Spam Protection

The plugin includes built-in spam prevention that works without any configuration or third-party services.

Honeypot Field

Every form includes a hidden text field that is invisible to human visitors but visible to automated bots. If a bot fills in this field, the submission is silently discarded — the bot receives a fake “success” response so it doesn’t retry.

No configuration needed. This is always active.

Rate Limiting

Submissions are rate-limited per IP address:

• 20 submissions per 10 minutes from the same IP address (subscribe endpoint; update-subscriptions is 30/10min, unsubscribe 60/10min)
• After hitting the limit, submissions return “Too many requests. Please wait a moment and try again.”
• The limit resets after 10 minutes

Rate limits are stored as WordPress transients and require no configuration.

Nonce Verification

Every form submission includes a WordPress nonce token that is verified server-side. This prevents:

• Cross-site request forgery (CSRF) attacks
• Submissions from forms on other domains
• Direct POST requests without first loading the page

If the nonce is invalid or expired, the submission is rejected with a “Security check failed” message.

Email Validation

• Client-side: JavaScript validates the email format on blur (before submission)
• Server-side: PHP validates the email format using WordPress’s is_email() function

Invalid emails are rejected before any database operations occur.

What’s Not Included

These may be added in future versions:

• reCAPTCHA / hCaptcha — challenge-based verification for high-traffic sites
• IP blocklist — manual or automatic blocking of specific IPs

(Double opt-in is available — email confirmation before a sign-up becomes active — see Double Opt-in.)

• Email domain blocklist — blocking disposable email services

For most sites, the honeypot + rate limiting combination effectively blocks automated spam without any user friction.