Stackedboost Signup Guard - Block Disposable Emails on Registration and Comments
| 开发者 | stackedboost |
|---|---|
| 更新时间 | 2026年9月16日 00:21 |
| PHP版本: | 7.4 及以上 |
| WordPress版本: | 7.1 |
| 版权: | GPLv2 or later |
| 版权网址: | 版权信息 |
详情介绍:
registration_errors) and comment submission (preprocess_comment). When someone tries to sign up or comment with an address from a known disposable domain, the plugin refuses it and shows a message you can edit. The point is fewer fake accounts, less registration spam and less comment spam, without adding a captcha and without sending anything to an outside service.
8,201 known throwaway domains are bundled with the plugin. The list ships as a plain text file inside the plugin folder and is only read into memory when an address actually needs checking, on a registration or a comment. No network request is made at any point, for any reason. There is no account to create, no API key to enter, and no external service involved. The check runs on your own server, on data that is already on the form.
Subdomains are matched too. Blocking example.com also blocks mail.example.com, test.example.com, and so on, because the plugin walks the domain from the right and checks each level.
You can add your own list of domains to always block, and a separate list of domains to always allow. The allow list wins over everything, including the bundled list, so if this plugin ever turns away a real person using a forwarding or privacy address, you add their domain there and they are never blocked again.
Anyone who can moderate comments on your site is exempt from every check, so an editor testing the registration form is never blocked by their own plugin.
Settings > Signup Guard is a dashboard, not just a form. It shows how many sign-ups and comments were refused in total and at each form, a 30 day chart, the domains refused most often, and the last 20 refusals. Only domains are stored, never email addresses, because the domain is all that is needed to see the plugin is working and to decide whether to add it to the allow list. All of it is kept in a few WordPress options on your own site, with no extra database table.
This plugin deliberately does not touch WooCommerce checkout or WooCommerce account registration. A sibling plugin, Stackedboost Email Guard, covers those forms. Two plugins checking the same field would show a shopper the same complaint twice, so this one stays out of WooCommerce entirely and only guards the WordPress core forms.
What it cannot do
This is a filter against a known list, not a defense against a determined person. Someone who wants to get past it can register a fresh domain of their own, or use a throwaway mail host that has not been added to any list yet. What this plugin does well is cut the casual bot registrations and spam signups that use the same handful of well known disposable services. It will not stop someone who is actually trying to get around it.
Signup Guard Pro (optional, paid)
The bundled list only changes when this plugin updates, and new throwaway services keep appearing. Signup Guard Pro is a separate add-on, sold on stackedboost.com, that checks each sign-up and comment the bundled list lets through against a live list of more than 160,000 throwaway domains, refreshed daily, and refuses domains that do not exist. Everything described above works without it, and this plugin contains no Pro code and no locked features. It only provides a filter, sbsg_check_result, that the add-on uses.
Where the bundled list comes from
The bundled list is built from the disposable-email-domains project, an open source list dedicated to the public domain under CC0 1.0. Credit belongs to that project and its contributors. This plugin packages a copy of the list, it did not compile it.
安装:
- Upload the plugin files to the
/wp-content/plugins/stackedboost-signup-guarddirectory, or install the plugin through the WordPress plugins screen directly. - Activate the plugin through the "Plugins" screen in WordPress.
- Go to Settings > Signup Guard to review where checking happens, edit your allow and block lists, and change the message shown to a refused visitor.
屏幕截图:
常见问题:
Does this work with WooCommerce?
It leaves WooCommerce alone on purpose. This plugin only guards WordPress core account registration and WordPress core comments. WooCommerce checkout and WooCommerce account registration are covered by a sibling plugin, Stackedboost Email Guard. Running both on the same field would show the customer the same complaint twice, so Signup Guard stays out of WooCommerce entirely.
Does this plugin send anything anywhere?
No. The bundled domain list is a file inside the plugin, read from your own server's disk. There is no API call, no remote lookup, no telemetry, and no account to sign up for. Everything the plugin does happens inside your own WordPress install.
What happens if it blocks a real person?
Some legitimate people use forwarding services or privacy focused email addresses that can look like throwaway domains. If a real visitor tells you they were turned away, go to Settings > Signup Guard and add their domain to the "Never block" list. It wins over the bundled list and your own block list, and takes effect immediately.
Does it catch subdomains?
Yes. Blocking example.com also blocks mail.example.com, signup.example.com, and any other subdomain of it. The same rule applies to the allow list.
Will it block me as an admin?
No. Anyone logged in with the ability to moderate comments is exempt from every check the plugin makes, so you can test your own registration and comment forms without being refused by your own settings.
How current is the bundled list, and what if a new throwaway host shows up?
The list is bundled with the plugin and updated when a new plugin version ships, so it is only as current as your installed version. New disposable mail services appear regularly and will not be caught until the list is updated. If you spot one being used to spam your site, add its domain to the "Also block" list yourself, it takes effect right away without waiting for a plugin update. If you would rather not track new services by hand, the optional Signup Guard Pro add-on checks against a live list refreshed daily.
Does it slow down my site?
The list file is only read when someone actually submits a registration or a comment, not on every page load. It is not shipped as PHP code, so it costs nothing until it is needed.
Can I turn off just one of the two checks?
Yes. Settings > Signup Guard has separate switches for registration and for comments, so you can guard one form and leave the other open.
更新日志:
- New dashboard on Settings > Signup Guard: refusal totals per form, last refusal, a 30 day chart and the most refused domains.
- Refusal counts are kept per day for 90 days and per domain for the top 200, in options, never as email addresses.
- New
sbsg_check_resultfilter so an add-on can add its own verdict for addresses the local lists let through. Domains on your allow list are never passed on. - Dashboard styles moved to an enqueued stylesheet that loads on this screen only.
- Uninstalling removes the new counters too.
- First release. Guards WordPress account registration and comments against 8,201 bundled disposable email domains, checked locally with no network request. Merchant block list and allow list. Recent refusals log storing domain only.