DamaSoft Email Security

DamaSoft Email Security reduces messages sent to malformed, disposable, blacklisted or mistyped recipient domains. Its core WordPress mail protection works independently and has no required plugin dependency. When WooCommerce or the official CartFlows Cart Abandonment Recovery plugin is present, their specific checkout and recovery flows are protected automatically. The plugin does not claim to verify whether an individual mailbox exists. That would require sending data to an external verification service. Instead, it combines checks that can run locally and transparently:

• WordPress email-syntax validation.
• Manual address and domain allow/block lists.
• A local list of common disposable-email domains.
• Typo suggestions for well-known providers.
• Cached DNS checks for MX, A and AAAA records.
• Conservative fail-open DNS mode to reduce false positives during temporary resolver outages.

Outgoing WordPress mail The plugin checks To, Cc and Bcc recipients before PHPMailer sends a message. Certainly invalid recipients are removed from mixed recipient lists. When all routing recipients are invalid, the send is intentionally short-circuited as successful so queue and recovery plugins do not retry forever. WooCommerce This integration is optional. When WooCommerce is active, both classic checkout and the Checkout Block are validated on the server. A lightweight front-end helper can suggest corrections such as gmail.dcom to gmail.com, but the server remains the source of truth. CartFlows Cart Abandonment Recovery This integration is optional. When CartFlows Cart Abandonment Recovery is active, verified capture requests are checked before an invalid address reaches the recovery queue. A scheduled cleanup can also mark existing bad rows as unsubscribed without deleting CartFlows statistics. The integration deliberately touches only the official cartflows_ca_cart_abandonment table after verifying its schema. Smart control centre The modern administration area separates the operational dashboard, allow/block rules, settings and filtered security log into focused submenu screens. The dashboard keeps live counters, system health, quick actions and frequent offenders immediately visible. A compact WordPress dashboard widget gives a useful summary without loading assets on unrelated admin pages. Privacy by design No data is sent to DamaSoft or to an external HTTP service. DNS checks send only the domain portion of an address to the DNS resolver configured by the hosting provider. The security log stores blocked or uncertain addresses only; successful mail is not copied. Checkout IP addresses are anonymized, retention is configurable, and WordPress personal-data export and erasure tools are supported.

1. Back up the site before replacing a production security plugin.
2. Upload the ZIP through Plugins > Add New > Upload Plugin.
3. Activate DamaSoft Email Security.
4. Open DS Email Security in the WordPress admin menu.
5. Review the allow/block lists and protection settings.

When upgrading from DAMA Email Security 2.x, the new plugin preserves the existing options and dama_email_logs table. During activation it deactivates the active 2.x predecessor so the two versions cannot filter the same message twice.

3.2.1

• Added an Italian interface fallback for Italian WordPress sites while community translations are reviewed; English remains available elsewhere.
• Made the allow and block rules easier to review on desktop and mobile.
• Keeps the version badge visible beside the logo on smaller administration screens.
• Kept settings, security log and validation behaviour compatible with 3.2.0.

3.2.0

• Clarified that repeated CartFlows and checkout activity represents automatic checks, not people, orders or manual attempts.
• Changed dashboard totals to count distinct daily security cases instead of inflating them with repeated automatic checks.
• Kept the raw check count in the detailed log and now shows both first and latest detection times.
• Separated log grouping by source and stable validation result so unrelated protection flows can no longer merge into one row.
• Fixed all-invalid outgoing mail so WordPress receives an intentional successful short-circuit after recipient filtering, preventing avoidable retry loops.
• Added correct protection for Bcc-only and Cc-only WordPress messages.
• Improved singular Italian status labels and the wording of dashboard, widget, log and privacy information.
• Added the dedicated public plugin-details URL; translations are delivered through WordPress.org language packs instead of compiled catalogs in the ZIP.

3.1.0

• Split the control centre into dedicated Dashboard, Rules, Settings and Log submenu screens.
• Added clear dashboard shortcuts and updated widget and Plugins-screen links to open the correct section.
• Kept each action, notice, filter and pagination flow inside its relevant section.
• Reduced unnecessary database work by loading log queries only on the Log screen.

3.0.2

• Translated legacy allowed security-log statuses and added their filter and visual style.

3.0.1

• Added the bundled Italian translation for the plugin description shown on the Plugins screen.

3.0.0

• Renamed the plugin to DamaSoft Email Security with the DS Email Security menu label.
• Rebuilt the administration dashboard and WordPress dashboard widget.
• Added a dedicated DamaSoft email-shield logo while keeping a standard Dashicon in the WordPress menu.
• Added safe migration from the original 2.x single-file plugin without deleting settings or logs.
• Added conservative DNS mode for new installations while preserving strict mode on upgrades.
• Added To, Cc and Bcc filtering and stopped storing successful-recipient logs.
• Added server-side WooCommerce Checkout Block support.
• Hardened CartFlows capture interception with nonce validation and exact integration targeting.
• Fixed full cleanup pagination and removed the unsafe fallback that could touch unrelated cart tables.
• Added anonymized IP logging, configurable retention, privacy-policy text, exporter and eraser.
• Replaced dynamic SQL identifiers with WordPress placeholders and protected admin actions with redirects and nonces.
• Added clean uninstall handling, translation support and WordPress.org metadata.