Kama SpamBlock
Kama Spamblock blocks simple automated comment spam. It is invisible to normal visitors and does not use captchas. The plugin protects the standard WordPress comment endpoint, wp-comments-post.php. It adds a small check to the comment form. Direct requests that skip the form are blocked. This is a basic check, not proof that a person wrote the comment. Bots that load the page and run JavaScript can pass it. Kama Spamblock does not replace a full anti-spam service. It also checks pings and trackbacks for a link back to your site. Even if you are using an external comment system like Disqus, Kama Spamblock can add lightweight protection. Automated requests can be posted directly to the ‘wp-comments-post.php’ file, where the plugin can block basic bots. Simple and effective protection Kama Spamblock combines several small checks that are inexpensive for the site and invisible during normal commenting: The protective field name and its unique code rotate together every four hours. Ten recent pairs remain valid for pages served from full-page cache. Each marker is tied to the specific WordPress post, so a marker copied from another comment form is rejected. The form must remain open for at least three seconds before it can be accepted. Protective fields are added only after interaction with the comment submit button. If a valid comment is blocked, a JavaScript-only retry form preserves the entered data. The retry challenge changes its HTML structure to make basic scraping less reliable. Pingbacks and trackbacks must return a successful HTTP response, non-binary content, and a real backlink. These checks deliberately remain lightweight. A capable bot that loads the page, runs JavaScript, and reproduces normal browser behaviour can still pass them. Using Kama Spamblock with other anti-spam plugins Kama Spamblock can work with a full anti-spam plugin or service. It blocks simple direct spam requests first. The other tool can then check the comments that remain. For example, it can analyse comment text, reputation, or behaviour. The plugins complement each other. For this combination to work as intended: The other plugin should use the standard WordPress comment flow, or check comments after Kama Spamblock allows them. The site must show the standard comment form and allow the plugin’s JavaScript to run. Set the correct ID for the form’s submit button in the plugin settings. Test the setup if another plugin replaces the comment form, uses AJAX, or sends comments to its own endpoint. Kama Spamblock may need extra integration, or it may not check those comments.
Pixeline's
This plugin provides an unobtrusive yet efficient protection against email harvesters / spambots. Post/page authors may write email addresses in their article in the usual format (“john@doe.com”) without exposing them to spam email harvesters. The plugin takes care of the obfuscation, implementing a graceful degradation technique focusing on usability so as to protect your email addresses from harvesters while keeping them usable to your human visitors. The plugin replaces any email address found in posts, pages, comments and excerpts, and replace them by a bit of html markup that should deceive most email harvesters: john(replace the parenthesis by @)doe.com . If javascript is available, it will display a clickable link and display the original email to the human user. Maximum usability, maximum protection. Please rate the plugin if you like it. Usage Write your email addresses inside your posts and pages as usual. When the plugin is activated, it will replace them by a human-readable html string that explains how to deduce the email address, and if javascript is available (99.9% of the time), the original email address will be displayed as a clickable mailto: link. For example: Hello john@doe.com. How are you today? will become John( replace these parenthesis by @ )doe.com. Additionally, you can specify what the mailto: link should look like by sticking a parenthesis inside of which you put the visible link text, like this: Hello john@doe.com(John Doe). How are you today? will become John( replace these parenthesis by @ )doe.com. inside a theme If you need to protect emails inside your Theme’s files (like the footer.php for example), you can use the function safe_email() like this: echo safe_email('you@domain.com'); Theme-safe alternative (plugin can be disabled) If your theme must keep working even when this plugin is disabled, use a wrapper in your theme (for example in functions.php) and call that wrapper everywhere instead of calling safe_email() directly. if ( ! function_exists( 'theme_safe_email' ) ) { function theme_safe_email( $email, $label = '' ) { $email = sanitize_email( $email ); if ( '' === $email ) { return ''; } if ( function_exists( 'safe_email' ) ) { $payload = $email . ( '' !== $label ? '(' . $label . ')' : '' ); return safe_email( $payload ); } $encoded_email = antispambot( $email ); $link_label = '' !== $label ? $label : $encoded_email; return ' ' . esc_html( $link_label ) . ' '; } } Contribute Github repo: https://github.com/pixeline/pixeline-email-protector
