message content. The duplicate checker stores one way hashes rather than message text. Client hints store the reported platform version and the browser's User Agent for 24 hours. The bad word escalation stores the first 160 characters of a matched message with the user's account, so repeated violations can be reviewed. No data leaves your server except for the optional Turnstile verification, which communicates with Cloudflare.

No. Verification runs in the background while members chat; a passed check is remembered for 15 minutes. A send never waits on Cloudflare — it either passes instantly from cache or is refused immediately with a clear message, while the background check finishes seconds later for the next attempt.

The invisible check can take a second or two after a page loads. If a member sends a message during this brief window, it may be refused once due to a race condition. This is a temporary race condition, not a block. The member can simply send the message again a few seconds later.

Yes. Go to Anti Spam Guard → Message Texts. Each block, confirmation and warning message has its own setting. Leaving a field empty uses the built in translatable default.

Yes. Admin and member facing text is translation ready using the anti-spam-guard-for-better-messages text domain.

No. Messages shorter than the minimum length (default 40 characters, configurable) never enter the duplicate check at all. Both the threshold and the time window are configurable.

No. The per-hour conversation limit only counts messages that were actually delivered. Refused sends (security check, contact filter, duplicates) never count.

It can be used without a CAPTCHA. Cloudflare Turnstile is optional. The behavioural modules can detect several types of automated abuse without showing a verification prompt to members.

No. It uses the optional standalone Cloudflare Turnstile module. So you need that only if you want to use the Turnstile module. All other modules work without it.