Analytical Spam Filter vs OpenPorte Spam Protection

Most spam filters make your visitors do the work by solving captchas, clicking image grids, or proving they are human before they can leave a comment. Analytical Spam Filter takes a different approach. It analyzes how a submission behaves and blocks spam automatically, with no friction for legitimate visitors. Key Features No captchas No API keys No third-party services Privacy-friendly design Behavioral spam detection IP reputation tracking Content fingerprinting Cache-compatible operation Install it, activate it, and it starts working. Spam is identified by observing behaviors that real visitors naturally exhibit. People take time to read before typing, interact with the page, and use a real browser. Bots often skip those signals. The plugin uses those differences to distinguish legitimate submissions from automated spam without interrupting the user experience. The plugin uses multiple independent detection techniques on every submission. A bot that bypasses one check is likely to be caught by another. This layered approach improves effectiveness over time. Once a spammer’s IP address or message content has been identified, future attempts can be blocked more quickly. Visitors with a previously approved comment are never flagged, regardless of the spam history associated with their IP address. No visitor data is sent to external spam services, and no account registration or API configuration is required. All field names added by the plugin are randomized during installation and can be regenerated at any time. This helps prevent bots from targeting the plugin based on known source code signatures. The plugin is compatible with caching plugins when Cache Compatibility is enabled. The plugin blocks spam submitted through the default WordPress comment form only. It is also automatically compatible with the Micro Contact Form plugin. Blocking Methods Timestamp Blocking — Records when the page loaded and when the form was submitted. Submissions that arrive too quickly to have genuinely read the page, or after the token has expired, are blocked. Duration Blocking — Measures how long the visitor actively spent filling out the form. Bots fill forms almost instantly. Requires Cache Compatibility to be enabled. IP Blocking — Remembers which IP addresses have been blocked before. Once an address reaches the configured threshold, future submissions are flagged without running the remaining checks. IP addresses with a previously approved comment are never flagged. Content Blocking — Remembers the content of blocked spam. If the same message appears again from a different IP address, it is flagged immediately. Content that matches a previously approved comment is excluded from the spam history. Honeypot — Adds a hidden field that legitimate visitors never see or interact with. Bots that fill every available field are caught. Submissions where the field is missing entirely are also flagged. Automated Client Detection — Blocks submissions from automated tools that do not identify themselves as a real browser. Legitimate visitors send this information automatically. Referer Check — Blocks submissions that did not originate from a page on your own site. URL / Domain Blocking — Flags submissions containing more URLs or domain names than the configured limit. Spam comments frequently contain multiple links. JavaScript Check — When Timestamp or Duration Blocking is active, the plugin can determine whether JavaScript ran when the form loaded. Bots that skip JavaScript are caught automatically. Randomized Field Names — Hidden field names are randomized during installation and can be regenerated at any time from the settings page, so bots cannot target the plugin based on known field names. Trackback Blocking — Optionally block all trackbacks, which are a common source of spam. Pingback Blocking — Optionally block all pingbacks, which are a common source of spam. General Options Send email notifications for blocked spam, valid submissions, or all submissions Configurable email rate limit to prevent inbox flooding during attacks Add spam to the WordPress spam queue, or block and reject it immediately Optionally show rejection reasons to the submitter Enable Cache Compatibility for caching plugin support and duration blocking Regenerate security keys at any time from the settings page

OpenPorte is a free and open-source plugin that protects WordPress forms from spam using a lightweight Proof-of-Work challenge instead of CAPTCHAs. The goal is to make spam expensive for bots while keeping the experience almost invisible for legitimate visitors and respecting their privacy. For site owners, OpenPorte offers an easy to configure and deploy modern spam protection under their control. For the site users, it offers an accessible, transparent and privacy-friendly alternative to CAPTCHAs. OpenPorte is built around the open-source ALTCHA widget. Some highlights: CAPTCHA-free spam protection Fully open source (GPL) Self-hosted – no mandatory external service Designed to be accessible and privacy-friendly Compatible with existing ALTCHA integrations Easy migration for users of ALTCHA Spam Protection v1 (≤ 1.26.3) For the list of contributors, refer to our GitHub project: Contributors. AI-assisted development AI-assisted project. Architecture, security decisions, and final review are mine; AI tools (Claude, Mistral, and others) help with drafting code, tests, translations, and documentation — without them, one person couldn’t keep this fork alive. Background The original ALTCHA Spam Protection WordPress plugin (v1) was open source (GPLv2). Its authors have since released a version 2/3 which is no longer open source. They no longer maintain the open source project and recommend that users migrate to v2/v3. See the official project at https://altcha.org for their offering. OpenPorte started as a fork and continues the v1 line as free software (GPLv2 or later) for users who want to stay on a fully open-source, self-hosted solution. It is a faithful fork: existing v1 installations can switch to OpenPorte and keep their settings (see Upgrading). Compatibility OpenPorte is backward-compatible with ALTCHA Spam Protection v1 plugin: Your existing settings are migrated automatically on activation. The [altcha] shortcode keeps working (alongside the new [openporte]). The altcha_* filters and actions keep firing as deprecated aliases. Custom API Mode has been verified against GateCHA, an open source server implementing the creation and verification of ALTCHA challenges. See the Deprecations section for the full list of compatibility aliases and what they map to. Upgrading From the original ALTCHA v1 plugin Deactivate the old ALTCHA plugin, then install and activate OpenPorte. Your existing configuration is detected and copied into the OpenPorte settings on first activation; the original ALTCHA settings are left untouched, so you can roll back to ALTCHA v1 without losing anything. Do not run both plugins at the same time. From ALTCHA v2/v3 If your site was already moved to ALTCHA v2/v3 (for example by the automatic 3.0.0 update), your original v1 settings are normally still in the database: the v2/v3 upgrade neither migrates nor removes them. Deactivate ALTCHA, then install and activate OpenPorte — it finds and imports the v1 settings, even when the v1 plugin itself has long been deleted. Settings made in v2/v3 are not read. Deprecations The following ALTCHA-era identifiers are kept as aliases for backward compatibility and are scheduled for removal in a future release: The [altcha] shortcode — use [openporte]. The altcha/v1 REST namespace — use openporte/v1. The altcha_* filters and actions — now firing through WordPress’ deprecated hook mechanism; use the openporte_* equivalents. The AltchaPlugin class and the ALTCHA_VERSION / ALTCHA_WIDGET_VERSION constants — use OpenPortePlugin and the OPENPORTE_* constants. Integrations targeting paid-only third-party plugins; affected users should migrate to the official ALTCHA v2/v3 plugin. The “Custom HTML” integration (auto-configuration of hand-written tags) — place the [openporte] shortcode instead. You can re-enable it for now under Settings → OpenPorte → Integrations. Privacy No cookies, no tracking OpenPorte prioritizes user privacy by avoiding the use of cookies and fingerprinting techniques. No external service This plugin remains fully contained within your WordPress installation, eliminating any reliance on external services. Modes of Operation OpenPorte verifies submissions in one of two modes, selected in the settings (API Mode): Self-hosted (default) — a proof-of-work challenge is issued and verified by your own WordPress site through the REST API. Fully self-contained, with no external service and no additional setup beyond enabling the integrations you need. Custom — point the Challenge URL at your own ALTCHA-compatible backend (for example a self-hosted ALTCHA Sentinel, or GateCHA). Submissions are verified with your site’s shared secret. The paid altcha.org regional SaaS classifier offered by earlier versions has been removed; both remaining modes are free and self-hostable. REST API This plugin requires the WordPress REST API. If you are using any “Disable REST API” plugins, ensure that the endpoint /altcha/v1/challenge (marked for deprecation) and /openporte/v1/challenge are allowed. Supported Integrations CoBlocks Contact Form 7 Elementor Pro Forms (deprecated — paid plugin, see Deprecations) Formidable Forms Forminator GravityForms HTML Forms wpDiscuz WPForms WordPress Login, Register, Password reset WordPress Comments WooCommerce Many other plugins and your own content (via the [openporte] shortcode, or the deprecated [altcha] alias) Source Code All source code for the plugin, and the ALTCHA widget is available on GitHub. In the repository, you’ll also find versions of non-minified JavaScript and CSS assets: Plugin: https://github.com/openporte/openporte ALTCHA Widget: https://github.com/altcha-org/altcha