{"id":160565,"date":"2022-07-27T20:28:37","date_gmt":"2022-07-27T20:28:37","guid":{"rendered":"https:\/\/wordpress.org\/plugins\/spamjam\/"},"modified":"2026-10-23T10:22:01","modified_gmt":"2026-10-23T10:22:01","slug":"spamjam","status":"publish","type":"plugin","link":"https:\/\/ta-lk.wordpress.org\/plugins\/spamjam\/","author":9532416,"comment_status":"closed","ping_status":"closed","template":"","meta":{"version":"3.3.0","stable_tag":"trunk","tested":"7.1.3","requires":"6.2","requires_php":"7.4","requires_plugins":null,"header_name":"SpamJam","header_author":"Utopique","header_description":"SpamJam prevents comments and registration spam.","assets_banners_color":"bc8c70","last_updated":"2026-10-23 10:22:01","external_support_url":"","external_repository_url":"","donate_link":"https:\/\/www.paypal.com\/cgi-bin\/webscr?cmd=_s-xclick&hosted_button_id=DNSC3NVBWR66L","header_plugin_uri":"https:\/\/utopique.net\/","header_author_uri":"https:\/\/utopique.net\/","rating":0,"author_block_rating":0,"active_installs":100,"downloads":4318,"num_ratings":0,"support_threads":0,"support_threads_resolved":0,"author_block_count":0,"sections":["description","installation","faq","changelog"],"tags":[],"upgrade_notice":{"3.3.0":"

Stronger comment validation, safer cached-form recovery, reliable moderation, and improved accessibility for multiple comment forms.<\/p>"},"ratings":[],"assets_icons":{"icon-128x128.png":{"filename":"icon-128x128.png","revision":2762608,"resolution":"128x128","location":"assets","locale":"","width":128,"height":128},"icon-256x256.png":{"filename":"icon-256x256.png","revision":2762608,"resolution":"256x256","location":"assets","locale":"","width":256,"height":256}},"assets_banners":{"banner-1544x500.png":{"filename":"banner-1544x500.png","revision":2762608,"resolution":"1544x500","location":"assets","locale":"","width":1544,"height":500},"banner-772x250.png":{"filename":"banner-772x250.png","revision":2762608,"resolution":"772x250","location":"assets","locale":"","width":772,"height":250}},"assets_blueprints":{},"all_blocks":[],"tagged_versions":[],"block_files":[],"assets_screenshots":[],"screenshots":{"1":"Protection dashboard with blocked-spam statistics","2":"Clear protection settings and license-aware controls","3":"Searchable spam inbox and review tools (Pro feature)"}},"plugin_section":[],"plugin_tags":[4867,598,212451,600,2419],"plugin_category":[54],"plugin_contributors":[78154,81304],"plugin_business_model":[],"class_list":["post-160565","plugin","type-plugin","status-publish","hentry","plugin_tags-comment-spam","plugin_tags-honeypot","plugin_tags-registration-spam","plugin_tags-security","plugin_tags-spam-protection","plugin_category-security-and-spam-protection","plugin_contributors-freemius","plugin_contributors-skyminds","plugin_committers-skyminds"],"banners":{"banner":"https:\/\/ps.w.org\/spamjam\/assets\/banner-772x250.png?rev=2762608","banner_2x":"https:\/\/ps.w.org\/spamjam\/assets\/banner-1544x500.png?rev=2762608","banner_rtl":false,"banner_2x_rtl":false},"icons":{"svg":false,"icon":"https:\/\/ps.w.org\/spamjam\/assets\/icon-128x128.png?rev=2762608","icon_2x":"https:\/\/ps.w.org\/spamjam\/assets\/icon-256x256.png?rev=2762608","generated":false},"screenshots":[],"raw_content":"\n

Spam should not create more work for you\u2014or more friction for your visitors.<\/p>\n\n

SpamJam quietly stops automated comment spam with layered, on-site checks. There are no CAPTCHAs to solve<\/strong>, no puzzles to frustrate readers, and no complicated setup before protection begins.<\/p>\n\n

Install it, activate it, and get back to running your site.<\/p>\n\n

Why Site Owners Choose SpamJam<\/h4>\n\n

\ud83d\udeab Less Spam to Moderate<\/strong> - Catch automated submissions before they clutter your comment queue.\n\ud83d\udc64 No Friction for Real People<\/strong> - Visitors can comment without image grids, challenges, or extra verification steps.\n\u26a1 Protected from Activation<\/strong> - Core comment protection is enabled by default, with sensible settings already in place.\n\ud83e\udde0 Fewer False Positives<\/strong> - Multiple signals work together; suspicious edge cases can be held for review instead of being discarded.\n\ud83e\ude76 Lightweight by Design<\/strong> - Focused checks run where they are needed, without loading a heavy front-end framework.\n\ud83d\udd12 Privacy-Conscious Detection<\/strong> - Core comment analysis runs on your WordPress site rather than sending comment content to a remote spam-scoring service.<\/p>\n\n

Free Comment Protection<\/h4>\n\n

The free version gives blogs, publishers, and WooCommerce stores a strong first line of defense:<\/p>\n\n

    \n
  • Per-site salted honeypot<\/strong> - An invisible, site-specific trap makes generic bot scripts easier to identify.<\/li>\n
  • Context-bound timing check<\/strong> - Uses a signed timestamp tied to the site, post, and comment or product-review context.<\/li>\n
  • Weighted spam scoring<\/strong> - Combines form, timing, token, and referrer signals instead of relying on one fragile test.<\/li>\n
  • Cache-safe moderation path<\/strong> - Preserves comments from stale cached forms and holds uncertain submissions for review instead of discarding them.<\/li>\n
  • Secure form validation<\/strong> - Nonces and time-boxed HMAC tokens help verify legitimate comment submissions.<\/li>\n
  • Built-in keyword blocklist<\/strong> - Stops common comment-spam patterns.<\/li>\n
  • WooCommerce product reviews<\/strong> - Protects review forms and declares compatibility with WooCommerce HPOS.<\/li>\n
  • No-JavaScript fallback<\/strong> - Missing JavaScript is only a limited signal and does not block or hold a submission by itself.<\/li>\n
  • Dashboard statistics<\/strong> - See the protection working from your WordPress admin.<\/li>\n<\/ul>\n\n

    No account or API key is required to start protecting comments.<\/p>\n\n

    Go Beyond Comments with SpamJam Pro<\/h4>\n\n

    When spam reaches registrations, contact forms, or a high-traffic site, SpamJam Pro adds the control and visibility you need:<\/p>\n\n

      \n
    • Protection for popular form plugins<\/strong> - Cover Contact Form 7, WPForms, Gravity Forms, Elementor Forms, Fluent Forms, Formidable Forms, Ninja Forms, and WooCommerce registration with bounded payload validation, the core blocklist, and source-aware rules.<\/li>\n
    • Actionable spam inbox<\/strong> - Search and filter events, review false positives, restore recoverable comments, allow trusted senders, and use bulk actions.<\/li>\n
    • Source-aware rules<\/strong> - Allow, moderate, block, or discard submissions using conditions tailored to each protected source.<\/li>\n
    • Registration protection<\/strong> - Add honeypot checks and email confirmation to WordPress registrations.<\/li>\n
    • Flood and content controls<\/strong> - Set rate limits, minimum comment length, maximum links, and your own blocked terms.<\/li>\n
    • Targeted blocking<\/strong> - Block configured IP addresses, email addresses, domains, or countries while allowlisting trusted senders.<\/li>\n
    • Reports and analytics<\/strong> - Understand trends, sources, repeat signals, and false positives; receive weekly summaries or export PDF reports.<\/li>\n
    • Professional site tools<\/strong> - Add an automatically updated extended blocklist, multisite synchronization, and white-label controls.<\/li>\n<\/ul>\n\n

      Every Pro feature is included. Choose a license based only on the number of sites you manage from SpamJam's Account screen in your WordPress dashboard.<\/p>\n\n

      Built for the Sites Spam Targets<\/h4>\n\n

      SpamJam is a practical fit for:<\/p>\n\n

        \n
      • Blogs and publications with open comments<\/li>\n
      • WooCommerce stores collecting product reviews<\/li>\n
      • Membership and community sites accepting registrations<\/li>\n
      • Lead-generation sites using popular form plugins<\/li>\n
      • Agencies managing protection across multiple WordPress sites<\/li>\n<\/ul>\n\n

        How SpamJam Stops Bots<\/h4>\n\n

        SpamJam looks for the patterns automated submissions leave behind:<\/p>\n\n

          \n
        1. A site-specific hidden field catches bots that fill every input.<\/li>\n
        2. A signed timestamp identifies implausibly fast submissions.<\/li>\n
        3. Secure tokens and referrer checks test whether the request came through the expected form flow.<\/li>\n
        4. A built-in blocklist catches common spam content.<\/li>\n
        5. A weighted scoring engine combines those signals and decides whether to allow, hold, or block the submission.<\/li>\n<\/ol>\n\n

          Real visitors keep the familiar WordPress comment experience. The protection stays in the background.<\/p>\n\n

          Privacy & Data Handling<\/h4>\n\n

          Core comment detection is performed on your site and does not require a remote content-scoring service. SpamJam stores minimal blocked-event metadata locally for dashboard statistics and removes old events after the configured retention period. Personal recovery data is off by default; if you enable it, SpamJam excludes passwords, nonces, security tokens, CAPTCHA values, and CSRF fields from recoverable form data.<\/p>\n\n

          Some optional licensing, update, geographic blocking, and premium blocklist features connect to external services when used. Review your site's privacy obligations and enabled settings as you would with any WordPress plugin.<\/p>\n\n\n

            \n
          1. In WordPress, go to Plugins > Add New<\/strong>.<\/li>\n
          2. Search for SpamJam<\/strong>.<\/li>\n
          3. Click Install Now<\/strong>, then Activate<\/strong>.<\/li>\n
          4. Your comment forms are protected immediately. Open SpamJam<\/strong> in the admin menu to review statistics or adjust settings.<\/li>\n<\/ol>\n\n

            You can also upload the plugin ZIP from Plugins > Add New > Upload Plugin<\/strong>.<\/p>\n\n\n

            \n

            Does SpamJam work immediately after activation?<\/h3><\/dt>\n

            Yes. Core comment protection is enabled by default with sensible settings. You can fine-tune it from the SpamJam admin screen, but you do not need to configure an API key or build rules before getting protection.<\/p><\/dd>\n

            Will this slow down my site?<\/h3><\/dt>\n

            SpamJam is designed to stay focused and load its comment-protection script only on pages where comments are open. It has no jQuery dependency, and premium feature files load conditionally when their features are enabled.<\/p><\/dd>\n

            Will my users see captchas?<\/h3><\/dt>\n

            No. SpamJam's core protection uses hidden traps, secure tokens, timing, and request signals instead of CAPTCHA challenges.<\/p><\/dd>\n

            Does this work with my theme?<\/h3><\/dt>\n

            SpamJam works with standard WordPress comment forms and includes a fallback selector for themes that use a custom form ID. A developer filter is available for unusual comment-form markup.<\/p><\/dd>\n

            Does SpamJam work with full-page caches and CDNs?<\/h3><\/dt>\n

            Yes. SpamJam does not require a page-load AJAX or REST request. Current forms can be approved normally, while authentic stale forms from page caches such as WP Rocket or Cloudflare APO preserve the comment and use WordPress moderation when token freshness cannot be confirmed. Purge cached HTML after changing the site URL or WordPress security salts.<\/p><\/dd>\n

            Is this compatible with WooCommerce?<\/h3><\/dt>\n

            Yes. The free version protects WooCommerce product review forms and declares compatibility with High-Performance Order Storage (HPOS). SpamJam Pro can also protect WooCommerce account registration.<\/p><\/dd>\n

            What's the difference between Free and Pro?<\/h3><\/dt>\n

            Free focuses on automatic comment and product-review protection. SpamJam Pro adds registration and third-party form coverage, custom rules, an actionable spam inbox, targeted blocking, deeper analytics, reporting, multisite synchronization, and white labeling. Every Pro license includes the complete feature set; licenses differ only by the number of sites covered.<\/p><\/dd>\n

            How does geographic blocking work?<\/h3><\/dt>\n

            SpamJam Pro can block comments from selected country codes. When enabled, SpamJam uses an external IP geolocation lookup and caches the result to reduce repeat requests.<\/p><\/dd>\n

            What is rate limiting?<\/h3><\/dt>\n

            Rate limiting caps how many comment submissions one IP address can make during a configurable period. It helps contain bursts without changing the experience for ordinary commenters.<\/p><\/dd>\n

            Can I see what spam was blocked?<\/h3><\/dt>\n

            SpamJam Pro adds a searchable inbox for blocked events, reasons, sources, and review status. You can configure retention and choose whether to keep the minimum recovery data needed to restore a false-positive comment.<\/p><\/dd>\n

            Does this work with other anti-spam plugins?<\/h3><\/dt>\n

            It may, but running multiple plugins that modify or validate the same comment form can create duplicate checks or conflicts. Test the combination on a staging site and avoid overlapping protection where possible.<\/p><\/dd>\n

            Will SpamJam block legitimate comments?<\/h3><\/dt>\n

            No anti-spam system can promise zero false positives. SpamJam reduces the risk by combining several signals and holding suspicious edge cases for moderation when appropriate. SpamJam Pro adds false-positive review and recovery tools.<\/p><\/dd>\n

            Do you offer support?<\/h3><\/dt>\n

            Free users can use the WordPress.org support forum. SpamJam Pro customers can contact priority support.<\/p><\/dd>\n

            Is my data sent to third parties?<\/h3><\/dt>\n

            Core comment detection runs locally and does not require sending comment content to a remote scoring API. Optional features may connect to external services, and optional logs are stored in your WordPress database. See the Privacy & Data Handling section above and assess the settings you enable for your own privacy requirements.<\/p><\/dd>\n\n<\/dl>\n\n\n

            3.3.0 - 2026-10-23<\/h4>\n\n
              \n
            • Security - Validates comment trap and token types, lengths, and formats; detects filled \"0\" traps; and binds signed timing tokens to the site, post, and comment or review context.<\/li>\n
            • Compatibility - Preserves comment text from expired cached forms and sends uncertain submissions to moderation without adding a refresh request.<\/li>\n
            • Moderation - Checks subscriber and customer comments, retains trusted moderator bypasses, and preserves earlier spam, trash, and error decisions.<\/li>\n
            • Accessibility - Uses unique hidden-trap IDs, preserves theme textarea IDs, and scopes JavaScript to each comment form.<\/li>\n
            • Diagnostics - Separates stable observed-signal codes from final decisions without logging successful comments, raw tokens, or comment bodies.<\/li>\n
            • Quality - Adds controlled-clock comment regressions, generated-markup checks, and multiple-form JavaScript coverage.<\/li>\n
            • Integrations - Hardens all advertised Pro form adapters and registration fields against malformed or oversized values, applies the core blocklist to normalized form content, and reports detected versus enabled integrations accurately.<\/li>\n
            • Settings - Aligns country lists, IPv6 CIDR validation, rate-limit defaults, detection fallback registration, blocklist validation, and protection descriptions across the admin UI and runtime.<\/li>\n<\/ul>","raw_excerpt":"Block comment and form spam without CAPTCHAs. Lightweight honeypot protection works automatically and keeps real visitors moving.","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/ta-lk.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin\/160565","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/ta-lk.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin"}],"about":[{"href":"https:\/\/ta-lk.wordpress.org\/plugins\/wp-json\/wp\/v2\/types\/plugin"}],"replies":[{"embeddable":true,"href":"https:\/\/ta-lk.wordpress.org\/plugins\/wp-json\/wp\/v2\/comments?post=160565"}],"author":[{"embeddable":true,"href":"https:\/\/ta-lk.wordpress.org\/plugins\/wp-json\/wporg\/v1\/users\/skyminds"}],"wp:attachment":[{"href":"https:\/\/ta-lk.wordpress.org\/plugins\/wp-json\/wp\/v2\/media?parent=160565"}],"wp:term":[{"taxonomy":"plugin_section","embeddable":true,"href":"https:\/\/ta-lk.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_section?post=160565"},{"taxonomy":"plugin_tags","embeddable":true,"href":"https:\/\/ta-lk.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_tags?post=160565"},{"taxonomy":"plugin_category","embeddable":true,"href":"https:\/\/ta-lk.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_category?post=160565"},{"taxonomy":"plugin_contributors","embeddable":true,"href":"https:\/\/ta-lk.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_contributors?post=160565"},{"taxonomy":"plugin_business_model","embeddable":true,"href":"https:\/\/ta-lk.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_business_model?post=160565"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}