Spam Protection
The plugin includes built-in spam prevention that works without any configuration or third-party services.
Honeypot Field
Every signup form includes a hidden text field that is invisible to human visitors but visible to automated bots. If a bot fills in this field, the submission is silently discarded – the bot receives a fake “success” response so it doesn’t retry.
No configuration needed. This is always active.
The honeypot deliberately returns a fake success response rather than an error. A bot that got a clear rejection would keep trying variations, so a convincing “thanks” makes it move on and leaves your logs clean.
Rate Limiting
Submissions are rate-limited per IP address:
- 20 submissions per 10 minutes from the same IP address (subscribe endpoint; update-subscriptions is 30/10min, unsubscribe 60/10min)
- After hitting the limit, submissions return “Too many requests. Please wait a moment and try again.”
- The limit resets after 10 minutes
Rate limits are stored as WordPress transients and require no configuration.
Nonce Verification
Every form submission includes a WordPress nonce token that is verified server-side. This prevents:
- Cross-site request forgery (CSRF) attacks
- Submissions from forms on other domains
- Direct POST requests without first loading the page
If the nonce is invalid or expired, the submission is rejected with a “Security check failed” message.
Email Validation
- Client-side: JavaScript validates the email format on blur (before submission)
- Server-side: PHP validates the email format using WordPress’s
is_email()function
Invalid emails are rejected before any database operations occur.
What’s Not Included
These may be added in future versions:
- reCAPTCHA / hCaptcha – challenge-based verification for high-traffic sites
- IP blocklist – manual or automatic blocking of specific IPs
(Double opt-in is available – email confirmation before a sign-up becomes active – see Double Opt-in.)
- Email domain blocklist – blocking disposable email services
For most sites, the honeypot + rate limiting combination effectively blocks automated spam without any user friction.
Turn on double opt-in for any public, high-traffic form. It stops a spam bot from stuffing your list with addresses it does not control, because nothing becomes an active subscriber until the address owner clicks the confirmation link.
Comments