SpamKill – No-CAPTCHA, No-Signup Anti-Spam & Spam Protection for Comments & Reviews for WooCommerce

Not ready to switch? You don’t have to. SpamKill runs happily alongside Akismet, so you can try it without removing anything.

Spam protection without CAPTCHA

CAPTCHAs and reCAPTCHA make your visitors solve a puzzle to compensate for bots’ behavior — and every puzzle costs you real comments, reviews, and leads. Honeypot plugins are friendlier, but modern headless-browser bots and human spam farms walk straight through them. And if you’re still getting spam with reCAPTCHA enabled, you’ve already seen the problem: solver services crack puzzles for pennies.

SpamKill is a true reCAPTCHA alternative, not another puzzle: your form is served through the SpamKill cloud, where behavioral analysis screens every submission before it reaches your site. Real visitors notice nothing. There is nothing to solve, click, or check — and your real visitors’ data is never stored by SpamKill (see External Services below).

Stop fake WooCommerce review spam

WooCommerce product reviews are WordPress comments underneath — and bots know it. Fake reviews damage buyer trust and your store’s credibility. SpamKill covers product review forms out of the box, on the free tier, with the same invisible screening as comments. Comment-spam channels that bypass the form entirely (pingbacks/trackbacks, anonymous REST/XML-RPC submissions) are rejected too while protection is on.

See it working

• A live protection status on the settings page
• A blocked-spam counter on your dashboard — see how much spam never reached your moderation queue
• A note on the Comments screen showing what was stopped this week

Contact form spam too? That’s SpamKill Pro (optional)

Everything above is free, forever. If spam bots and fake leads are also hitting your contact forms and lead gen forms — poisoning your email list and polluting your CRM — SpamKill Pro adds the same invisible, no-CAPTCHA form spam protection to Contact Form 7, WPForms, Gravity Forms, Elementor Forms, Divi, Formidable Forms, Forminator, Fluent Forms and Everest Forms — plus any custom HTML or AJAX form. In beta: Thrive Leads, Bloom, Bricks Forms, MailerLite.

• Free: WordPress comment form, WooCommerce product reviews, email typo suggestions
• Pro: form builders (Contact Form 7, WPForms, Gravity Forms, Elementor Forms, Divi, Formidable Forms, Forminator, Fluent Forms, Everest Forms) and any custom / AJAX form

Try Pro free for 30 days — no card needed.

External Services

SpamKill is a cloud service; this plugin is the connector. It talks to three endpoints, all operated by SpamKill (spamkill.co):

• api.spamkill.dev — when a protected form is first rendered, the form’s HTML structure is sent here to generate the protected version. Pro license keys are verified here. Free-tier sites are identified by their domain name.
• protect.spamkill.dev — submissions to protected forms (including the visitor’s name, email address, IP address, and message content) route through this endpoint for spam screening before being delivered to your site. The data is processed solely to determine whether the submission is spam.
• console.spamkill.co — once protection is on (or a Pro license key is set), the plugin asks this endpoint how many spam attempts SpamKill has blocked for your site, to show on your dashboard. It sends only your site’s host name (for example, example.com) — no license key, personal data or form content — at most about twice a day, and only from the WordPress admin or a scheduled WordPress task. Like every request made through the WordPress HTTP API, it also carries WordPress’s standard User-Agent (WordPress version and site URL).

Your real visitors’ personal data is never stored. Legitimate submissions are analyzed in real time, delivered to your site, and discarded from SpamKill’s end — their names, email addresses, IP addresses, and message content are not retained on SpamKill’s servers. For submissions identified as spam , SpamKill keeps aggregated frequency data only — counts of how often a given name, email address, or message has been seen — which improves detection for everyone. Per-domain submission counts are also kept to power your dashboard statistics.

By activating comment/review protection you agree to this data flow. See SpamKill’s Terms of Service and Privacy Policy . Suggested wording for your own privacy policy is provided under Settings → Privacy.