Spam Defender
Combine local comment filtering, optional Google reCAPTCHA, contact-detail shielding and inactive-account management. Start with conservative settings and test real visitor journeys.
Paid plugin; protection requires an activated Freemius licence.
Install and activate protection
Upload the supplied ZIP through Plugins → Add Plugin → Upload Plugin, activate it and enter your Freemius licence. Open Spam Defender. A plugin marked active in WordPress is not sufficient if its licence has not been activated. Review the dashboard before adjusting individual protection sections.
Configure the comment filter
Under Comment Filter, choose whether excessive links should hold, mark as spam or reject a comment. Set the link threshold and whether the Website field and bare domains count. Review the hidden honeypot, minimum submission time, blocked words, direct-post checks, trusted commenters and pingback/trackback controls. Try legitimate comments and a controlled spam example. The Comments screen’s Spam Defender column explains detections. Keep an existing anti-spam service until you have confirmed the replacement is working.
Email allow, block and trust rules
Choose allowed domains only if comments should come exclusively from that set. Block individual addresses or domains when needed, and use trusted entries carefully because they can bypass relevant checks. If applying email rules to registrations, test a new account with an address that should pass and one that should fail. Avoid broad rules that exclude legitimate customers.
Add Google reCAPTCHA
Open CAPTCHA, choose v2 checkbox, v2 Invisible or v3, and create matching keys in Google’s reCAPTCHA administration. Register the correct domain. Select the detected locations you want protected and review conflict warnings before enabling another CAPTCHA. Test while signed out. Supported integrations include WordPress login/registration/password reset/comments, WooCommerce classic checkout and account forms, Contact Form 7, WPForms and Gravity Forms. The WooCommerce block checkout and the other integrations listed as unsupported on the screen are not protected by this integration.
Recover from a CAPTCHA lockout
If invalid CAPTCHA settings prevent login, add define( 'AHSD_DISABLE_CAPTCHA', true ); to wp-config.php using your hosting file tools. Log in, correct or disable the broken configuration and test it. Remove the recovery line after fixing the problem so protection can resume. Keys must match the selected reCAPTCHA version; v2 and v3 keys are not interchangeable.
Use Contact Shield
Enable Contact Shield to obscure email addresses and telephone numbers from scrapers. Choose allowed crawlers and the correct visitor-IP source; use the Cloudflare option only for a properly configured Cloudflare setup. Strong mode encodes contact details for ordinary visitors and decodes them in the browser, making it the appropriate mode for page caching. Check visible text, mailto/tel links and a cached page. Clear page caches after changing shield settings.
Review inactive users
The Inactive Users section lists accounts unused for the configured period, 12 months by default. Review the list and retention policy before taking action. Start with manual reminders, choose the notice period and confirm users can log in to cancel a pending deletion. Automatic reminders and automatic deletion are separate settings. Administrators are excluded. Choose the administrator who receives reassigned posts before deletion. Review the masked reminder/deletion history. This feature helps implement a retention policy; it does not decide what your organisation should retain.
Reports, privacy and maintenance
The dashboard and WordPress widget show blocked login/spam totals and frequently targeted pages. Counts begin when the relevant recording feature is available; they are not a complete historical audit. Local comment filtering runs on your server; Google reCAPTCHA sends visitor information to Google when enabled, and Freemius handles licensing/updates. Review the suggested WordPress privacy-policy text. Back up before updates and before bulk account operations. If protection appears inactive, check the licence, selected locations and CAPTCHA conflict scan first.