by
Monday Digital Lab
0 (0 reviews)
MDL Spam Filter
Block contact form spam server-side with keywords, honeypot, rate limiting and optional AI — works with Contact Form 7, WPForms, Gravity Forms.
MDL Spam Filter ranks #47,374 among WordPress.org plugins with 10+ active installations, is #1,739 of 4,596 in the Security category, and was last updated Aug 10, 2026. Data from WordPress.org, refreshed twice daily — see methodology.
Tested up to WP 7.0.6 (Current: 7.1.2)
v1.0.1
Current Version v1.0.1
Updated 1 month ago
Last Update on 10 Aug, 2026
Refreshed 9 hours ago
Last Refreshed on
#1,739 of 4,596 in Security
Top 50% by installs
Rank
#47,374
—
No change
Active Installs
10+
+900%
KW Avg Position
N/A
—
No change
Downloads
790
+16 today
Support Resolved
0%
—
No change
Rating
0%
Review 0 out of 5
0
(0 reviews)
Next Milestone 20
10+
20+
34,112
Ranks to Climb
-
Growth Needed
8,000,000
Active Installs
Pro
Unlock Exact Install Count
See the precise estimated active installs for this plugin, calculated from real-time ranking data.
- Exact install estimates within tiers
- Track install growth over time
- Milestone progress predictions
Need 10 more installs to reach 20+
Rank Changes
Current
#47,374
Change
Best
#
Downloads Growth
Downloads
Growth
Peak
Upgrade to Pro
Unlock 30-day, 90-day, and yearly download history charts with a Pro subscription.
Upgrade NowReviews & Ratings
0.0
0 reviews
Overall
0%
5
0
(0%)
4
0
(0%)
3
0
(0%)
2
0
(0%)
1
0
(0%)
Track This Plugin
Get detailed analytics, keyword tracking, and position alerts delivered to your inbox.
Start Tracking FreePlugin Details
- Version
- 1.0.1
- Last Updated
- Aug 10, 2026
- Requires WP
- 6.2+
- Tested Up To
- 7.0.6
- PHP Version
- 7.4 or higher
- Author
- Monday Digital Lab
Support & Rating
- Rating
- ☆ ☆ ☆ ☆ ☆ 0
- Reviews
- 0
- Support Threads
- 0
- Resolved
- 0%
Keywords
Upgrade to Pro
Unlock keyword rankings, search positions, and detailed analytics with a Pro subscription.
Upgrade NowSimilar Plugins
Adminify – White Label, Admin Menu Editor, Login Customizer
6K+ installs
#2,760
Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits
30K+ installs
#1,009
LiteSpeed Cache
7M+ installs
#5
Akismet Anti-spam: Spam Protection
5M+ installs
#8
Wordfence Security - Firewall, Malware Scan, and Login Security
5M+ installs
#11
Really Simple Security - Simple and Performant Security (formerly Really Simple SSL)
3M+ installs
#17
Hostinger Tools
3M+ installs
#20
WPS Hide Login
2M+ installs
#27
Limit Login Attempts Security – Login Security, 2FA, Firewall, Brute Force Prevention
1M+ installs
#33
WP Super Cache
1M+ installs
#37
Frequently Asked Questions
Common questions about MDL Spam Filter
It scans any POST submission that contains an email address — or that carries a recognised form plugin's identifier (Contact Form 7, WPForms, Gravity Forms, Ninja Forms, and similar) even without an email field — so it works with most form plugins and plain HTML forms without extra setup. AJAX and REST forms such as Contact Form 7 get a proper response, so the submit spinner does not hang.
Your choice, under Settings → Protection. "Silently discard" shows the form's normal success message while the submission is dropped, so bots get no clue. "Show a blocked message" displays a clear notice that the message was flagged as spam.
No. Keyword detection works with no external service. An API key is only needed if you enable AI detection.
Detection mode is set to "AI only" and the AI-unavailable keyword fallback is turned off, so keywords play no part. Switch to "Keywords only" or "Keywords, then AI", or turn the fallback back on in Settings → AI engine, to manage and use keywords. With the fallback on, keywords are still editable and are used only when the AI provider is unreachable.
By default, when detection mode is "AI only" and the provider cannot be reached (outage, timeout, rate limit, or a bad key), the plugin falls back to a keyword scan so spam is not silently let through. You can turn this off in Settings → AI engine. In "Keywords, then AI" mode the keyword scan always runs first, so an outage never opens the gate. A blocked submission caught this way is logged with the reason "Matched keyword (AI unavailable)". You can also be told about provider problems as they happen: turn on the AI Engine provider-error notification in Settings → Notifications and the plugin emails you when it hits a provider error — an invalid or expired API key, exhausted credit or quota, or an outage. Alerts are throttled to one email per distinct error every 10 minutes.
Yes. Under Settings → AI engine, "Detection rules" offers three modes: the built-in default rules, your own custom rules, or both combined. Custom rules are plain-language lines such as "Treat requests for electrical or roofing work as spam — we only do plumbing." If you'd rather not write them yourself, the "Generate rules with AI" assistant drafts rules from a short description of your business (ready-made templates included) — review the draft, adjust it, and save.
Yes. Under Settings → Protection set "Submission rate limit" to the maximum number of submissions allowed per minute from one visitor. Submissions beyond that are blocked without an AI call, which throttles bursts and caps API cost. It defaults to 20 per minute; set it to 0 to disable.
Two zero-cost bot traps under Settings → Advanced protection. The honeypot adds an invisible form field that humans never see; any submission that fills it is blocked. The minimum submit time blocks forms submitted faster than a human could plausibly fill them (bots typically submit instantly). Both checks fail open: a visitor without JavaScript or on a cached page is never blocked by them.
Yes. Turn on the language guard under Settings → Advanced protection and pick a mode. Block selected languages & alphabets blocks submissions written mostly in any language or alphabet you tick (the default selection is everything except Latin). Allow only selected languages & alphabets inverts it: anything written mostly in a language or alphabet you did not tick is blocked, including ones not listed. Either way the guard also blocks words that mix Latin with look-alike Cyrillic letters — a common trick to sneak terms like "vіаgra" past keyword filters. Accented Latin languages such as French, German, or Spanish always count as Latin, and a foreign name or city in an otherwise fine message does not trip it. The check is deterministic and costs nothing — it runs before any keyword or AI work and fails open on content it cannot judge. The guard detects the alphabet, not the exact language — it cannot tell apart languages that share an alphabet, such as Russian vs Ukrainian or English vs Indonesian. For per-language policy, use AI detection instead: add a custom rule under Settings → AI engine → Detection rules such as "We only serve English-speaking customers — treat submissions written entirely in another language as spam." The AI reads every language, so it classifies foreign-language spam on meaning either way.
Yes. Under Settings → Advanced protection, add email addresses, domains, or IP addresses to the allow list (matching submissions skip every check, including AI) or the deny list (matching submissions are blocked immediately, without an AI call). You can also manage senders in one click: every Filter Log and Review row with a valid email shows a "Block sender" action that adds that address to the deny list, and Review rows additionally show an "Allow sender" action that adds it to the allow list (rows whose sender is already listed show "On deny list" or "On allow list" instead). Each change is recorded in the Activity Log, and both lists stay editable under Settings → Advanced protection.
