BotBlocker Security – Complete security platform vs SolverGuard Spam Shield

BotBlocker Security is a complete security platform that blocks 99% of attacks before WordPress loads. Firewall, bot detection, rate limiting, CAPTCHA, 2FA, analytics, notifications, tools – one plugin replaces your entire security stack: no need for separate firewall, CAPTCHA, 2FA, and anti-spam plugins. No bloat, no monthly fees for core protection. If your site is hit by login brute force, spam comments, fake Googlebots, content scrapers, or XML-RPC floods, you are not alone: bots generate over 47% of all web traffic. Most security plugins react after WordPress boots, wasting CPU and memory on every bad request. BotBlocker stops them at the door – then gives you the analytics, alerts, and tools to understand exactly what it blocked and why. Because BotBlocker intercepts traffic before themes and plugins run, it also shields vulnerabilities in your entire plugin and theme stack. Zero-days in contact form plugins, unpatched slider code, outdated e-commerce extensions – attackers never reach the vulnerable code. BotBlocker is your first and last line of defense, every day. Why site owners switch to BotBlocker Faster than the competition. Runs on early init through three interception layers, before themes and plugins load. Server load drops during attacks instead of spiking. Zero database queries for returning visitors – 11 pre-generated PHP files with SHA-256 integrity, loaded via native include. One plugin, full security stack. Firewall, CAPTCHA, 2FA, anti-spam, rate limiting, bot detection – BotBlocker covers virtually every security need a WordPress site has. Most users uninstall 2-3 separate plugins after switching. PRO adds malware scanning, security headers, speed optimization, and behavioral analysis – still one plugin. Smarter bot detection. 2,899 User-Agent signatures – largest blacklist among WordPress plugins – plus 2,800+ additional bot signatures. 13 header checks including AdBlock detection, incognito mode detection, Canvas/WebGL fingerprinting, and device API verification. Anti-detect scoring with 9 weighted signals catches headless Chrome, Puppeteer, Selenium, and PhantomJS even when they spoof user-agent strings. Smarter CAPTCHA. 9 modes including Silent Auto-Verify – zero clicks for humans, hard wall for bots. Proprietary CAPTCHAs defeat AI-based solvers that crack reCAPTCHA for $2-3 per 1,000. Honest free version. Full firewall, all 9 CAPTCHA modes, full 2FA, full logging, full Multisite, Redis/Memcached, shortcodes, command palette, Telegram alerts, visual analytics, 15 diagnostic tools. No nag screens, no crippled features. Privacy-first. No visitor data leaves your server. GDPR and CCPA compliant out of the box. Works with everything. Cloudflare, WP Rocket, LiteSpeed, WooCommerce, Elementor, multisite, IPv6, PHP 7.4 to 8.5. 🛡️ Core Firewall (Free) Three-Layer Architecture – intercepts traffic at wp-config.php (before WordPress), MU-plugin phase, and main shield. The first layer blocks known threats before WordPress, plugins, or themes even load – saving 30-100ms and 5-20MB RAM per blocked request. This also means BotBlocker shields you from vulnerabilities in other plugins and themes: attackers exploiting a zero-day in a contact form or slider plugin never reach the vulnerable code. Web Application Firewall (WAF) with real-time rule updates via the BotBlocker Threat Defense Feed 2,899 User-Agent signatures – largest blacklist among WordPress plugins – covering Scrapy, Selenium, Puppeteer, PhantomJS, curl, wget, Python, Java, Perl, and SQL injection tools. Plus 2,800+ additional bot signatures. Brute force protection with progressive lockouts – 5 attempts per 15 minutes, escalating bans for repeat offenders Rate Limiting – sliding window velocity tracking per IP. 30 requests/minute triggers CAPTCHA challenge; 50 requests/minute blocks IP for 10 minutes. Subnet-level aggregation catches distributed attacks across /24 IPv4 or /64 IPv6 ranges. Floor protection prevents false positives at low thresholds. Anti-spam for comments, registration, contact forms – spammers blocked before they connect XML-RPC and REST API locked down by default with allowlist for trusted services HTTP method-level hardening – CONNECT and TRACE blocked (XST attack prevention). OPTIONS handled for CORS preflight. Explicit method allowlist. Fake crawler detection via FCrDNS (dual-direction DNS verification), ASN tokens, and published IP ranges – 95% effective, impossible to spoof without controlling the provider’s DNS zone. Multi-resolver DNS fallback. LLM / AI crawler management – allow or block GPTBot, ChatGPT-User, ClaudeBot, PerplexityBot, Bytespider via CIDR-verified IP ranges. 1,435 LLM source ranges synced from cloud. Trusted crawlers verified, impersonators blocked. Country, ASN, IP range, User-Agent, Referer blocking rules with instant enforcement. ASN database: 3.6M verified source records. Geo-blocking with visual country selector and import/export. Cloudflare-aware real-IP resolution and origin bypass protection TLS fingerprinting (JA3/JA4) – detects bots by TLS handshake signature, cross-validates against User-Agent. 189 JA3/JA4 signatures. Opt-in, requires server module. See docs/TLS-FINGERPRINTING.md RKN (Roskomnadzor) blocking – 852 CIDR ranges, cloud-synced, auto-updated with self-healing tamper recovery Full IPv6 support – separate tables and logic for IPv4 and IPv6, every feature works with both Live traffic monitor with attack map, country, ASN, device, browser, and exact block reason for every request Built-in caching via Redis and Memcached – free, auto-disable on connection failure 🔍 Bot Detection & Anti-Detect (Free) 13 HTTP header checks run on every visitor, catching bots that other plugins miss: Empty User-Agent / UA Anomalies / Empty Accept-Language PTR/DNS Mismatch – forward/reverse DNS mismatch, impossible to fake Geo vs Language Mismatch – visitor claiming one language from a different country Incognito/Private Mode detection AdBlock/uBlock detection in visitor’s browser Canvas & WebGL Fingerprinting – JS consistency verification WhatsApp Preview / OPTIONS Preflight – legitimate traffic whitelisted Anti-Detect Challenge Page activates when header checks raise suspicion – silent browser fingerprinting before any CAPTCHA appears: 9 weighted detection signals: navigator mismatch (×2), fake plugins (×3), font rendering mismatch (×2), WebGL mismatch (×2), Chromium-specific properties (×3), JS execution jitter, touch event mismatch (×2), language mismatch (×3), incognito detection (×2) Critical signal combinations trigger immediate block – e.g. navigator mismatch + fake plugins together Cookie capability test + sessionStorage retry counter HMAC-signed responses resist DDoS provider interference Circuit Breaker: 3 failures → 30-second cooldown → auto-retry CAPTCHA appears only if auto-verification fails – real users rarely see it 🎯 CAPTCHA System – All 9 Modes Free # Mode User Experience Best For 8 Silent Auto-Verify (Recommended) Zero clicks. JS fingerprint check passes silently. Default. Maximum UX. 0 Simple Button Single “I am not a robot” button Minimal friction 1 Color Buttons Click the matching color button Visual verification 2 Image CAPTCHA Click the image matching the category. 5 packs: Eagle, Horse, Raccoon, Dog, Cat Visual recognition 3 reCAPTCHA v2 + Button Google checkbox + BotBlocker button Google ecosystem users 4 reCAPTCHA v2 Standard Google reCAPTCHA Google ecosystem only 5 Dynamic Shapes 60fps Canvas with moving geometric figures. 5 shapes × 5 colors = 25 combinations. Maximum anti-AI protection 6 Dynamic Digits Animated math equation Math verification 7 Hold Button Hold and release in the green zone Physical interaction proof Hybrid Mode – combine any internal CAPTCHA with invisible reCAPTCHA v3 for two-layer defense DDoS Resilience Mode – HMAC-signed verification responses prevent forged challenge bypass Session Token Verification – cookie-less fingerprint for restricted hosting (no CAPTCHA loops for VPN/proxy users) CAPTCHA Diagnostics – failure reason codes (token decrypt, transient missing, hash mismatch, mode mismatch) for precise troubleshooting Image Delivery Modes: Inline Base64 (single request, recommended) or Separate Requests (cache-friendly) 🔒 Login Security & 2FA (Free) Two-Factor Authentication compatible with Google Authenticator, Authy, 1Password, Bitwarden – TOTP standard with 10 backup codes 9 CAPTCHA modes on login, registration, lost password, and custom forms Hybrid Mode – combine any internal CAPTCHA with reCAPTCHA v3 for two-layer invisible defense on login Hide login URL (PRO) Configurable lockout durations with escalation for repeat offenders – failed CAPTCHA triggers short ban, repeated failure triggers 24-hour ban 💳 Payment Gateway Bypass (Free) Auto-detects 25+ e-commerce platforms (WooCommerce, Easy Digital Downloads, SureCart, MemberPress, Paid Memberships Pro, Give, Dokan, CartFlows, FunnelKit, and more) and 150+ payment providers (Stripe, PayPal, Mollie, Adyen, Braintree, Square, Razorpay, Klarna, Paddle, Authorize.Net, 2Checkout, YooKassa, LiqPay, and more). Also auto-detects webhooks from form plugins (Contact Form 7, WPForms, Gravity Forms, Ninja Forms, Formidable Forms, Forminator, Fluent Forms). Four detection layers – 198 path patterns, 227 query keys, 360 action names, 114 signature headers – ensure zero false positives on payment traffic. Webhooks, IPN callbacks, and payment notifications never get blocked. 📊 Visibility & Control (Free) Visual dashboard with KPI cards – Requests today, Blocked today, Search engines passed, Protection score (0-100%). Hourly bar chart, distribution donut charts (Hosting, Device, Browser, OS) Dashboard social proof card – live WordPress.org rating (1-5 stars with half-star), active installs count, number of ratings, link to WP.org (cached 12 hours) Inline IP rule widget – add IP allow/block rules directly from dashboard via AJAX, no page reload. Bulk IP import with 4 one-click buttons (IPv4/IPv6 whitelist/blacklist). Protection Status Checklist – individual enable/disable toggles for all features with “Enable remaining” bulk action Health Score gauge – 44 parameters across 3 categories, 5 security levels from Critical (<25) to Secure (≥85). Real-time score updates as you change settings. 3 security presets – Light, Strong, Full – one-click configuration. Plus Default for new installs. Setup Wizard – 8 steps: welcome → protection level → compatibility check → exclusions → CAPTCHA → init mode → cache → finish with summary. Under 5 minutes. ⌘K Command Palette – press Ctrl+K / ⌘K on any admin page to instantly search and navigate every setting, tab, and action. 30+ quick-action shortcuts (“Block an IP address”, “Set up 2FA”, “Run malware scan”, “Clear visitor cookies”). Near-zero-click configuration. Interactive analytics – 8 KPI metrics, donut charts (Hosting, Device, Browser, OS), traffic line chart with time range, world map with country-level visualization, top IPs and top countries ranking tables 55 diagnostic event codes across 12 log categories – exact block reason for every single decision. 12 categories independently toggleable. Detailed event log with IP, country, ASN, User-Agent, browser type, OS type, device type, and exact block reason 17 interface languages – English, Deutsch, Español, Français, Polski, Русский, Українська, العربية, עברית, Italiano, 日本語, 한국어, Nederlands, Português, Svenska, Türkçe, 中文 + POT template Admin page header bar – “Blocked today: X · Total: Y” on every admin page without opening dashboard Admin bar WordPress toolbar node – protection status + Dashboard + Settings links Configurable retention with timezone and DST awareness. Daily Summary with incremental aggregation for fast multi-day analytics. X-Robots-Tag control – user-configurable SEO directives (noindex, nofollow, noarchive, nosnippet, noimageindex, notranslate, unavailable_after) on blocked/challenge pages – prevents search engines from indexing security barriers Clean uninstall – drops all 17 tables, removes 40+ options, clears 22+ transients, removes 12 cron hooks, deletes MU-plugin files and uploads/botblocker/ directory. Uninstall feedback dialog collects departure reason. Zero leftover data. 📬 Notifications & Alerts (Free) Email reports – daily / twice-weekly / monthly security summaries with key metrics. Critical server load warnings and Cloud API expiry alerts. Telegram Bot integration (add-on) – weekly security summaries via @BotFather-connected bot: total requests, allowed, blocked, suspicious, search bots, fake bots, timezone, protection mode, security score, block rate. Connection test button for setup verification. Configured in Add-ons → Telegram Notifications. Admin Dashboard Alerts (8 types) – cloud connection lost, missing runtime files, cloud API expired, cloud API hits exhausted, ASN database update failed, addon update failed, addon incompatible, cache plugin incompatibility 🧩 Shortcodes & Developer Tools (Free) 20 shortcodes for frontend dashboards, client portals, and status pages: Shortcode What It Displays [bbcs_counters_grid] Hits + blocked + search engine counters [bbcs_blocked_today] / [bbcs_blocked_total] Block counters [bbcs_health_gauge] Visual health score gauge chart [botblocker_generateSiteHealthList] Security recommendations checklist [bbcs_health_full] Full health assessment grid [bbcs_top_ips] / [bbcs_top_countries] Top IPs and countries (configurable count + days) [bbcs_top_devices] / [bbcs_top_browsers] Top devices and browsers [bbcs_latest_hits] Latest visitor hits table [botblocker_rules_stats] IPv4/IPv6 rules + paths + bots statistics [bbcs_database_update] / [bbcs_database_total] Cloud IP database stats [bbcs_system_status] Server info: OS, PHP, DB, WP versions [bbcs_botblocker_news] BotBlocker news feed [bbcs_lang_options] Language selector dropdown [bbcs_plugins_themes] Installed plugins and themes list [bbcs_cron_tasks] Scheduled cron tasks widget [bbcs_recommendations] Security improvement recommendations WP Connectors (WordPress 6.7+) – BotBlocker registers as a native WordPress Connector on the Connections admin page Custom verification endpoint (bbcs-verify) – decoupled from WordPress permalink structure WordPress Admin → Tools → Site Health → Info integration Plugin update changelog injection – changelog displayed directly in the WordPress plugin update screen Floating support widget on all admin pages – submit support tickets from dashboard without leaving site 🔧 Tools & Diagnostics (Free) 15 maintenance and diagnostic actions built into the admin panel: Tool Purpose Export Data & Settings Full JSON backup of settings, rules, IP lists, configuration Import Data & Settings Restore from JSON backup Reinstall Database Factory-reset all BotBlocker tables Repair & Optimize DB WordPress database repair and optimization Clear All Visitor Data Purge hits, counters, and statistics Clear Transients Remove expired WordPress transients Update ASN Database Download latest 3.6M-record ASN geolocation database Update RU-Gov List Download latest 852-range RKN CIDR blocklist Sync LLM Providers Refresh 1,435 AI crawler IP ranges from cloud Clear Visitor Cookies Reset all BotBlocker cookies – forces re-verification Reset URL Rewrite Rules Fix 404 errors after permalink changes Clear Object Cache Flush WordPress internal + Redis/Memcached caches Site Health Open WordPress Site Health diagnostic Clear Debug Log / Download Debug Log Purge or download wp-content/debug.log for support 🚀 PRO Adds (Premium / Pro / Ultimate) Cloud Threat Intelligence – 5M+ attack IPs cross-checked against global databases. Zero-day behavioral and heuristic detection catches unknown attack patterns before signatures exist. VPN, Tor, proxy, ASN, and hosting reputation checks. Early Init Mode – filtering before WordPress Core loads. Boot code in wp-config.php blocks threats at the earliest possible layer. Up to 30-100ms and 5-20MB RAM saved per blocked request. Multisite-aware, auto-disables if Cloud API inactive. Self-healing runtime files. Hide Login URL – custom admin URL slug. Four behaviors when default URL is accessed: 403 message, 404 page, …

SolverGuard Spam Shield is the only free WordPress plugin that protects every entry point of your site — contact forms, comment sections, user registrations, login page, REST API, XML-RPC, and your server itself — with zero shortcodes and zero per-form configuration required. While most anti-spam plugins protect only one area of your site, SolverGuard deploys 30+ independent protection layers across six major modules. Install it, activate it, and your entire WordPress site is defended immediately. “Set it and forget it” protection — works automatically from the moment you activate.” 🛡️ MODULE 1: Contact Form 7 Protection Six independent spam-fighting layers apply automatically to every CF7 form on your site — no per-form setup needed. 🍯 Honeypot — An invisible hidden field is silently injected into every form. Real users never see it or fill it in. Bots that auto-fill every field get caught instantly and blocked. ⏱ Time-Based Check — Bots submit forms in milliseconds; humans take a few seconds to read and fill out a form. This module blocks submissions that arrive suspiciously fast (bots) or from stale, expired sessions, eliminating both automated attacks and session replay attacks. 🚫 IP Blocker — Block individual IP addresses or entire CIDR network ranges (e.g. 10.0.0.0/8) from submitting any form on your site. The same block list is automatically shared with comments, login, and registration protection for maximum coverage. 🔤 Keyword Filter — Case-insensitive keyword and phrase matching scans every submitted form field simultaneously. Block spam phrases, competitor names, casino/pharma keywords, or any custom list of prohibited terms. 📈 Rate Limiter — Caps the number of form submissions per IP address within a configurable sliding time window. Stops bots that submit the same form hundreds of times per hour, without ever impacting real users. 🤖 Google reCAPTCHA v3 — Silent, frictionless bot scoring via Google’s reCAPTCHA v3. No annoying checkboxes or image puzzles for real visitors — the score is calculated invisibly in the background and submissions below your threshold are blocked automatically. 💬 MODULE 2: Comment Spam Protection Ten layers of dedicated comment spam protection, covering every submission path including Gutenberg and headless REST API setups. 🍯 Comment Honeypot — A hidden anti-spam field is injected into every WordPress comment form automatically. ⏱ Comment Time Check — Blocks comments submitted too quickly after page load (bots) or from sessions that expired too long ago. 🚫 IP Blocking — Automatically reuses the shared IP block list — block an IP once, block it everywhere. 📈 Comment Rate Limiter — Separate per-IP rate limiting specifically for comments, independent of form rate limiting. 🔤 Comment Keywords — A global keyword list plus comment-specific blocked phrases. Stop spam before it reaches your moderation queue. 🔗 Link Count Limit — Block comments containing more than a configurable number of hyperlinks — the #1 hallmark of spam comments. 📧 Email Domain Blocking — Block registrations and comments from disposable or known spam email domains. Enter a list of blocked domains and all matching email addresses are automatically rejected. 🤖 User-Agent Filtering — Block comments from known spam bot user-agents. Optionally block requests with no user-agent header at all. ⏳ Hold Comments With Author URL — Automatically sends comments from authors with a URL in their display name to moderation, rather than publishing them instantly. 🌐 REST API Protection — All comment spam checks also apply to submissions made via the WordPress REST API (used by Gutenberg and headless/decoupled WordPress setups). 🔐 MODULE 3: Login & Brute-Force Protection Stop hackers from guessing your password with automated brute-force attacks. 🔒 Login Rate Limiting — After a configurable number of failed login attempts from the same IP, further attempts are blocked for a configurable lockout period. Stops dictionary attacks and credential-stuffing bots cold. ⏱ Configurable Lockout — Set exactly how many failed attempts trigger a lockout, and how many minutes the lockout lasts. Default: 5 attempts, 15-minute lockout. 📋 Full Audit Logging — Every blocked login attempt is logged with the IP address, timestamp, and the reason for the block, so you can see exactly what threats your site faces. 👤 MODULE 4: Registration Spam Protection Block fake accounts and spam bot registrations before they are ever created in your database. 🍯 Registration Honeypot — A hidden field traps bots that auto-fill every registration field. ⏱ Registration Time Check — Blocks registrations submitted impossibly fast or from expired form sessions. 📧 Email Domain Blocking — Block registrations from specific disposable email domains. Subdomain matching included — blocking spammail.com also blocks [email protected]. 🔤 Username & Email Keyword Filter — Blocks registrations with prohibited words in the username or email address. 📈 Registration Rate Limiter — Limits the number of registration attempts per IP in a configurable period. 🌐 REST API & XML-RPC Coverage — Protection applies to ALL registration paths: the standard form, the WordPress REST API, and direct wp_insert_user() calls. Fake accounts are blocked before they are ever written to the database, which also prevents WordPress from sending notification emails for blocked registrations. 🤖 MODULE 5: Advanced Bot Protection A dedicated bot-detection engine that runs before WordPress even fully loads — blocking malicious traffic at the earliest possible moment. 🕵️ Known Bad Bot Blacklist — 30+ built-in user-agent signatures covering scrapers (AhrefsBot, SemrushBot, MJ12bot), vulnerability scanners (Nikto, sqlmap, WPScan, Acunetix, Nessus), DDoS tools (Slowloris, LOIC), AI crawlers, and spam bots. Fully customizable with your own additional signatures. 🚫 Empty User-Agent Blocking — Blocks all requests with no User-Agent header — a near-universal sign of automated attack traffic. 🔍 Fake Googlebot / Bingbot Detection — Real Googlebots come from specific Google-owned IP ranges with verifiable reverse DNS. This module performs a live reverse DNS lookup to verify any request claiming to be Googlebot or Bingbot, and blocks fakes that don’t pass verification. Protects your server resources from being wasted on impersonators. ⚠️ Suspicious URL Pattern Blocking — Blocks probes for sensitive files and attack patterns including: /wp-config.php, /.env, /.git/, /.htaccess access attempts Web shell uploads (shell.php, c99.php, r57.php) Directory traversal attacks (../../) SQL injection in URLs (UNION SELECT, DROP TABLE) XML/XXE injection attempts phpMyAdmin and database tool probes WordPress scanner paths (/wp-content/uploads/*.php) 🌊 Request Flood Protection — Sitewide per-IP rate limiting that blocks any IP sending excessive requests within a configurable time window. Stops DDoS and scraping attacks that would otherwise overload your server. 🔒 HTTP Method Filter — Blocks unnecessary and dangerous HTTP methods such as TRACE and CONNECT that are used by certain attack tools. 🛡️ Security Headers — Automatically adds five HTTP security headers to every response: X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block Referrer-Policy: strict-origin-when-cross-origin Permissions-Policy: geolocation=(), microphone=(), camera=() 🎭 Hide WordPress Version — Removes the WordPress version number from page source, RSS feeds, script/style URLs, and HTTP headers — making version-specific exploit scanning much harder. 👤 Block Author Enumeration — Blocks the ?author=1 URL trick that attackers use to discover your WordPress usernames before launching targeted brute-force attacks. ✏️ Custom Bot Signatures & URL Patterns — Add your own custom bot user-agent signatures and URL regex patterns directly from the admin panel. ⚙️ MODULE 6: General WordPress-Wide Protection Site-wide hardening that protects your WordPress installation at the infrastructure level. 📡 XML-RPC Protection — Fully disable XML-RPC (a common DDoS amplification vector), or choose the surgical option: disable only the pingback methods while leaving the rest of XML-RPC available for legitimate use (e.g. mobile apps). 🔗 REST API Rate Limiting — Rate-limit unauthenticated REST API requests per IP to prevent API abuse by bots and scrapers. 🚫 REST API User Enumeration Block — Automatically blocks unauthenticated access to the /wp/v2/users REST endpoint, which attackers use to harvest all WordPress usernames on your site. 🏓 Trackback & Pingback Spam Blocking — Block all incoming trackback and pingback requests sitewide. Also removes the X-Pingback HTTP header and the pingback URL from your blog info to hide the endpoint from probes. 🔗 Comment Author URL Hold — Automatically sends any comment to moderation when the author’s display name contains a URL — a common spam technique. 📊 Spam Log & Reporting Full Audit Log — Every blocked request is logged with the IP address, user-agent, submission data, block reason, and timestamp. Available under Anti-Spam Protection → Spam Log. Filter by Module — Quickly find blocked entries by protection module (honeypot, rate limiter, bot protection, login, registration, etc.). Automatic Log Cleanup — Set a log retention period in days and old entries are automatically purged. Keep your database clean without manual work. One-Click Log Clear — Clear all log entries instantly from the admin panel. ✅ Why Choose SolverGuard Spam Shield? Feature SolverGuard Typical Free Plugin CF7 Form Protection ✅ 6 layers ✅ 1-2 layers Comment Spam Protection ✅ 10 layers ✅ Basic Login Brute-Force Protection ✅ Yes ❌ No Registration Spam Protection ✅ Yes ❌ No Advanced Bot Protection ✅ 10+ checks ❌ No XML-RPC & REST API Hardening ✅ Yes ❌ No Security Headers ✅ Yes ❌ No Hide WordPress Version ✅ Yes ❌ No Author Enumeration Block ✅ Yes ❌ No Spam Log with Auto-Cleanup ✅ Yes ❌ No Zero Configuration Required ✅ Works instantly ⚠️ Often requires setup 100% Free ✅ Yes ✅ Yes Works Automatically — Zero Configuration Required All protection layers activate automatically the moment you install and activate the plugin. No shortcodes to add, no per-form configuration, no template edits. Every module can be individually toggled on or off, and all settings are accessible from a single admin page under Anti-Spam Protection → Settings. External Services This plugin optionally integrates with Google reCAPTCHA v3 for silent spam scoring on Contact Form 7 submissions. This feature is disabled by default and must be explicitly enabled by the site administrator by entering their own reCAPTCHA site and secret keys. What data is sent and when? When reCAPTCHA is enabled, the visitor’s reCAPTCHA response token and IP address are sent to Google’s servers at the time of a form submission. No data is sent to Google if the reCAPTCHA module is disabled. Service: Google reCAPTCHA v3 Provider: Google LLC Terms of Service: https://policies.google.com/terms Privacy Policy: https://policies.google.com/privacy No other data is sent to any external service. All spam detection is performed locally on your own server.