Spambargo: Anti-Spam for Forms & Comments

No. Native integrations are never pre-validated by the universal AJAX checker. Generic interception targets likely lead forms and can be controlled with CSS selectors or data attributes. This generic mode is a browser-side, best-effort pre-check and cannot stop a bot that posts directly to a custom form handler; server-enforced protection requires one of the listed native integrations or custom server-side validation.

By default, yes. The honeypot and server checks continue to work, while a missing behavior token is allowed. Administrators can enable strict token mode, which is stronger but requires JavaScript.

Not in this release. Checkout Blocks receive server-side identity, blacklist, content, phone and rate checks. Behavioral tokens and the visual math challenge are deliberately skipped because Blocks require a dedicated client-side extension-data integration.

Each line is a separate literal rule. A single-word line blocks that complete word, not a longer word that merely contains it. A multi-word rule blocks only when all of its words appear in the same order, although other words or punctuation may appear between them. Matching is not case-sensitive. Regular expressions are not executed. One matching line is enough to block a submission.

New installations include the existing strict spam-rule recommendations (gambling, pharmaceuticals, crypto, SEO outreach and adult content). These can block legitimate English enquiries, so edit or clear them to fit your audience. During upgrades, previously saved blocked terms, including an intentionally empty list, are preserved.

Country blocking uses WooCommerce geolocation when available or a country code supplied by a trusted proxy or the wpas_detect_country_code filter. If no reliable country is found, country blocking fails open; Spambargo does not contact an external geolocation service. Language blocking checks the primary Accept-Language browser language, not the natural language of the message. Users and bots can alter this header; use it as an additional signal rather than a sole anti-spam measure.

Yes. A daily WordPress cron event removes entries older than the configured retention period and clears expired rate-limit counters.

Data is preserved by default. Enable “Delete all data when plugin is uninstalled” before deleting the plugin to remove its tables and settings.