Description

Booker Privacy Spam Guard protects Elementor forms and the native WordPress comment form from spam without unnecessarily processing personal data. It is built specifically for Elementor users: the classic Elementor Pro Form widget gets the full feature set, and the WordPress comment form is covered as well. The new Atomic Form widget receives content checks, rate limiting, auto-ban and local proof of work based on the global default protection level; per-form honeypot and time checks are not yet available for its newer editor control system.

Invisible honeypot field with a random field name that is unique per installation
Time-based plausibility check via a signed, tamper-proof time window
Server-side nonce integrity check per form
Content heuristic: blocks entries with too many links or your own spam keywords
Rate limiting based on a pseudonymous, daily-rotating fingerprint (no raw data such as IP addresses is stored)
Automatic ban for fingerprints that repeatedly stand out (threshold and time window configurable)
Local adaptive SHA-256 proof-of-work challenge with no external service, cookies or visible puzzle
Per-form protection levels (Off / Basic / Standard / Strict)
Statistics overview with a 14-day history chart and a list of blocked requests in the WordPress admin
Ready-to-use text snippet for your privacy policy, including integration with WordPress’ built-in Privacy Policy Guide
Configurable client IP detection for sites behind a reverse proxy, load balancer or CDN (e.g. Cloudflare), with a trusted-proxy list to prevent spoofing
Cache- and CDN-friendly: the timing token and nonce are refreshed on page load from a non-cached endpoint, so full-page or edge caches never serve visitors a stale token
No cookies, no external requests, no subscription costs

The built-in local proof-of-work provider uses the challenge extension points; optional alternative providers can be registered through the same interface.

The plugin’s privacy-friendly, data-minimal design does not, on its own, make your entire website legally compliant – that depends on many other factors and remains your responsibility.

Installation

Upload the plugin folder to wp-content/plugins/, or install it as a ZIP via the WordPress admin.
Activate the plugin.
Elementor (free or Pro) must be active; the actual form processing requires Elementor Pro.
Under “Booker Tools” “Privacy Spam Guard” the “Settings” tab, set the default protection level, proof-of-work mode, retention period, your own spam keywords and the auto-ban threshold.
In the Elementor editor, the protection level can be adjusted per form under “Additional Options”.
Copy the privacy policy text snippet at the bottom of the settings page, or import it into your own privacy page via Settings Privacy “Load suggested content”.

FAQ

Are any cookies set?: No. The fingerprint is generated exclusively server-side from a shortened IP address, the user agent and a secret-derived value that changes daily – without cookies or local storage. As an online identifier, the fingerprint should nevertheless be treated as pseudonymous data.
Is any data sent to third parties?: No. No external HTTP requests are made.
Why do I see no effect without Elementor Pro?: The actual form processing (submission, validation, sending) is part of Elementor Pro. Without an active Elementor Pro, the plugin does not register any of its checks for Elementor forms. The native WordPress comment form is still protected.
What happens during an automatic ban?: If a pseudonymous fingerprint is blocked more often than the configured threshold (default: 8) within the configured time window (default: 24 hours), further requests from it are rejected automatically – even if an individual request would look harmless on its own. Daily fingerprints within the rolling window are checked together, including across UTC day boundaries. The ban expires by itself once the old entries fall out of the window; it can be disabled or adjusted in the settings.
Are the nonce and timing token a CAPTCHA replacement?: No. They reject malformed requests and simple automated submissions, but are deliberately available to real visitors on public, cached pages and therefore are not secrets. The local proof-of-work challenge adds a short-lived, fingerprint- and form-bound calculation that makes replay and mass submissions more expensive. Honeypot, content checks, rate limiting and auto-ban remain additional layers.
Does proof of work require JavaScript?: Yes. When the local proof-of-work challenge is enabled, visitors need JavaScript to submit a protected form. The calculation runs in a Web Worker so that the page remains responsive. You can disable the challenge under the plugin settings if a no-JavaScript submission path is required.
Is the privacy policy text snippet legally binding?: No, it is a wording suggestion, not legal advice. Please review it before use and adapt it to your own privacy policy.
Does “GDPR” mean my website is automatically GDPR-compliant?: No. The plugin is built to be particularly data-minimal itself (no cookies, no external services, pseudonymous daily fingerprints). The legal compliance of your entire website depends on many other factors and remains your responsibility.
My site runs behind Cloudflare or a reverse proxy. What should I configure?: Under Settings, set “Client IP detection” to the matching header (e.g. CF-Connecting-IP for Cloudflare) and enter your proxy’s IP addresses or ranges in the trusted-proxy list. A forwarded header is only trusted when the request comes from one of those addresses, which prevents attackers from spoofing IPs to bypass rate limiting.

Reviews

There are no reviews for this plugin.

Contributors & Developers

“Booker Privacy Spam Guard” is open source software. The following people have contributed to this plugin.

booker GmbH

Translate “Booker Privacy Spam Guard” into your language.

Interested in development?

Browse the code, check out the SVN repository, or subscribe to the development log by RSS.

Changelog

1.6.6

Fixed: admin styles and scripts now use the actual page hooks returned by WordPress, ensuring they load reliably after the unique menu-prefix migration.

1.6.5

WordPress.org compatibility: all declarations, stored data, REST routes, script handles and browser globals now use the unique bookprsp prefix.
Compatibility: existing settings, fingerprint secrets, honeypot state and statistics are migrated automatically from the former short prefix.
Internationalization: locale-specific PO/MO files are no longer bundled; translations are delivered through translate.wordpress.org.

1.6.4

Changed: renamed the plugin to Booker Privacy Spam Guard and aligned the WordPress.org slug, text domain and package names with booker-privacy-spam-guard.
Compatibility: existing settings, statistics, database tables, filters and PHP extension points remain unchanged during the rename.

1.6.3

Fixed: signed public-form integrity tokens are no longer tied to the WordPress login session, so submissions by logged-in visitors are accepted correctly.
Fixed: the integrity token is refreshed before every submission without resetting the minimum-time check.

1.6.2

Fixed: every submission attempt now receives a fresh single-use proof, so retrying after an Elementor field-validation or action error no longer triggers replay protection.
Fixed: technical challenge, timing and nonce failures no longer contribute to auto-ban, and auto-ban rejections no longer extend their own ban window.

1.6.1

Fixed: Elementor popup forms now initialize their own proof-of-work state after Elementor clones the popup template, preventing submissions with an empty proof.

1.6.0

New: local adaptive SHA-256 proof-of-work challenge calculated in a Web Worker, with no cookies, visible puzzle or external provider.
Security: challenges are signed, bound to the form and daily fingerprint, expire after a short period and are protected against replay.
Adaptive protection: recent blocked attempts increase the required work; Basic and Strict protection levels adjust the baseline automatically.
Integration: classic Elementor forms, Atomic Forms and native WordPress comments are supported without adding proof fields to submitted form content.
New settings for challenge mode and base difficulty, plus automatic refresh for forms left open for a longer period.
Privacy policy wording and German translations updated for the local calculation.

1.5.1

Fixed: the site-wide default protection level now applies to new and legacy classic Elementor forms without an explicit per-form value.
Fixed: Atomic Forms on the same page now use their individual Elementor form IDs for rate limiting and statistics.
Fixed: content checks no longer fail on hosts without the optional PHP mbstring extension.
Fixed: auto-ban now evaluates daily fingerprints together across UTC day boundaries for the complete configured rolling window.
Privacy: documentation and suggested privacy-policy wording now correctly describe the fingerprint as pseudonymous data.
Documentation: clarified that public nonce and timing tokens are anti-automation layers, not secret CAPTCHA replacements.

1.5.0

New: built-in spam word list, checked in addition to your own keywords. Terms are matched as whole words (so “loan” cannot match inside “download”), the list is filterable via bookprsp_default_spam_keywords, and it can be switched off in the settings.
New: the honeypot field name now rotates periodically (weekly by default, filterable via bookprsp_honeypot_rotation), so a bot cannot memorize it permanently. The previous name stays valid for detection, so pages still served from a cache keep working.

1.4.0

New: submissions without a page URL are blocked. Elementor’s own form script always posts the page URL; a submission without it did not come from a rendered page and is a reliable bot indicator (posting straight to admin-ajax.php).
New: link shorteners (bit.ly, tinyurl.com, cutt.ly, …) are detected as a spam signal. The list is filterable via bookprsp_link_shorteners; hosts are matched exactly, so unrelated domains cannot false-match.
Changed: the link threshold at protection level Standard is now 2 (was 3).
Security: the timing token’s fallback lifetime is now 2 hours (was 24). Real visitors get a freshly minted token via the non-cached endpoint anyway, so this mainly shrinks the window in which a token scraped from a cached page could be replayed.

1.3.0

New: cache/CDN compatibility. The timing token and nonce are now refreshed on page load from a non-cached REST endpoint, so full-page or edge caches (e.g. Cloudflare) can no longer serve visitors a frozen, expired token. Falls back gracefully to the server-rendered token when JavaScript is unavailable.
Improved: the timing token’s maximum age is now generous and filterable (bookprsp_timing_max_seconds) to avoid false-blocking real visitors on long-cached pages.

1.2.1

New: intro/welcome section on the statistics page that explains the plugin’s purpose and benefits at a glance.

1.2.0

New: configurable client IP detection for sites behind a reverse proxy, load balancer or CDN (e.g. Cloudflare), including a trusted-proxy list (IP/CIDR) to protect against spoofed headers.
New: automatic database upgrade path that keeps the schema up to date on plugin updates.
Menu structure: all views now grouped under “Booker Tools Privacy Spam Guard” with tabs for statistics and settings.

1.1.0

New: content heuristic (too many links, your own spam keywords) as an additional criterion.
New: automatic ban for repeatedly blocked fingerprints (threshold/time window configurable).
New: 14-day history chart on the statistics page.
New: ready-to-use privacy policy text snippet, including integration with the WordPress Privacy Policy Guide.

1.0.0

Initial release: honeypot, time check, nonce check, rate limiting, per-form protection levels, statistics page.

Description

Installation

FAQ

Are any cookies set?

Is any data sent to third parties?

Why do I see no effect without Elementor Pro?

What happens during an automatic ban?

Are the nonce and timing token a CAPTCHA replacement?

Does proof of work require JavaScript?

Is the privacy policy text snippet legally binding?

Does “GDPR” mean my website is automatically GDPR-compliant?

My site runs behind Cloudflare or a reverse proxy. What should I configure?