Spam Eater quietly checks every protected form submission and blocks the ones sent by bots. Real visitors never see a puzzle or a CAPTCHA, and nothing is sent to an outside service. Each submission goes through up to four checks: Honeypot – a hidden field that people never see, but bots fill in. Jav
PricingFree downloadThe WordPress.org download is free. Pro versions, add-ons or external services may cost extra.
CompatibilityRequires WordPress 6.0 and PHP 7.4.
SourceWordPress plugins · Oct 18, 2026
01 / Source details
About this tool.
Spam Eater quietly checks every protected form submission and blocks the ones sent by bots. Real visitors never see a puzzle or a CAPTCHA, and nothing is sent to an outside service.
Each submission goes through up to four checks:
01Honeypot – a hidden field that people never see, but bots fill in.
02JavaScript token – set by a small script, so bots that don’t run JavaScript are caught.
03Timing – forms sent within three seconds of loading, or from a page that is too old, are rejected.
04Interaction – a mouse, keyboard, touch or scroll event must have happened on the page.
Login forms only use the honeypot check, so password managers and visitors without JavaScript can still log in.
IP addresses that keep filling in the hidden honeypot field are blocked for a while (5 times and 24 hours by default, both adjustable). While blocked, an address can’t send any protected form. It can still log in, so a shared address can never lock you out of your own site.
Also included, all running on your own server
Your own words and patterns to block , for spam that people type by hand: words, links or regular expressions, checked in memory as the form arrives and never stored.
Turn away throwaway email addresses , using a list of disposable email domains that comes with the plugin, so no address is ever sent anywhere to be checked.
Always allow and Always block lists of IP addresses and ranges (CIDR, IPv4 and IPv6).
Slow down password guessing : repeated failed logins for one username from one address wait a little longer each time, without ever locking out the real owner.
A spam summary on the Dashboard with the last 30 days, and an optional weekly email.
Test a form as a bot : administrators get a button under each protected form that sends it as a bot would and reports whether Spam Eater refused it.
WP-CLI commands for statistics, unblocking, settings and the allow and block lists.
The optional extras are off until you turn them on.
Protected forms
WordPress comments, login, registration and lost password forms (and plugins that use them, such as Theme My Login and WooCommerce reviews)
WooCommerce classic checkout and Checkout block, including card-testing bots that post to the Store API (express payment buttons keep working), Pay for Order, and My Account login, registration, lost password and account details
Contact Form 7, Gravity Forms, WPForms, Formidable Forms, Fluent Forms, Ninja Forms, Forminator, HTML Forms, QuForm, Clean and Simple Contact Form, Jetpack Forms, Kadence Forms, WS Form, JetFormBuilder, SureForms and Everest Forms
Elementor Pro forms, Bricks Builder forms and the Beaver Builder contact form
bbPress, BuddyPress (and BuddyBoss, Youzify), Ultimate Member, UsersWP, wpDiscuz, MemberPress and Paid Memberships Pro
MC4WP (Mailchimp for WordPress), MailPoet, Brevo, Easy Digital Downloads checkout and GiveWP (option-based donation forms)
Your own forms, through three developer functions (see the FAQ)
Each integration can be turned off under Settings → Spam Eater. Integrations only load when the matching plugin is active, and the small script only loads on pages that show a protected form.
Privacy
No cookies, no tracking and no calls to outside services.
What people type into forms is never stored.
The IP block list keeps a one-way hash of each address plus an anonymised version for display, and entries expire automatically.
The spam log is off by default. When turned on, it records only the time, reason, page and an anonymised IP address, and keeps entries for 30 days.
The spam summary keeps only daily counts per reason: no addresses or contents.
The login throttle (off by default) keeps a keyed hash of the address and username of failed logins, for an hour at most.
Addresses you type into Always allow, Always block and Trusted proxies are kept as you typed them.
Suggested text is added to Settings → Privacy for your privacy policy.
Credits
Disposable email domains: the disposable-email-domains project, https://github.com/disposable-email-domains/disposable-email-domains, CC0 1.0 Universal.
Check engine ( includes/engine/ ): Spam Eater for PHP forms, https://github.com/scratchy-76/spam-eater-php, by AccessNow, MIT licence (GPL-compatible).
See it in action
Screenshots & previews.
Choose which forms to protect. Forms from plugins that aren't active are listed but can't be ticked.IP blocking and trusted proxies, Always allow and Always block lists, your own words and patterns, throwaway emails, slowing down password guessing, and privacy options.Blocked addresses (anonymised) with an Unblock button, and the optional log of blocked submissions with the reason for each.
02 / Source details
Getting started.
01Upload the accessnow-spam-eater folder to /wp-content/plugins/ , or install the ZIP through Plugins → Add New → Upload Plugin.
02Activate the plugin.
03Go to Settings → Spam Eater to check which integrations are on (they are all on by default).
04If your site sits behind a reverse proxy, load balancer or CDN such as Cloudflare, add the proxy addresses under Trusted proxies . Otherwise every visitor looks like they come from the proxy, and blocking one would block everyone.
03 / Source details
Frequently asked questions.
Where do I get help?
Step-by-step help articles, with screenshots, are at https://support.accessnow.com.au/help/workspace-accessnow/accessnow-spam-eater. The plugin’s own screens link to the article for each one, under the Help tab at the top right. To ask a question, use Get support on https://accessnow.com.au/projects/spam-eater/.
Does it work with page caching?
Yes. The hidden fields work on cached pages. If a cached page is more than about 12 hours old, the script fetches fresh tokens from your own site (admin-ajax.php) before the form is sent. Tokens last up to two days; developers can change this with the accessnow_spam_eater_token_lifetime filter.
A form in a pop-up is refused with reference SE-C2. Why?
The script loads only on pages that show a protected form. If a form is fetched after the page loads, for example a pop-up that loads its content when opened, the page had no form to begin with and the script never loaded. Turn on Load the Spam Eater script on every page under Settings → Spam Eater.
Do Apple Pay, Google Pay and other express payment buttons still work?
Yes. Some payment gateways place the order through their own endpoint, with their own data, instead of the checkout form. Spam Eater recognises those orders and only applies the IP block list and honeypot checks to them.
Can I protect my own forms?
Yes. Print the hidden fields inside your form, and check the submission where you handle it:
Send the form as normal form data (a regular POST, or FormData through fetch() or a REST route), not as a JSON body. Multi-step forms send the fields with every step. If your form is drawn in the browser after the page loads, call window.accessnowSpamEater.fill() once it is in the page. The functions are documented in includes/api.php , and can be switched off under Settings → Spam Eater → Custom forms.
Does it send any data to other services?
No. All checks run on your own server.
My site is behind Cloudflare or another proxy. What should I do?
Add the proxy IP addresses or ranges (for example 173.245.48.0/20 ) under Settings → Spam Eater → Trusted proxies, one per line. Spam Eater then reads the visitor’s address from the X-Forwarded-For header, but only for requests that come from those proxies. The settings page shows the address your own request came from, which helps you tell whether a proxy is in use.
A real visitor was blocked. How do I help them?
The error message includes a short reference code (for example SE-C2). Turn on the spam log to see why submissions are blocked, and use the Unblock button in the blocked IP list if needed. Only a filled-in honeypot field counts towards an IP block, so a visitor whose browser failed another check can simply try again.
Does it cover the WooCommerce block checkout?
Yes, since 2.4.0. The script adds its values to the order the Checkout block sends through WooCommerce’s Store API, and the order is checked before it is created, so card-testing bots that post straight to the Store API are refused. Express payment buttons in the Checkout and Cart blocks that use WooCommerce’s own checkout flow send the same values. If a gateway’s express button posts its own data and is refused with SE-C2, developers can give it the lighter checks with the accessnow_spam_eater_store_api_context filter.
Can I block spam that people type themselves?
Yes. List words, links or /regular expressions/ under Settings → Spam Eater → Your own rules. A matching submission is refused with reference SE-K5. What people type is only checked in memory and never stored.
Where does the list of throwaway email domains come from?
From the disposable-email-domains project (https://github.com/disposable-email-domains/disposable-email-domains), released under CC0 1.0 (public domain). A copy ships with the plugin in includes/data/disposable-domains.txt and is refreshed with each release; nothing is looked up online. Developers can change it with the accessnow_spam_eater_disposable_domains filter.
Can the login throttle lock me out?
No. It only slows down one username from one address, a successful login clears it, the longest wait is 15 minutes, addresses under Always allow are never made to wait, and Lost your password? keeps working. It is off until you turn it on.
Which forms can’t it protect?
GiveWP donation forms made with its visual form builder (they only send the fields GiveWP knows about) and the Divi contact form (Divi has no step where another plugin can refuse a message with an error). Option-based GiveWP forms are protected.
I use an earlier version in the “spam-eater” folder. How do I update?
Up to version 2.2 the plugin was called Spam Eater by AccessNow and lived in a spam-eater folder. Install AccessNow Spam Eater and activate it, then press Deactivate the older copy in the notice that appears (or deactivate it on the Plugins screen). AccessNow Spam Eater takes over with the same settings, block list and statistics. Then delete the older copy. If “Delete all Spam Eater settings and statistics when the plugin is deleted” is ticked, untick it before deleting the older copy, because the settings are shared.
What happens to my data if I delete the plugin?
The IP block list and spam log are always deleted. Settings and statistics are only deleted if you tick “Delete all Spam Eater settings and statistics when the plugin is deleted” on the settings page.
Website LLMs.txt and LLMs-Full.txt Generator is an LLMs.txt generator and llms-full.txt generator for WordPress. It helps site owners generate, manage, preview, validate, and serve AI discovery files from published public content. Use it to create structured /llms.txt and optional /llms-full.txt end
EngageDock AI is a customizable floating contact widget for WordPress websites that want more leads and faster visitor communication. It helps small businesses turn website traffic into calls, texts, emails, and callback requests from one clean contact panel. Key Features: Click-to-Call – One tap ca
Altify AI is an auto ALT text and AI ALT text plugin for WordPress images. It helps generate descriptive image ALT text for accessibility and image SEO. Use bulk image ALT text tools for your Media Library, generate featured image ALT text automatically, and scale WooCommerce image ALT updates with
The Accepted Payment Methods plugin is a straightforward, lightweight solution that enhances your website by displaying visually appealing icons of the payment methods you accept. This plugin is ideal for a variety of websites, including e-commerce platforms, service-oriented websites, and informati
