MentoGuard - Spam Blocker & reCAPTCHA Alternative for Contact Form 7
| 开发者 |
hbakhtiari
mentotex |
|---|---|
| 更新时间 | 2026年8月22日 03:55 |
| PHP版本: | 8.0 及以上 |
| WordPress版本: | 7.0 |
| 版权: | GPL-2.0-or-later |
| 版权网址: | 版权信息 |
详情介绍:
Tired of spam emails flooding your inbox from your contact form? MentoGuard is a lightweight, privacy-first spam blocker that protects your Contact Form 7 forms from bots - without annoying your real visitors with image puzzles or checkbox challenges.
If you are looking for a reliable reCAPTCHA alternative that is fully GDPR compliant, MentoGuard stops spam bots silently using behavioral analysis and server-side token verification. Zero data is sent to Google or any external server. Ever.
Currently optimized for Contact Form 7 (CF7), with support for more form builders coming in future releases.
How It Works
MentoGuard uses five independent protection layers that work together invisibly:
- IP Blacklist - known bad IPs are blocked instantly before any other check runs. Supports IPv4, IPv6, and CIDR ranges.
- Signed Token - every form load generates a unique one-time server-side token. Headless bots that submit without loading the page are blocked immediately.
- Submission Timing - measures the time between page load and form submission entirely server-side. Bots submit in milliseconds; real users take seconds.
- Behavioral Score - JavaScript silently tracks mouse movement, typing patterns, field interaction order, and paste vs keyboard input to generate an accurate spam score.
- JS Bypass Detection - if a bot disables JavaScript entirely to avoid tracking, MentoGuard catches it server-side.
- No Google dependency - reCAPTCHA sends visitor data to Google servers. MentoGuard keeps everything on your own server.
- No puzzles, no friction - real visitors never click a checkbox or identify traffic lights. Protection is completely invisible.
- GDPR-friendly by design - no cookies, no third-party requests, no data leaving your server.
- Zero page speed impact - scripts only load on pages that contain an active contact form. Every other page is completely unaffected.
- No monthly fees - MentoGuard is free and open source. No API keys, no account registration, no renewal.
- Native Contact Form 7 tag - place [mentoguard] directly inside the CF7 form editor
- Three protection presets - Relaxed, Balanced, Strict - one click to configure
- Per-signal control - enable or disable each behavioral signal and adjust its point value
- Configurable block threshold - set exactly how aggressive the spam filter should be
- Page time protection - configurable minimum time in seconds or milliseconds
- Spam Log dashboard - every blocked submission logged with IP, score, signals, and page URL
- Top Spammers page - IPs ranked by blocked attempt count with one-click blacklist addition
- IP Blacklist - manually add IPs or CIDR ranges permanently blocked before any other check
- Test Mode - see live spam scores without blocking anyone, perfect for tuning
- Debug Log - step-by-step validation showing exactly what happened for every submission
- Bulk log management - select and delete individual entries or clear all at once
- Automatic log retention - configurable from 30 days to forever
- Translation ready - full i18n support with .pot file included
安装:
- Upload the mentoguard folder to /wp-content/plugins/
- Activate through the Plugins menu in WordPress
- Add [mentoguard] inside your CF7 form editor before the submit button
- Go to MentoGuard > Settings and choose a preset - Balanced is recommended
- Enable Test Mode first to verify real users score below the block threshold
屏幕截图:
常见问题:
Is MentoGuard a reCAPTCHA alternative?
Yes. MentoGuard replaces reCAPTCHA with server-side behavioral analysis and token verification. No Google account required, no data sent externally, fully GDPR compliant.
Will it block real users by mistake?
MentoGuard uses a scoring system across multiple independent signals. Real users rarely trigger enough signals to reach the block threshold. Enable Test Mode before going live to verify scores on your own site.
Does it work with Contact Form 7?
Yes. MentoGuard registers as a native CF7 form tag. Place [mentoguard] inside the CF7 form editor and it works immediately - no other configuration needed.
Is it GDPR compliant?
Yes. No data leaves your server. Only blocked submissions are logged in your own WordPress database. Log retention period is configurable. All data is deleted on plugin uninstall.
Does it affect page speed or SEO?
No. MentoGuard scripts load only on pages containing a CF7 form with [mentoguard]. All other pages are completely unaffected - no scripts, no styles, no impact.
Can I block specific IPs permanently?
Yes. The IP Blacklist supports individual IPv4 and IPv6 addresses as well as CIDR ranges (e.g. 192.168.0.0/24). Blacklisted IPs are blocked before any other validation runs.
What is the Debug Log?
Enable Debug Mode in Settings, submit a form, then go to MentoGuard > Debug Log. You will see every validation layer - what was checked, what was found, and exactly why the submission was allowed or blocked.
Will other form builders be supported?
Yes. The core protection engine is form-builder agnostic. Contact Form 7 is the first integration. More form builders are planned for future releases.
更新日志:
1.8.6
- Update: Plugin display name updated
- Fix: IP validation in blacklist Ajax handler uses FILTER_VALIDATE_IP
- Fix: min_score filter uses absint() inline
- Fix: sanitize_time_value() capped at 9999
- Fix: All inline script tags replaced with wp_add_inline_script()
- Fix: Each POST field individually sanitized with sanitize_text_field() and wp_unslash()
- Fix: CIDR mask validation now checks 0-32 for IPv4, 0-128 for IPv6
- Fix: Plugin name trademark issue resolved
- Fix: Logger queries restructured to satisfy Plugin Check static analysis
- Fix: All Plugin Check warnings resolved
- Fix: Score badge colors - blocked entries always orange or red, never green
- Fix: Emoji replaced with Dashicons throughout admin
- Add: README.md for GitHub
- Add: Debug Mode and Debug Log page
- Fix: CF7 REST API token conflict resolved
- Fix: CF7 submits via REST API - switched to wpcf7_spam filter
- Add: Token auto-refresh after successful CF7 submission
- Add: IP Blacklist with CIDR range support
- Add: Top Spammers page with one-click blacklisting
- Add: Daily cron job for automatic log retention purge
- Fix: All database queries use $wpdb->prepare()
- Fix: All input reads include wp_unslash() and inline sanitization
- Add: Silence files in all directories
- Add: languages/ folder with .pot file
- Add: Page time protection - server-side timing check
- Add: Configurable minimum time in seconds or milliseconds
- Add: Signed one-time server-side token system
- Add: JS bypass detection
- Add: Bulk delete in Spam Logs
- Fix: Score badge color logic
- Fix: Server-side blocking reads threshold settings correctly
- Initial release