SpamAnvil – AI Anti-Spam & Comment Spam Protection vs VigIA – AI Visibility, Analytics & Control

SpamAnvil is a free, open-source WordPress anti-spam plugin — and a genuine Akismet alternative — that uses artificial intelligence to block comment spam. Unlike Akismet (which requires a paid plan for commercial sites) or simple keyword-based filters, SpamAnvil leverages large language models (LLMs) to actually understand your comments and detect even the most sophisticated spam. It layers a honeypot, a time trap and per-IP rate limiting in front of the AI, so obvious bots are blocked for free. Traditional spam filters rely on static word lists and link counting. Spammers have evolved. SpamAnvil fights back with AI that understands context, intent, and language patterns – catching spam that looks legitimate and approving real comments that others would flag. Why SpamAnvil? Set up in about a minute – Activation opens a wizard that asks for one API key and verifies it before saving. Nothing is stored unless the test passes. 100% Free – No premium tier, no subscription, no hidden costs. Bring your own API key (free options available). Smarter Than Rules – AI understands context. A comment about “buying a new home” won’t be flagged just because it contains “buy”. Defense in Depth – Honeypot, time trap, per-IP rate limit and heuristics block obvious bots for free, so the AI is only spent on the subtle cases. Open Mode – Because the filtering is invisible and automatic, you can drop the usual barriers (name/email, login, moderation) and get more real comments – even anonymous ones – without opening the door to spam. Works With Free AI Models – Use OpenRouter’s free models for $0 cost, or connect premium models for maximum accuracy. Privacy-First – Your data stays between you and your chosen AI provider. IP addresses are stored as salted, keyed hashes (HMAC-SHA-256), not recoverable without your site’s secret. GDPR/LGPD compliant by design. No Cloud Lock-in – Choose from 6+ AI providers. Switch anytime. Your anti-spam, your rules. Supported AI Providers OpenAI (GPT-4o-mini, GPT-4o, etc.) Anthropic Claude (Claude Sonnet, Haiku, etc.) Google Gemini (Gemini 2.0 Flash, Pro, etc.) OpenRouter (100+ models, including FREE ones) Featherless.ai (Open-source models) Any OpenAI-compatible API (LM Studio, Ollama via proxy, vLLM, etc.) A Swiss-Army-Knife of Defenses SpamAnvil layers several spam defenses so cheap, invisible filters catch obvious bots for free and the AI only handles the subtle cases. Every layer is optional and runs before any paid API call: Honeypot – A hidden field bots fill but humans never see. Instant, free block. Time trap – Comments submitted faster than a human could type are flagged. Tamper-proof (signed) and fails open, so it never blocks a real visitor. Per-IP rate limit – Throttles comment floods from a single IP before they even reach the database. Heuristics engine – Regex/statistical pre-analysis (URLs, spam words, gambling/SEO author names, language mismatch, prompt-injection patterns) that auto-spams the obvious cases with no API call. AI verdict – An LLM scores the rest 0-100 in context. Key Features AI-Powered Spam Detection – Each comment is analyzed by an LLM that scores it 0-100 for spam probability. Works with reasoning models (their thinking is parsed correctly). Layered Bot Defense – Honeypot, time trap and per-IP rate limiting block obvious bots for free, before any AI call. Model Picker – Browse and search each provider’s live model list right from the settings page (OpenAI, OpenRouter, Featherless). OpenRouter shows a “free” badge and context size. “Open Mode” – One toggle removes WordPress comment friction (no required name/email, no login, no moderation hold) so leaving a real, even anonymous, comment is effortless. Comments appear instantly and spam is removed in the background. Verdict Cache – Identical repeated spam reuses a recent AI verdict instead of calling the API again, cutting cost during floods. Intelligent Heuristics Engine – Pre-analyzes comments to catch obvious spam without API calls. Async Background Processing – Comments are queued and processed via WP-Cron so your site stays fast. Smart IP Blocking – Automatically blocks repeat offenders with escalating ban durations (24h, 48h, 96h… capped at 30 days). Automatic Retry with Backoff – Failed API calls retry with exponential delays; a real “Test Connection” verifies actual classification, not just the HTTP status. Encrypted API Key Storage – Authenticated AES-256-GCM encryption, or wp-config.php constants for maximum security. Statistics Dashboard & Logs – Track spam caught by each layer, API usage and errors, with the AI’s reasoning for every comment. An admin warning surfaces silent failures (no provider, or a backlog of failed items). Customizable AI Prompts, Fallback Providers, Prompt-Injection Defense, Configurable Threshold, Moderator Bypass. How It Works A visitor submits a comment. Rate limit – too many comments from this IP too fast? Throttled with an HTTP 429 (before anything is stored). IP block – is the IP already banned for repeat spam? Blocked. Form traps – was the hidden honeypot filled, or the comment submitted implausibly fast? Marked as spam instantly, no API call. Heuristics – a quick regex/statistical pre-analysis; obvious spam is auto-marked with no API call. Otherwise the comment is queued for AI analysis (or processed immediately in sync mode). Identical repeated content reuses a cached verdict. The AI analyzes the comment in context (post title, author info, heuristic data) and returns a spam score. Comments above your threshold are marked spam; clean comments are auto-approved. Repeat-offender IPs are escalated. With Open Mode on, comments publish instantly and any spam is removed in the background instead of being held for moderation. Use Cases Blogs receiving hundreds of spam comments per day WooCommerce stores where comment spam affects SEO and credibility Membership sites that need to protect community discussions Multilingual sites – AI understands comments in any language, unlike keyword-based filters High-traffic sites – Async processing handles any volume without slowing down your site Sites tired of Akismet – Free alternative with no cloud dependency and full data control Security SpamAnvil follows WordPress security best practices throughout: Authenticated AES-256-GCM encrypted API key storage wp-config.php constant support for API keys (never touch the database) Configurable trusted IP header (default REMOTE_ADDR) so a forged X-Forwarded-For cannot bypass IP blocking or rate limiting Nonce verification on all forms and AJAX requests Capability checks on all admin actions Prepared SQL statements on every database query Output escaping on all rendered content Prompt injection defense: boundary tags around the comment body AND commenter metadata, system prompt hardening, heuristic injection detection (body and author fields), strict JSON validation, deterministic settings Languages English (default) Translation-ready (.pot file included) Third-Party Services SpamAnvil sends comment data (content, author name, email, and URL) to external AI services for spam analysis. The specific service used depends on your configuration. No data is sent until you configure and enable a provider. OpenAI — https://openai.com — Terms of Use — Privacy Policy Anthropic (Claude) — https://www.anthropic.com — Terms of Service — Privacy Policy Google Gemini — https://ai.google.dev — Terms of Service — Privacy Policy OpenRouter — https://openrouter.ai — Terms of Service — Privacy Policy Featherless.ai — https://featherless.ai — Terms of Service — Privacy Policy When using the “Generic OpenAI-Compatible” option, data is sent to the URL you configure. You are responsible for ensuring compliance with the privacy policies of your chosen service.

VigIA (Spanish for “lookout” or “watchman”, incorporating “IA” – Spanish for “AI”) is a complete AI visibility toolkit for WordPress. Monitor 60+ AI crawlers, control access to your content, and optimize how AI systems discover and understand your site. What does VigIA do? Scores your AI visibility with a 100-point analyzer covering 20 checks across 5 categories Tracks AI crawlers visiting your site (GPTBot, ClaudeBot, PerplexityBot, and 60+ others) Provides detailed analytics with advanced filters, server-side pagination, and exportable reports with metadata banner Blocks unwanted crawlers via PHP (403 response) Manages robots.txt rules for AI crawlers with compliance monitoring Sends email alerts about crawler activity (daily, weekly, or monthly) Generates llms.txt files to help AI systems understand your site Serves markdown endpoints for posts, pages, taxonomy archives (categories, tags, WooCommerce product categories, custom taxonomies) and WooCommerce products with schema-like data Generates JSON-LD structured data with Site Identity and AI Discovery signals Exposes abilities for AI agents and automation tools (WordPress 6.9+) Key Features AI Visibility Analyzer * 100-point scoring system with letter grades (A+ to F) * 20 individual checks across 5 categories * Access & AI Discovery (37 pts): robots.txt, AI bot directives, Content Signals, llms.txt, sitemap, RSS feed * Structured Data & Semantic Context (25 pts): JSON-LD schemas, Open Graph, Twitter Cards, meta description, canonical URL * Content Structure & Readability (20 pts): heading hierarchy, semantic HTML5, image alt text, content/HTML ratio * AI Interaction & Distribution (8 pts): markdown delivery, AI share buttons * Access Performance (10 pts): TTFB measurement * Smart recommendations with direct links to VigIA features and plugin suggestions * Analyze any page on your site with URL autocomplete selector * Results cached for 24 hours with manual re-analyze option Analytics Dashboard * Total visits, unique crawlers, and pages crawled statistics * Timeline chart with daily breakdown * Category distribution (AI Training, AI Search, AI Assistant, Data Scraper) * Top crawlers and most crawled pages tables with paginated navigation * Share Buttons & AI-powered Summaries integration: see share button clicks per page * Recent activity log with content type and HTTP status columns (color coded by status family) * Advanced filters: multi-select crawler picker, content type, HTTP status code, and configurable date range * Server-side pagination with four-button pager (first, previous, next, last) — operates over the full database, not just the latest 500 rows * Period comparison functionality * CSV export with a metadata banner (site name, site URL, export type, date range, export timestamp, applied filters) * “Export filtered CSV” button that downloads exactly what the active filters return, with vigia-filtered-YYYY-MM-DD.csv filename * Content type detection distinguishes Home, Post, Page, Product, custom CPTs, Category archive, Tag archive, Date/Author archive, Feed, Sitemap, REST API, File, Admin / login attempts (/wp-admin, /wp-login.php), WordPress system (admin-ajax, xmlrpc, wp-cron, wp-comments-post), 404 Not found, and Other Crawler Blocking * Block crawlers via PHP with 403 Forbidden response * Quick block dropdown in analytics dashboard * Manage blocks from Extras page * Works on any server (Apache, Nginx, LiteSpeed, etc.) Robots.txt Management * Add Disallow rules for AI crawlers * Visual preview of your robots.txt * Compliance monitoring: see which crawlers ignore your rules * One-click blocking for non-compliant crawlers * Works with both physical and virtual robots.txt Email Alerts * Daily, weekly, or monthly reports * Three detail levels: Minimal, Normal, Complete * Non-compliant crawler warnings * Activity comparison with previous period Markdown for Agents * Serve posts, pages and any public post type as optimized markdown for AI agents * Serve taxonomy archive pages (categories, tags, WooCommerce product categories, custom taxonomies) as markdown — disabled by default, opt in per taxonomy * Dedicated .md URL endpoints (e.g., /your-post.md, /category/news.md, /product-category/electronics.md) * Accept: text/markdown content negotiation on posts and taxonomy archive pages * Discoverability via Link HTTP headers and HTML tags * YAML frontmatter for posts: title, date, modified, author, image, categories, tags, post type, lang * YAML frontmatter for taxonomy terms: title, description, url, type, taxonomy, parent, count, image (term meta), lang * WooCommerce product frontmatter adds schema-like fields: sku, product_type, price, regular_price, sale_price, currency, availability, stock_quantity, rating, rating_count, review_count * Taxonomy term body includes the term description (rendered through the_content), the list of direct child terms in hierarchical taxonomies, and an excerpt of the latest posts/products assigned to the term * Product listings inside product_cat archives include an inline summary with formatted price, “was X” on sale items, star rating and out-of-stock flag * Respects blocking rules (blocked crawlers get 403) and LLMs.txt exclusion filters * Per-term noindex detection from Yoast SEO, Rank Math, All in One SEO and SEOPress * Analytics integration: tracks markdown requests per crawler * X-Markdown-Tokens response header * Filters: vigia_markdown_post_eligible, vigia_markdown_term_eligible, vigia_markdown_term_posts_limit * Follows the Cloudflare Markdown for Agents standard LLMs.txt Generator * Select content by post type with one click * Filter by taxonomies (categories, tags, custom) * Manual include/exclude with AJAX search * Exclude by URL patterns (wildcards supported) * SEO plugin integration (auto-exclude noindex content) * Auto-regeneration (daily, weekly, monthly) * Robots.txt integration (add llms.txt and llms-full.txt references) * Generate llms.txt and llms-full.txt files * Full content or excerpt mode * Compatible with Yoast SEO, Rank Math, All in One SEO, SEOPress, The SEO Framework, and Native SEO NoIndexer JSON-LD Structured Data * Generate WebSite and Organization/Person schema for site identity * AI Discovery: ReadAction pointers to llms.txt, llms-full.txt, and Markdown for Agents endpoints * Social profiles and sameAs links for brand identity across the web * SearchAction for Google sitelinks search box * Media library integration for logo selection * SEO plugin conflict detection (Yoast, Rank Math, AIOSEO, SEOPress, The SEO Framework) * Choose output page (front page or any published page) * Live JSON-LD preview with real-time updates * Smart integration with LLMs.txt and Markdown for Agents features Supported AI Crawlers VigIA monitors 60+ AI crawlers including: OpenAI: GPTBot, OAI-SearchBot, OAI-AdsBot, ChatGPT-User Anthropic: ClaudeBot, Claude-SearchBot, Claude-User, Claude-Code Google: Google-Extended, GoogleOther, Gemini-Deep-Research, Google-NotebookLM Perplexity: PerplexityBot, Perplexity-User Meta: Meta-ExternalAgent, FacebookBot, Meta-WebIndexer Amazon: Amazonbot, Amzn-SearchBot, bedrockbot Mistral: MistralAI-User, MistralAI-Index Microsoft: BingBot ByteDance: Bytespider Apple: Applebot-Extended And many more… Privacy Focused VigIA stores visitor data locally in your WordPress database. No data is sent to external servers. Abilities API VigIA is one of the first WordPress plugins to implement the Abilities API introduced in WordPress 6.9. This API allows AI agents, automation tools, and external systems to discover and interact with VigIA’s functionality in a standardized, secure way. What are Abilities? Abilities are self-contained units of functionality that VigIA exposes through WordPress’s central registry. Each ability has defined inputs, outputs, and permissions, making it easy for automation tools to understand and use them. Available Abilities VigIA registers the following abilities: Analytics vigia/get-crawler-stats – Get statistics about AI crawler visits (total visits, unique crawlers, pages crawled) vigia/get-top-crawlers – Get a ranked list of most active AI crawlers vigia/get-top-pages – Get the most crawled pages on your site Blocking vigia/get-blocked-items – List all blocked crawlers and IP addresses vigia/block-crawler – Block a crawler by User-Agent pattern vigia/unblock-crawler – Remove an existing block Robots.txt vigia/get-robots-rules – Get current AI crawler rules in robots.txt vigia/add-robots-disallow – Add a Disallow directive for a crawler vigia/remove-robots-rule – Remove a robots.txt rule Use Cases Automated monitoring: AI agents can query crawler statistics and alert you to anomalies Reactive blocking: Automation tools can block crawlers that repeatedly ignore robots.txt External dashboards: Aggregate data from multiple WordPress sites with VigIA installed WP-CLI integration: Future command-line access through the Abilities API n8n / Make workflows: Build custom automation flows using VigIA’s abilities Requirements The Abilities API ships with WordPress 6.9 and later. On older WordPress versions, VigIA works normally but abilities and MCP are not available. MCP Server (Model Context Protocol) VigIA exposes its 9 abilities as native MCP tools to any MCP-compatible client (Claude Code, Cursor, Claude Desktop, Codex CLI, Antigravity, Continue, Cline, Zed and similar) using the official WordPress MCP Adapter. The adapter ships bundled with the plugin, so the MCP endpoint is active right after installation — no Composer step or terminal access required. Requirements WordPress 6.9 or later (provides the Abilities API) Quick connect (recommended) Open VigIA > Extras > MCP and click “Generate password and connection commands”. The plugin creates a dedicated Application Password named VigIA MCP and renders ready-to-paste commands for Claude Code, Cursor, Claude Desktop and a generic block (URL + Authorization header) for any other MCP client. The plain password is shown only once. If you lose it, revoke the entry from the same panel and generate a new one. Endpoint https://your-site.example/wp-json/vigia/v1/mcp The endpoint uses HTTP Basic auth with the WordPress Application Password. The user must have the manage_options capability. Connecting Claude Code Quick Connect builds the full command for you. The shape is: claude mcp add --transport http vigia https://your-site.example/wp-json/vigia/v1/mcp --header "Authorization: Basic BASE64_OF_USER_AND_APP_PASSWORD" Claude Code merges the new entry into its config file automatically — no risk of breaking other servers. Connecting Cursor Save the JSON block from Quick Connect as ~/.cursor/mcp.json. You can also reach this file from inside Cursor at Settings → Cursor Settings → MCP. If the file already exists with other content, see the FAQ. Claude Desktop and other clients Claude Desktop does not speak HTTP MCP, so it needs a small bridge and a config file of its own. Any other client (Codex CLI, Continue, Cline, Antigravity, Zed, or your own) takes the two raw values Quick Connect exposes: the server URL and the Authorization header. Both cases are covered in the FAQ, together with how to merge VigIA into a config file that already exists without losing what is in it. Read-only mode If you only want your AI to consult VigIA (not change anything), enable “Read-only mode” in the MCP tab. While on, write actions (block, unblock, robots changes) return a permission denied error. Read actions (statistics, top crawlers, blocked items, robots rules) keep working. The toggle stores a vigia_mcp_read_only option that hooks into the vigia_can_write_via_abilities filter. Developers can still force read-only from a mu-plugin: add_filter( 'vigia_can_write_via_abilities', '__return_false' ); The mu-plugin filter at the default priority takes precedence over the toggle. Who can reach the endpoint The endpoint requires the capability to manage options, the same one every tool behind it already asked for. The vigia_mcp_transport_capability filter can lower that bar; each tool keeps its own permission check. After connecting Restart your MCP client after adding the server so it picks up the new tools. Then try a few prompts to confirm everything is wired up: “Show me VigIA crawler stats for the last 7 days.” “List the top 5 most crawled pages on this site.” “Add a robots.txt Disallow rule for TestBot and then list the current AI crawler rules.” The third example exercises a read + write + read round-trip, which is the most complete sanity check. Support Need private support or custom development? Do you need one-on-one help, priority troubleshooting, or a custom feature, integration, or tweak built specifically for your site? I offer private support and custom development. Just contact me and tell me what you need. Need help or have suggestions? Official website WordPress support forum YouTube channel Documentation and tutorials Love the plugin? Please leave us a 5-star review and help spread the word! About AyudaWP We are specialists in WordPress security, SEO, AI and performance optimization plugins. We create tools that solve real problems for WordPress site owners while maintaining the highest coding standards and accessibility requirements.