SpamJam – Anti-Spam Protection for Comments & Forms

Spam should not create more work for you—or more friction for your visitors.

SpamJam quietly stops automated comment spam with layered, on-site checks. There are no CAPTCHAs to solve, no puzzles to frustrate readers, and no complicated setup before protection begins.

Install it, activate it, and get back to running your site.

Why Site Owners Choose SpamJam

🚫 Less Spam to Moderate – Catch automated submissions before they clutter your comment queue.
👤 No Friction for Real People – Visitors can comment without image grids, challenges, or extra verification steps.
⚡ Protected from Activation – Core comment protection is enabled by default, with sensible settings already in place.
🧠 Fewer False Positives – Multiple signals work together; suspicious edge cases can be held for review instead of being discarded.
🩶 Lightweight by Design – Focused checks run where they are needed, without loading a heavy front-end framework.
🔒 Privacy-Conscious Detection – Core comment analysis runs on your WordPress site rather than sending comment content to a remote spam-scoring service.

Free Comment Protection

The free version gives blogs, publishers, and WooCommerce stores a strong first line of defense:

• Per-site salted honeypot – An invisible, site-specific trap makes generic bot scripts easier to identify.
• Submission timing check – Detects forms submitted faster than a person could reasonably complete them.
• Weighted spam scoring – Combines form, timing, token, and referrer signals instead of relying on one fragile test.
• Safer moderation path – Suspicious submissions below the blocking threshold can be held for review.
• Secure form validation – Nonces and time-boxed HMAC tokens help verify legitimate comment submissions.
• Built-in keyword blocklist – Stops common comment-spam patterns.
• WooCommerce product reviews – Protects review forms and declares compatibility with WooCommerce HPOS.
• No-JavaScript fallback – Visitors with JavaScript disabled are not automatically hard-blocked.
• Dashboard statistics – See the protection working from your WordPress admin.

No account or API key is required to start protecting comments.

Go Beyond Comments with SpamJam Pro

When spam reaches registrations, contact forms, or a high-traffic site, SpamJam Pro adds the control and visibility you need:

• Protection for popular form plugins – Cover Contact Form 7, WPForms, Gravity Forms, Elementor Forms, Fluent Forms, Formidable Forms, Ninja Forms, and WooCommerce registration.
• Actionable spam inbox – Search and filter events, review false positives, restore recoverable comments, allow trusted senders, and use bulk actions.
• Source-aware rules – Allow, moderate, block, or discard submissions using conditions tailored to each protected source.
• Registration protection – Add honeypot checks and email confirmation to WordPress registrations.
• Flood and content controls – Set rate limits, minimum comment length, maximum links, and your own blocked terms.
• Targeted blocking – Block configured IP addresses, email addresses, domains, or countries while allowlisting trusted senders.
• Reports and analytics – Understand trends, sources, repeat signals, and false positives; receive weekly summaries or export PDF reports.
• Professional site tools – Add an automatically updated extended blocklist, multisite synchronization, and white-label controls.

Every Pro feature is included. Choose a license based only on the number of sites you manage from SpamJam’s Account screen in your WordPress dashboard.

Built for the Sites Spam Targets

SpamJam is a practical fit for:

• Blogs and publications with open comments
• WooCommerce stores collecting product reviews
• Membership and community sites accepting registrations
• Lead-generation sites using popular form plugins
• Agencies managing protection across multiple WordPress sites

How SpamJam Stops Bots

SpamJam looks for the patterns automated submissions leave behind:

1. A site-specific hidden field catches bots that fill every input.
2. A signed timestamp identifies implausibly fast submissions.
3. Secure tokens and referrer checks test whether the request came through the expected form flow.
4. A built-in blocklist catches common spam content.
5. A weighted scoring engine combines those signals and decides whether to allow, hold, or block the submission.

Real visitors keep the familiar WordPress comment experience. The protection stays in the background.

Privacy & Data Handling

Core comment detection is performed on your site and does not require a remote content-scoring service. SpamJam stores minimal blocked-event metadata locally for dashboard statistics and removes old events after the configured retention period. Personal recovery data is off by default; if you enable it, SpamJam excludes passwords, nonces, security tokens, CAPTCHA values, and CSRF fields from recoverable form data.

Some optional licensing, update, geographic blocking, and premium blocklist features connect to external services when used. Review your site’s privacy obligations and enabled settings as you would with any WordPress plugin.