WPCoreTools Disposable Email Guard
| 开发者 | wpcoretools |
|---|---|
| 更新时间 | 2026年8月23日 21:29 |
| PHP版本: | 7.4 及以上 |
| WordPress版本: | 7.1 |
| 版权: | GPLv2 or later |
| 版权网址: | 版权信息 |
详情介绍:
This plugin refuses sign-ups, comments, checkouts, and form submissions when the email address belongs to a disposable, burner, or temp-mail service. All checks run on your own server against domain lists that ship inside the plugin file — no email address is ever sent to a third-party service, and the plugin does not contact any external server in its default configuration.
Five well-known community-maintained disposable-email lists are bundled as snapshots. Two are active out of the box (around 9,800 unique domains combined); three larger lists are available as opt-in for stricter coverage. An optional auto-update from the upstream GitHub URLs is also available, off by default.
What it detects
- Disposable and burner addresses (default ON) — Mailinator, YOPmail, Guerrilla Mail, 10minutemail, Temp-Mail, and similar services.
- Anonymous / privacy mail (default OFF) — Proton Mail, Tutanota, Mailbox.org, Posteo, StartMail, SimpleLogin, addy.io, DuckDuckGo Email Protection, Firefox Relay, Apple Hide My Email. Off by default because plenty of legitimate paying customers prefer these services.
- Plus-addressing aliases (default OFF) —
user+tag@example.comstyle sub-addresses. - Dead and no-MX domains (default OFF) — typos like
gnail.com, parked or expired domains. One DNS lookup per new domain, then cached. - Custom block and allow rules with wildcard patterns:
*@spammer.com,*@*.ru,spam*@*.
- Registration form
- Profile email change
- Comment author email (off by default)
- Programmatic user creation (
wp_insert_user, REST API, WP-CLI, other plugins) - Lost-password form
- Multisite signup form
- Customer registration
- Checkout (billing email)
- My Account → Edit Account email change
- Product reviews
- Coupon application — refuse coupons when the billing email is on a blocklist (anti-abuse safety net)
- Contact Form 7 — built-in, no configuration needed
- Gravity Forms — built-in, no configuration needed
- Any other form plugin via the
wpcdeg_checkfilter (one line of PHP from your form's email-validation hook)
- Block — reject the submission with a clear error message.
- Flag — let the submission through, but tag the user / comment / order with
wpcdeg_flaggedmeta so you can review them in a list. Pairs with WooCommerce auto-hold and coupon refusal. - Log only — record matches in the detection log without rejecting or tagging anything. Useful for a dry-run before turning enforcement on.
disposable-email-domains(MIT) — ON by default, ~5,400 domains.7c/fakefilter— ON by default, ~4,500 domains.groundcat/disposable-email-domain-list(MIT) — opt-in, ~27,000 domains.wesbos/burner-email-providers(MIT) — opt-in, ~27,000 domains.disposable/disposable-email-domains(MIT) — opt-in, ~72,000 domains.
data/sources/{id}.txt) and is loaded from disk; no network call is required for any of them to function.
If you want the snapshots refreshed on a schedule from their GitHub raw URLs, an optional auto-update feature is available. It is off by default. See "External services" below for what is contacted and what is sent.
Tools
- Stats dashboard with a 14-day activity chart, per-reason breakdown, and top detected domains.
- WP Dashboard widget with the same at-a-glance summary.
- Detection log with date / reason / context filters and CSV export.
- Optional periodic email digest, daily or weekly.
- CSV / TXT bulk import for the blocklist and the allowlist.
- Settings JSON export and import for moving configuration between sites.
- WP-CLI:
wp wpcdeg refresh / test / stats / log / sources / clear-log. - HPOS and Cart/Checkout Blocks compatibility declarations.
- No email address is ever sent to a third-party service.
- The plugin does not contact any external server in its default configuration.
- If you enable the optional auto-update feature (or click the manual "Update now" button), the plugin issues HTTPS GET requests to
raw.githubusercontent.comfor the source URLs you have selected. The request body is empty, the User-Agent isWPCoreToolsDisposableEmailGuard/<version>, and no email addresses, user data, or your site URL are transmitted. Full disclosure under "External services" below. - The detection log stores the email address, domain, reason, and IP address locally for admin review. Retention is configurable from 7 to 365 days (default 90); a daily WP-Cron job purges older rows.
- On uninstall, all data is deleted only if you turned on the "Delete data on uninstall" setting.
安装:
- Upload the plugin folder to
/wp-content/plugins/, or install it via Plugins → Add New. - Activate the plugin.
- Visit Settings → WPCoreTools Disposable Email Guard. The first-time setup wizard runs automatically.
常见问题:
Does this send my visitors' email addresses to an external service?
No. Every check runs locally against domain lists that ship inside the plugin file. By default the plugin makes no outbound connections at all.
Does the plugin contact GitHub or any other server in its default configuration?
No. The bundled snapshots are loaded from disk, and nothing is fetched automatically. The optional auto-update feature, which lets WP-Cron contact GitHub to refresh those snapshots on a schedule, is off by default and must be enabled in the setup wizard or the Lists tab. The manual "Update now" button fetches only at the moment you click it. See "External services" for the full disclosure.
Will this block legitimate Proton Mail or Tutanota users?
Only if you turn on the "Anonymous / privacy providers" toggle. It is off by default for exactly that reason.
How are the disposable lists kept up to date?
Two ways. Either install a fresh version of the plugin (each release bundles updated snapshots), or opt into the auto-update feature, which lets WP-Cron fetch the source URLs from GitHub on a schedule (hourly, twice-daily, daily, or weekly).
Can I dry-run before I switch on blocking?
Yes. Set Mode to "Log only" — emails are recorded but no submissions are rejected. Or use "Flag" mode to allow signups but tag the user / order / comment for admin review.
What is "Flag" mode?
A non-destructive alternative to outright blocking. Submissions go through, but matching users get a wpcdeg_flagged user meta and a "Flagged" column on the Users list, comments get a meta tag, and WooCommerce orders get an order note plus a "Flagged" column on the Orders list. Useful when you do not want to lock out potential Proton or Tutanota customers but still want to triage them.
Can existing users get locked out by this plugin?
No. Logging in is never checked — the plugin validates new submissions only: registrations, checkout, comments, profile email changes, and the forms you enable. Existing accounts keep working even if their email provider later appears on a blocklist. Password reset by username is deliberately always allowed (only reset requests typed as an email address are checked), so nobody loses access to an account they already have. If long-standing members use a provider you are now blocking, add that domain to the allowlist.
Does this plugin ever delete users, orders, or comments?
No, never. It only blocks new submissions or flags existing ones for your review — flag and block, never delete. Removing a user, order, or comment is always a manual admin action through the normal WordPress / WooCommerce screens.
Does it work with WooCommerce HPOS?
Yes, both the legacy posts-table orders list and HPOS are supported.
Does it work with Contact Form 7 and Gravity Forms?
Yes, built-in integration on both. For other form plugins (WPForms, Elementor Forms, Forminator, Fluent Forms, etc.), call the wpcdeg_check filter from your form's email-validation hook.
What happens if a remote list URL is unreachable when auto-update runs?
The previous successful copy is kept (no data loss); the failure is recorded in the per-source meta. If no fetch has ever succeeded, the bundled snapshot continues to be used.
Will it slow down my site?
No. Each email check is an O(1) lookup against an in-memory map, loaded once per request and cached for an hour.
Does the MX record check slow down sign-ups?
Only the first lookup per domain — results are cached for 24 hours on success and 1 hour on failure. Most sign-ups hit the cache immediately. The check is opt-in and off by default.
更新日志:
1.0.7
- Compatibility: Tested with WordPress 7.1 and WooCommerce 11.0.
- New: the WooCommerce block-based checkout (Store API) is now validated server-side with the same rules, messages, and logging as the classic checkout — previously only the classic checkout hook ran.
- Fix: subdomains of listed domains (e.g. anything.mailinator.com) now match the blocklist; the allowlist walks parent domains the same way and keeps precedence.
- Fix: blocked programmatic email changes no longer blank an existing user's address. Invalid inserts are rejected with a proper error; invalid updates keep the original email, and unchanged emails always pass through.
- Fix: editing a user whose unchanged email is on a blocklist no longer fails — profile validation now runs only when the email is actually being changed.
- Fix: wildcard entries the UI documents (@yourcompany.com, @.ru, spam@*) are no longer silently stripped when saving the allowlist or importing lists/settings.
- Fix: the dead-domain MX check now fails open on DNS resolver outages — a resolver failure is no longer cached as "dead" for an hour.
- Fix: coupon refusal now also runs on the WooCommerce block-based checkout (Store API), with the same rules and message as the classic checkout.
- Fix: internationalized (punycode / IDN) domains — e.g. under the .xn--p1ai (.рф) TLD — are no longer dropped when the source lists are parsed, and unicode domains are converted to punycode before comparison when PHP's intl extension is available.
- Fix: a list entry equal to a common multi-part public suffix (such as co.uk) can no longer match every address under that suffix.
- Fix: scan counters now use atomic database increments, so the dashboard and digest scan totals and detection rate stay accurate under concurrent traffic.
- Fix: daily and weekly schedules (list refresh, log purge, email digest) recompute each occurrence in the site timezone, so they no longer drift an hour off the configured time after DST transitions.
- Fix: a user whose stored email was blanked by the earlier blanking bug can no longer change it to a blocked address — the update is rejected with a visible error.
- Fix: the setup wizard's final page no longer claims lists are "fetching in background" when auto-update is off — it now shows the active bundled-snapshot counts instead.
- Fix: the detection-log CSV export now honors the active period / reason / context filters and exports every matching row (the previous export ignored filters and stopped at the newest 500 rows).
- Fix: uninstalling with "Delete data on uninstall" enabled now removes everything it should — the uploads directory including its .htaccess, all plugin transients and counter/cache options, and the flag meta on users, comments, and orders (both legacy and HPOS).
- Fix: Contact Form 7 integration no longer fatals (PHP 8 TypeError) when the email field is posted as an array.
- Fix: "Update now" now fetches the enabled sources even while auto-update is off (the click is explicit one-shot consent); the recurring cron no longer fetches anything — including custom URLs — while auto-update is off.
- Fix: the setup wizard's list-selection step now rebuilds the active blocklist immediately, so the Done page count and enforcement match your selection.
- Fix: the CSV import notice now reports the number of entries actually saved after sanitization and warns when nothing was imported.
- Security: the detection-log CSV export now neutralises spreadsheet formula injection in exported cells.
- Tweak: the bulk-import "Replace" mode and the settings-JSON import now ask for confirmation and state exactly what will be overwritten (Replace touches only your custom list — never the built-in source lists).
- Tweak: the clear-log confirmation clarifies that flagged users, orders, and comments keep their flags; the Clear log button no longer disappears when the current filter matches nothing.
- Tweak: "Whitelist" heading renamed to "Allowlist"; corrected the empty-blocklist notice, wizard step copy, and test-digest notice; External services and FAQ documentation updated to match actual behaviour.
- Compatibility: Tested with WooCommerce 11.0 and PHP 8.5.
- Compatibility: Tested with WordPress 7.0 and WooCommerce 10.8. No behaviour changes.
- Fix: WordPress 6.7+ "Translation loading for the wpcoretools-disposable-email-guard domain was triggered too early" notice. Default block-message strings are now stored as raw English in
WPCDEG_Settings::defaults()(which fires onplugins_loaded, before WP'sinitaction), and translated at display time via the newWPCDEG_Settings::display_message()helper. Translators are unaffected — the literals still appear inWPCDEG_Settings::default_translated_messages()for.potextraction. - Fix: PHP 8.4 deprecation warnings about implicitly-nullable typed parameters (
WPCDEG_Stats $stats = null→?WPCDEG_Stats $stats = null) inWPCDEG_AdminandWPCDEG_Integrationsconstructors. - No behaviour changes — same defaults, same gates, same UI. End users on non-English sites with the default messages still see localized strings (translation now resolves at render time instead of activation time).
- New: "More tools by WPCoreTools" tab listing the rest of our free, GPL toolkit (Email Verify, Tidy Media, Speedix). Each entry shows whether it's already active on the site, with one-click activate links and Thickbox modal install for missing plugins.
- New: companion-aware notice — when WPCoreTools Email Verify is active, the More Tools tab calls out that you have layered protection.
- Fix: readme
Tested up tocorrected. - No changes to validation, blocklists, or existing settings.
- Five bundled disposable-email source snapshots, two enabled by default; works fully offline.
- Three modes: block, flag, log only.
- Optional anonymous-provider blocking, plus-addressing checks, dead-MX checks (all off by default).
- WordPress integrations: registration, profile, comments, lost-password, multisite signup, programmatic user creation.
- WooCommerce integrations: registration, checkout, My Account email change, product reviews, coupon-abuse blocker, auto-hold for flagged orders. HPOS and Cart/Checkout Blocks compatible.
- Built-in Contact Form 7 and Gravity Forms integration; generic
wpcdeg_checkfilter for other form plugins. - Custom block / allow lists with wildcard support.
- Detection log with filters and CSV export, stats dashboard with 14-day chart, optional periodic email digest.
- WP-CLI:
refresh,test,stats,log,sources,clear-log. - CSV / TXT bulk import; settings JSON export and import.
- Per-reason customizable user-facing messages; quiet-hour cron scheduling in site timezone.