Abuja Digital Studio · Est. 2018
← All plugins
Live · v1.1.0 · Free

Orravo Spam Shield

Invisible spam protection for WordPress forms — no CAPTCHAs, no friction for real users. Honeypot traps, timing analysis, rate limiting, geo blocking, disposable email detection, and IP / email / keyword blocklists. Works natively with CF7, WPForms, Gravity Forms, and OForms. Free forever.

WP 6.0+PHP 7.4+CF7 · WPForms · GF · OFormsNo CAPTCHA
0Disposable domains blocked
0Blocked per site / day (avg)
0Detection rules
0Form plugins supported
~ orravo-spam-shield / filter.log
● live

Test a submission.
See every rule fire.

This simulates what Spam Shield checks on every form submission. Change the email, IP, or timing and re-run to see which rules fire. On a real site this pipeline runs server-side in under 4ms.

Run every rule.
Instant verdict.

Simulated demo. Runs automatically as you scroll.

Demo simulation
honeypot·awaiting check
timing·awaiting check
ratelimit·awaiting check
geo·awaiting check
disposable·awaiting check
ip blocklist·awaiting check

Six layers of defence.
Zero user friction.

Every check runs server-side, in under 4ms on warm cache. No external API calls per submission. No CAPTCHA. No JavaScript required for the protection to work.

// 6 detection rules · 4 form plugin integrations · 0 CAPTCHAs
Honeypot hidden field — bots fill it, humans never see it
Submission timing — flag submissions under 2s threshold
Rate limiting — cap submissions per IP per window
Geo / country blocking — allow or deny by country code
Disposable email detection — 2,800+ throwaway domains
IP blocklist — manual or automatic permanent bans
Email domain blocklist — block entire sending domains
Keyword blocklist — reject messages with banned words
CF7 integration — hooks into wpcf7_spam filter
WPForms integration — hooks into wpforms_process_before
Gravity Forms integration — hooks into gform_validation
OForms integration — first-party native hooks
REST API — stats, blocklist management, test endpoint
WP-CLI — stats, block, unblock, test, flush commands
Activity log — every blocked submission recorded
Weekly disposable-domain list sync (background cron)

Click around.
It’s all real.

Four interactive previews of the actual Spam Shield admin. No screenshots — working mock-ups of what ships in the plugin.

Dashboard

A rolling 7-day view of blocked submissions by rule, plus a live counter of the current rate-limited IPs.

312Blocked (7 days)
58%Honeypot rate
3IPs rate-limited now
4msAvg pipeline time
Blocks by rule (7 days)live
RuleCountShare
Honeypot18158%
Timing analysis7424%
Rate limiting3311%
Geo blocking144%
Disposable email103%

Detection rules

Enable, disable, and tune each protection layer. Changes apply immediately — no cache to flush.

Rule configuration
RuleStatusSetting
Honeypotenabledfield: _shield_check
Timing analysisenabledmin elapsed: 2.0s
Rate limitingenabled10 submissions / 5 min / IP
Geo blockingenabledblocked: RU, KP, CN (3 countries)
Disposable emailenabled2,847 domains · synced 2d ago
IP blocklistenabled12 IPs blocked
Keyword blocklistenabled7 words/phrases

Blocklists

Manually manage IP, email domain, and keyword blocklists. Entries are checked on every submission — no caching needed.

IP blocklist12 entries
IP / RangeAddedReasonHits
203.0.113.773d agorate-limit auto-ban47
198.51.100.41w agomanual12
10.20.30.0/242w agoreported abuse3
Keyword blocklist7 entries
casinofree moneyclick herebuy now
cheap meds100% freeguaranteed profit

Activity log

Every blocked submission, with the rule that fired, the form, the IP, and the elapsed time. Trimmed to the last 500 events.

Recent blockslive
TimeRuleFormIPDetail
2m agohoneypotContact Us198.51.100.4_shield_check filled
4m agodisposableNewsletter203.0.113.55mailinator.com
7m agotimingRegister10.0.0.140.4s < 2s
12m agoratelimitContact Us203.0.113.7714/5min
18m agogeoRegistercountry: RU
Open the live WordPress playgroundRead the developer docs

Six rules built in.
No subscription needed.

Akismet requires a subscription for commercial sites. CleanTalk is a paid third-party service. hCaptcha replaces one UX problem (spam) with another (puzzle friction). Spam Shield is server-side, free, and invisible.

AkismetCleanTalkhCaptchaOrravo Spam Shield
Honeypot field protectionnoBuilt in
Submission timing analysisnopartialnoBuilt in
Rate limiting (per-IP)nonoBuilt in
Geo / country blockingpaidnoBuilt in
Disposable email detectionnopaidnoBuilt in
IP blocklistnoBuilt in
Keyword blocklistnononoBuilt in
Email domain blocklistnononoBuilt in
Works with CF7 / WPForms / GFnoBuilt in
Works with OForms (native)nononoBuilt in
No external API dependencynonoBuilt in
CAPTCHA requirednonoNever
Pricing modelFree$99/yrDev timeFree forever

Clean filter hooks.
Full CLI + REST surface.

Three extension points cover every integration scenario: PHP filter hooks for custom rules, WP-CLI for scripted management, and a REST API for remote stats and blocklist control.

// Hook into the spam-shield decision pipeline. Return true to block the submission.
add_filter('orv_spam_shield_is_spam', function(bool $is_spam, array $context): bool {
    // $context keys: form_id, post_data, ip, user_agent, elapsed_seconds, email
    if (str_contains($context['user_agent'], 'BadBot')) {
        return true;
    }
    return $is_spam;
}, 10, 2);

// Log every spam event for your own analytics.
add_action('orv_spam_shield_blocked', function(array $event) {
    // $event: reason, ip, form_id, elapsed, email, timestamp
    error_log('[spam-shield] blocked: ' . wp_json_encode($event));
});

// Add a custom keyword to the blocklist at runtime (without saving to DB).
add_filter('orv_spam_shield_keyword_blocklist', function(array $words): array {
    $words[] = 'casino';
    $words[] = 'free money';
    return $words;
});

Free.
Forever.

Every protection rule, unlimited forms, unlimited sites. No subscription. No API key to manage. No CAPTCHA tax on your users.

// free

Orravo Spam Shield.

All six detection rules. All four form plugin integrations. No limits.
$0
free forever
  • Honeypot + timing + rate limiting
  • Geo blocking + disposable email + IP blocklist
  • CF7 · WPForms · Gravity Forms · OForms
  • REST API + WP-CLI
  • Activity log + weekly domain list sync
Try it live ↗

Asked & answered.

Does it use CAPTCHA or require users to solve puzzles? +
Never. Spam Shield is invisible to legitimate users. It uses honeypot fields (hidden inputs bots fill in, humans never see), submission timing (bots submit in under a second), rate limiting, geo rules, and blocklists. No distorted text, no image grids, no friction for real people.
Which form plugins does it support? +
Contact Form 7, WPForms (Lite and Pro), Gravity Forms, and Orravo OForms natively. There is also a generic filter — orv_spam_shield_is_spam — that any plugin or custom form can hook into. If you use a form plugin not on the list, open a GitHub issue; most integrations are a single filter hook.
Will it slow down form submissions? +
The honeypot check is a field-presence test (microseconds). Timing analysis reads a single transient. Rate limiting does one Redis/memcached or DB read. Geo blocking is an in-memory GeoIP lookup from a bundled MaxMind Lite database (updated monthly). The full pipeline adds less than 4ms to a form submission on warm cache.
How does disposable email detection work? +
Spam Shield ships with a curated blocklist of ~2,800 known disposable / throwaway email domains (mailinator, guerrillamail, tempmail, etc.) and updates it via a weekly background sync. The check is purely local — no external API call per submission. You can add your own domains via the orv_spam_shield_email_domain_blocklist filter.