Title: MDL Spam Filter Author: Monday Digital Lab Published: 22. juuli 2026 Last modified: 10. aug 2026 --- Search plugins ![](https://ps.w.org/mdl-spam-filter/assets/banner-772x250.png?rev=3625803) ![](https://ps.w.org/mdl-spam-filter/assets/icon-256x256.png?rev=3625803) # MDL Spam Filter By [Monday Digital Lab](https://profiles.wordpress.org/mondaydigitallab/) [Download](https://downloads.wordpress.org/plugin/mdl-spam-filter.1.0.1.zip) * [Details](https://et.wordpress.org/plugins/mdl-spam-filter/#description) * [Reviews](https://et.wordpress.org/plugins/mdl-spam-filter/#reviews) * [Installation](https://et.wordpress.org/plugins/mdl-spam-filter/#installation) * [Development](https://et.wordpress.org/plugins/mdl-spam-filter/#developers) [Support](https://wordpress.org/support/plugin/mdl-spam-filter/) ## Description **Stop contact form spam before it reaches your inbox.** MDL Spam Filter is a lightweight anti-spam plugin that protects Contact Form 7, WPForms, Gravity Forms, Elementor forms, and any other contact form — using keyword filtering, a honeypot, rate limiting, a language guard, and optional AI spam detection (Anthropic Claude, OpenAI GPT, or any OpenAI-compatible provider). No CAPTCHA, no visitor friction, and nothing is stored or emailed until a submission passes the filter. #### Why server-side MDL Spam Filter scans front-end contact form submissions on the server before any form handler runs. When a submission is detected as spam, it is blocked: no email is sent — including the admin notification of a new submission and any autoresponder— and nothing is written to your form plugin’s entries or email log. You choose whether blocked submissions are recorded in this plugin’s own private log. The filter is form-agnostic. It inspects any POST request that carries an email address — or that is recognisably from a supported form plugin even without an email field — so it works with Contact Form 7, WPForms, Gravity Forms, Elementor forms, raw HTML forms, and most others without per-plugin configuration. AJAX and REST submissions (such as Contact Form 7) receive a proper response, so the submit spinner never hangs. #### How a submission is checked Checks run cheapest-first, so most spam is stopped before anything costly happens: 1. **Is it a contact form at all?** Only front-end POSTs carrying an email address or a recognised form plugin’s identifier are scanned. WooCommerce checkout and account flows, user registration, login, and password reset are never scanned or blocked. 2. **Allow list** — a listed sender skips every remaining check, including AI. 3. **Deny list** — a listed sender is blocked immediately, with no AI call. 4. **Honeypot** — an invisible field that only bots fill in. 5. **Minimum submit time** — blocks forms submitted faster than a human could plausibly fill them. 6. **Rate limit** — caps submissions per minute from one visitor, throttling floods before any AI spend. 7. **Language guard** — blocks by language or alphabet, and traps words mixing Latin with look-alike Cyrillic letters. 8. **Keywords** — the built-in list plus your own terms. 9. **AI** — optional classification by your chosen provider. Steps 2–7 are deterministic, instant, and cost nothing. Only steps 8–9 examine the message itself, and AI runs last. **The verdict.** Keyword and AI verdicts can be held in the Review queue for your decision (on by default) instead of dropped. Deterministic blocks (steps 3–7) are always blocked immediately and never enter the queue. Either way you choose what the sender sees: * **Silently discard** — the form shows its normal success message while the submission is quietly dropped, giving bots no signal. * **Show a blocked message** — the form displays a clear “flagged as spam” notice. #### Keyword filtering * 200+ built-in keywords organised into collapsible categories (pharma, SEO outreach, scams, gambling, and more) — toggle them individually, per category, or all at once. * Unlimited custom keywords, using the same chip interface as the built-in list. * Activate, pause, or remove individual keywords without losing them. * Regular-expression keywords: wrap a custom term in slashes (/pattern/) for advanced matching — invalid patterns are skipped safely. * Per-keyword hit counters show how many submissions each keyword has blocked, so dead keywords are easy to prune. #### AI detection (optional, bring your own key) * Works with Anthropic (Claude), OpenAI, or any custom OpenAI-compatible provider, using your own API key. No API key is needed for keyword-only use. * Verdicts are requested as a strict yes/no decision and, where the provider supports it, constrained to a structured JSON response (json_schema / json_object) — so the result can’t be ambiguous free text. * Custom AI detection rules: keep the built-in rules, write your own, or combine both — with a “Generate rules with AI” assistant and ready-made templates that draft rules from a plain-language description of your business. * Keyword fallback when the AI provider is unavailable, so an API outage does not silently let spam through (AI-only mode; on by default). * API keys can be kept out of the database entirely by defining them in wp-config. php, and are never included in a settings export. #### Review queue * On by default: keyword- and AI-flagged submissions are held for manual review, captured before any form handler runs — so nothing is stored in your form plugin and no email is sent until you decide. The visitor still sees the form’s normal success message. * View the submitted fields, then Accept to email it to the site admin (kept out of the filter log) or Block to drop it (recorded in the filter log). * Feedback loop: one-click Allow sender / Block sender on held items, plus an inline“ add keyword” box that turns a held spam’s telltale phrase into a blocking keyword. * Optional email notification when a submission is held. #### Blocking and bot traps * Server-side blocking before the submission reaches form handlers or email. * Honeypot field and minimum-submit-time check that stop obvious bots before any keyword or AI work (no cost, no false success signal). * Optional per-visitor submission rate limit to throttle floods before any AI call is made. * Optional language guard: block the languages and alphabets you choose (Cyrillic, Chinese, Arabic, and more) or allow only the ones you choose — plus an always- on trap for words mixing Latin with look-alike Cyrillic letters, a common keyword- filter evasion trick. Accented Latin languages are never affected. * Allow list (never block) and deny list (always block) by email address, domain, or IP — with a one-click “Block sender” action on every Filter Log and Review row. * Outgoing-email safety net: when a submission is spam, every email it triggers is suppressed — including the admin “new submission” notification and any autoresponder. #### Filter log, privacy and retention * Private, opt-in log of blocked submissions in a dedicated database table — never written to your form plugin’s entries or email log. * Stores submitter IP as a one-way hash for privacy. * Searchable, filterable log with date range and method filters, sortable dates, bulk delete, and CSV export. * Filter Log excerpts expand in place, so long submissions can be read without leaving the list. * Automatic retention cleanup: filter-log and review-queue entries older than a configurable number of days (default 90, 0 = keep forever) are pruned daily, so a spam flood cannot grow the database forever. * Activity audit log: who changed settings and keywords, imports/exports, log purges, AI connection tests, and AI provider outages — with automatic 90-day retention. * Fields whose name indicates a secret or payment detail (passwords, tokens, card numbers, and similar) are excluded from the text sent to any AI provider and from the stored log excerpt. #### Notifications * A dedicated Notifications settings section: one central notification email address for every alert (review holds, provider errors, weekly digest), with an on/off toggle and optional override address per notification. * A tag-style picker for adding multiple recipients to any field (plain comma-separated input still works), with invalid addresses flagged on save rather than dropped silently. * A send-test button that resolves the recipient exactly like the real notification, so you can confirm delivery before a real alert depends on it. * Optional email alert when the plugin hits a provider error — invalid or expired API key, exhausted credit or quota, or a provider outage — throttled to one email per distinct error every 10 minutes. * Optional weekly email digest: blocked totals, detection-method breakdown, top blocked senders, and the review-queue backlog — skipped automatically when there is nothing to report. * Everything falls back to the site admin email. #### Dashboard and reporting * Analytics dashboard with a 7/30/90-day period picker: daily blocked-submission chart, trend deltas against the previous period, busiest-day and awaiting-review tiles, detection-method breakdown, and top blocked senders and targeted pages— every bar, method, sender, and page clicks through to the pre-filtered Filter Log. * System-health card: protection state, detection engine and API-key source, AI- provider status (from the circuit breaker — no live call), review-queue backlog, scheduled maintenance (with your retention period), and weekly-digest status, each with a fix-it link when something needs attention. The cron rows diagnose real scheduling problems: an overdue event (WP-Cron not firing on a quiet site) or a stale queue entry gets an amber warning with the fix. * Dismissable setup checklist that tracks protection, detection, notifications, and the first test email — each step deep-links to the right screen. * One-click report export (CSV): totals, daily counts, method breakdown, and top senders/pages for the selected period. * “Spam blocked” counter in the WordPress dashboard At a Glance widget. * Dashboard aggregates are cached for five minutes so the overview never runs heavy queries on every load. #### Admin experience * WooCommerce-style navigation: a dedicated top-level MDL Spam Filter menu with Dashboard, Settings, Keywords, Review, Filter Log, Activity Log, Help, and Import/ Export pages. The Settings page is organised into sections (Protection, Detection engine, AI engine, Advanced protection, Form targeting, Email & logging, Notifications) and the Help page into Getting started / FAQ / About. * Every screen opens with a one-line purpose statement and a primary action, a persistent banner warns on every screen when protection is off, the Filter Log, Review, and Activity lists all sort by date, table headers stay visible while scrolling long lists, and the whole UI follows your chosen WordPress admin color scheme. * Accessible by design: keyboard-visible focus on every custom control (toggles, keyword chips, recipient pickers, chart bars), screen-reader table behind the dashboard chart, WCAG AA contrast on badges and status colors, and reduced-motion support. * Contextual help on every screen: the WordPress Help flyout carries the screen’s purpose and the FAQ entries relevant to that page. * Settings import/export as JSON for moving configuration between sites (API keys are never exported), plus a separate keywords-only import/export for sharing keyword lists without touching other settings. #### Compatibility * Works with Contact Form 7, WPForms, Gravity Forms, Ninja Forms, Elementor forms, raw HTML forms, and most others without per-plugin configuration. * Works with AJAX and REST forms without hanging the submit spinner. * Form targeting: scan all forms, or only selected forms identified by their id, class, or name. * Transactional flows are left alone: WooCommerce checkout and account, user registration, login, and password reset are never scanned. ### External Services This plugin connects to third-party AI services **only when AI detection is enabled**, or when an admin uses the optional “Generate rules with AI” assistant on the settings page. Keyword-only mode with the assistant unused contacts no external service. #### Anthropic (Claude API) Used to classify submission text as spam or genuine when the AI provider is set to Anthropic, and to draft custom detection rules when an admin uses the “Generate rules with AI” assistant. * What is sent: the text content of the contact form submission and your API key, sent to the endpoint at the time a submission is scanned; and, only when an admin clicks “Generate rules with AI”, the business description that admin types into the assistant. * Endpoint: https://api.anthropic.com/v1/messages * Terms of Service: https://www.anthropic.com/legal/commercial-terms * Privacy Policy: https://www.anthropic.com/legal/privacy #### OpenAI (Chat Completions API) Used to classify submission text as spam or genuine when the AI provider is set to OpenAI, and to draft custom detection rules when an admin uses the “Generate rules with AI” assistant. * What is sent: the text content of the contact form submission and your API key, sent to the endpoint at the time a submission is scanned; and, only when an admin clicks “Generate rules with AI”, the business description that admin types into the assistant. * Endpoint: https://api.openai.com/v1/chat/completions * Terms of Use: https://openai.com/policies/terms-of-use * Privacy Policy: https://openai.com/policies/privacy-policy #### Custom provider (optional) If you set the AI provider to “Custom”, submission text and your API key are sent to the OpenAI-compatible endpoint URL you enter in the settings — and, only when an admin clicks “Generate rules with AI”, the business description that admin types into the assistant. The endpoint must be an https:// URL that is not a private or loopback address (an http:// endpoint can be enabled with the `mdlsf_allow_insecure_custom_endpoint` filter for a trusted local model). No request is made unless you configure this. Because the endpoint is supplied by you, review the terms and privacy policy of whichever provider you point it at (for example OpenRouter, Groq, Together AI, or a self-hosted model). ## Screenshots [⌊Dashboard with the setup checklist, period picker (7/30/90 days), trend deltas, blocked-submission chart, and system-health card.⌉⌊Dashboard with the setup checklist, period picker (7/30/90 days), trend deltas, blocked-submission chart, and system- health card.⌉[ Dashboard with the setup checklist, period picker (7/30/90 days), trend deltas, blocked-submission chart, and system-health card. [⌊Settings page with WooCommerce-style sections, detection mode, and AI provider options.⌉⌊Settings page with WooCommerce-style sections, detection mode, and AI provider options.⌉[ Settings page with WooCommerce-style sections, detection mode, and AI provider options. [⌊Notifications section: one central address, per-notification toggles and overrides with a tag-style multi-email picker, and a send-test button.⌉⌊Notifications section: one central address, per-notification toggles and overrides with a tag-style multi- email picker, and a send-test button.⌉[ Notifications section: one central address, per-notification toggles and overrides with a tag-style multi-email picker, and a send-test button. [⌊Keywords page: built-in keywords grouped by category, with search and per-group toggles, plus your own custom keywords.⌉⌊Keywords page: built-in keywords grouped by category, with search and per-group toggles, plus your own custom keywords.⌉[ Keywords page: built-in keywords grouped by category, with search and per-group toggles, plus your own custom keywords. [⌊Filter Log page with search, filters, date sorting, expandable excerpts, bulk delete, and CSV export.⌉⌊Filter Log page with search, filters, date sorting, expandable excerpts, bulk delete, and CSV export.⌉[ Filter Log page with search, filters, date sorting, expandable excerpts, bulk delete, and CSV export. [⌊Review queue: flagged submissions held before anything is stored or emailed — accept, block, or turn a phrase into a keyword.⌉⌊Review queue: flagged submissions held before anything is stored or emailed — accept, block, or turn a phrase into a keyword.⌉[ Review queue: flagged submissions held before anything is stored or emailed — accept, block, or turn a phrase into a keyword. ## Installation 1. Upload the `mdl-spam-filter` folder to `/wp-content/plugins/`, or install through the Plugins screen. 2. Activate the plugin through the Plugins screen. 3. Go to the MDL Spam Filter menu in the admin sidebar, then open Settings to configure detection. 4. If using AI detection, choose a provider (Anthropic, OpenAI, or a custom OpenAI- compatible endpoint) and enter your API key. 5. Optionally, under Form targeting, limit scanning to specific forms by id, class, or name. #### After activating The dashboard shows a setup checklist that walks through the same steps. In short: 1. Confirm protection is on under Settings Protection, and choose what a blocked sender sees. 2. Pick a detection mode under Settings Detection engine — keywords only, AI only, or keywords then AI. 3. Set your notification email under Settings Notifications and use the send-test button to confirm delivery. 4. Submit a test message through your own contact form and check it arrives, then watch the Review and Filter Log screens as real traffic comes in. Keyword detection needs no API key and no external service. ## FAQ ### Does this work with my contact form plugin? It scans any POST submission that contains an email address — or that carries a recognised form plugin’s identifier (Contact Form 7, WPForms, Gravity Forms, Ninja Forms, and similar) even without an email field — so it works with most form plugins and plain HTML forms without extra setup. AJAX and REST forms such as Contact Form 7 get a proper response, so the submit spinner does not hang. ### Can I limit which forms are scanned? Yes. Under Settings Form targeting choose “Selected forms” and add each form by its id, class, or name (for example #contact-form or .wpcf7-form). A lightweight front-end script tags each form with its id, class, and name so only the forms you list are scanned. ### Is an API key required? No. Keyword detection works with no external service. An API key is only needed if you enable AI detection. ### What does the visitor see when a submission is blocked? Your choice, under Settings Protection. “Silently discard” shows the form’s normal success message while the submission is dropped, so bots get no clue. “Show a blocked message” displays a clear notice that the message was flagged as spam. ### Does the site admin still get a notification email for spam? No. When a submission is flagged as spam, every email it would send is suppressed, including the admin “new submission” notification and any autoresponder to the visitor. This applies to forms that send through both standard page submits and AJAX. The outgoing-email safety net (Settings Email & logging) must be enabled, which it is by default. ### Can I use regular expressions in keywords? Yes. Wrap a custom keyword in forward slashes to have it matched as a regular expression, for example /\bcheap +rolex\b/. Patterns are always case-insensitive, and an invalid pattern is skipped safely rather than blocking anything. Each keyword — plain or regex — also shows a hit counter on the Keywords page telling you how many submissions it has blocked, so ineffective keywords are easy to spot and prune. ### The Keywords page says keywords are not in use. Why? Detection mode is set to “AI only” and the AI-unavailable keyword fallback is turned off, so keywords play no part. Switch to “Keywords only” or “Keywords, then AI”, or turn the fallback back on in Settings AI engine, to manage and use keywords. With the fallback on, keywords are still editable and are used only when the AI provider is unreachable. ### Can I customise what the AI treats as spam? Yes. Under Settings AI engine, “Detection rules” offers three modes: the built- in default rules, your own custom rules, or both combined. Custom rules are plain- language lines such as “Treat requests for electrical or roofing work as spam — we only do plumbing.” If you’d rather not write them yourself, the “Generate rules with AI” assistant drafts rules from a short description of your business (ready- made templates included) — review the draft, adjust it, and save. ### What happens if my AI provider is down? By default, when detection mode is “AI only” and the provider cannot be reached ( outage, timeout, rate limit, or a bad key), the plugin falls back to a keyword scan so spam is not silently let through. You can turn this off in Settings AI engine. In “Keywords, then AI” mode the keyword scan always runs first, so an outage never opens the gate. A blocked submission caught this way is logged with the reason “ Matched keyword (AI unavailable)”. You can also be told about provider problems as they happen: turn on the AI Engine provider-error notification in Settings Notifications and the plugin emails you when it hits a provider error — an invalid or expired API key, exhausted credit or quota, or an outage. Alerts are throttled to one email per distinct error every 10 minutes. ### How are my API keys stored? Your provider API keys are never included in a settings export. For maximum safety you can keep them out of the database entirely by defining them in wp-config.php: ``` define( 'MDLSF_ANTHROPIC_API_KEY', '...' ); (or `MDLSF_OPENAI_API_KEY` / `MDLSF_CUSTOM_API_KEY`). ``` When a constant is defined it overrides and hides the stored option, and the matching field shows a read-only note instead of an input. ### Can I rate-limit submissions? Yes. Under Settings Protection set “Submission rate limit” to the maximum number of submissions allowed per minute from one visitor. Submissions beyond that are blocked without an AI call, which throttles bursts and caps API cost. It defaults to 20 per minute; set it to 0 to disable. ### What are the honeypot and minimum submit time? Two zero-cost bot traps under Settings Advanced protection. The honeypot adds an invisible form field that humans never see; any submission that fills it is blocked. The minimum submit time blocks forms submitted faster than a human could plausibly fill them (bots typically submit instantly). Both checks fail open: a visitor without JavaScript or on a cached page is never blocked by them. ### Can I block submissions written in a foreign language? Yes. Turn on the language guard under Settings Advanced protection and pick a mode.** Block selected languages & alphabets** blocks submissions written mostly in any language or alphabet you tick (the default selection is everything except Latin).** Allow only selected languages & alphabets** inverts it: anything written mostly in a language or alphabet you did not tick is blocked, including ones not listed. Either way the guard also blocks words that mix Latin with look-alike Cyrillic letters— a common trick to sneak terms like “vіаgra” past keyword filters. Accented Latin languages such as French, German, or Spanish always count as Latin, and a foreign name or city in an otherwise fine message does not trip it. The check is deterministic and costs nothing — it runs before any keyword or AI work and fails open on content it cannot judge. The guard detects the alphabet, not the exact language — it cannot tell apart languages that share an alphabet, such as Russian vs Ukrainian or English vs Indonesian. For per-language policy, use AI detection instead: add a custom rule under Settings AI engine Detection rules such as “We only serve English-speaking customers — treat submissions written entirely in another language as spam.” The AI reads every language, so it classifies foreign-language spam on meaning either way. ### Can I always allow or always block specific senders? Yes. Under Settings Advanced protection, add email addresses, domains, or IP addresses to the allow list (matching submissions skip every check, including AI) or the deny list (matching submissions are blocked immediately, without an AI call). You can also manage senders in one click: every Filter Log and Review row with a valid email shows a “Block sender” action that adds that address to the deny list, and Review rows additionally show an “Allow sender” action that adds it to the allow list (rows whose sender is already listed show “On deny list” or “On allow list” instead). Each change is recorded in the Activity Log, and both lists stay editable under Settings Advanced protection. ### What is the Review queue? A hold-for-review step for submissions flagged by keywords or AI, on by default — turn it off with “Hold flagged mail for review” under Settings Email & logging. When on, a flagged submission is captured and the request is stopped before any form handler runs — so nothing is stored in your form plugin and no email is sent until you decide. The visitor still sees the form’s normal success message. You can also have the plugin email you when a submission is held: turn on the review notification under Settings Notifications. It goes to the central notification email address, or a review-specific override address if you set one; either falls back to the site admin email. For each held submission you can: * **View** — see all submitted fields, the sender, source, and reason. The detail view also includes a quick “add keyword” box: paste a telltale phrase from the spam and it is added to your custom keyword list immediately, so future submissions containing it are caught without an AI call. * **Accept** — email the submitted fields to the site administrator (goes out through wp_mail like any other mail). Not added to the filter log. * **Block** — discard the submission (never delivered) and record it in the filter log. * **Allow sender / Block sender** — add the sender to the allow or deny list in one click, so their future submissions are always let through or always blocked. This applies only to keyword/AI verdicts. Deterministic bot blocks (rate limit, deny list, honeypot, minimum submit time, language guard) are always blocked immediately and never enter the queue. Because the submission is held before the form plugin processes it, the accepted email is a notification the plugin composes from the submitted fields — it is not the form plugin’s own templated email, and no form-plugin entry is created. Note: forms that submit over admin-ajax (for example WPForms) are processed too early for this pre-handler capture; their flagged mail is blocked and logged rather than queued. ### Where are blocked submissions stored? Only in this plugin’s own database table, and only if you enable logging. They are never written to your form plugin’s entries or email log. Entries do not pile up forever: filter-log and review-queue rows older than the retention period (Settings Email & logging, default 90 days) are removed automatically once a day. Set the retention to 0 to keep entries indefinitely. ### Is submission data sent anywhere? Only when AI detection is enabled, or when an admin uses the “Generate rules with AI” assistant. With AI detection on, the submission text is sent to the AI provider you select (Anthropic, OpenAI, or a custom OpenAI-compatible endpoint you configure) for classification. The rule assistant additionally sends the business description an admin types into it, so the provider can draft custom detection rules. See External Services below. Fields whose name indicates a secret or payment detail (passwords, API tokens, card numbers, CVV, account/routing numbers, and similar) are excluded from both the text sent to the provider and the stored log excerpt. ### What does the Activity Log page show? A plugin-level audit trail, separate from the Filter Log: settings and keyword changes( with which settings changed — never their values), imports and exports (settings and keywords), log purges and deletions, automatic retention pruning, review-queue decisions, senders blocked or allowed from the Filter Log or Review pages, keywords added from the review queue, weekly digests sent, AI connection tests, notification test emails, plugin activation, and AI provider errors (throttled, so an outage produces one entry per window). Entries record the acting user and are pruned automatically after 90 days. Setting values and API keys are never stored in the activity log. ### Can I export the log or my settings? Yes. The Filter Log page has a CSV export that honours your current search and filters. The Import/Export page has a JSON settings export/import for moving configuration between sites — API keys are never included in the export — plus a separate keywords- only export/import for sharing keyword lists without touching other settings. ### Where do the plugin’s notification emails go? Set one central address under Settings Notifications and every alert the plugin sends — review-queue holds, AI provider errors, and the weekly digest — goes there. Leave it blank to use the site admin email. Each notification also has its own on/ off toggle and an optional override field, so you can send, say, the digest to a different mailbox. Every field accepts several addresses through a tag-style picker— press Enter or type a comma after each — and anything that is not a valid email address is flagged when you save instead of being dropped silently. A “Send test email” button on the same section delivers a test message to whoever would receive the selected notification, so you can confirm delivery before a real alert depends on it. ### Can I get a summary email instead of checking the dashboard? Yes. Turn on the weekly digest under Settings Notifications. Once a week the plugin emails a summary — how many submissions were blocked in the last 7 days, the detection- method breakdown, the top blocked senders, and how many items are waiting in the review queue — to the address you set there (the central notification email address, or a digest-specific override; defaults to the site admin email). Weeks with nothing to report send no email. ### Why does System health say the daily cleanup is overdue? WordPress cron is not a real cron — it only fires when someone visits the site. On a quiet, staging, or local site, scheduled events sit in the queue past their due time, and the dashboard’s System health card flags them as overdue rather than pretending all is well. Visit the front end once (the overdue job runs and reschedules itself), or for a reliable setup add `define( 'DISABLE_WP_CRON', true );` to wp- config.php and point a real system cron at wp-cron.php every few minutes. If the card instead reports the cron entry as stale (a daily event scheduled more than a day out), deactivating and reactivating the plugin rebuilds the schedule. ### Can developers customise it? Yes. These hooks are available: * `mdlsf_predefined_keywords` (filter) — modify the built-in keyword list. * `mdlsf_excluded_requests` (filter) — mark additional requests (by your own logic) as non-contact-form so they are never scanned. * `mdlsf_sensitive_field_keys` (filter) — modify the list of field-name substrings excluded from scanning, AI, and logging (passwords, tokens, card numbers, etc.). * `mdlsf_language_guard_threshold` (filter) — adjust the ratio of offending-script letters (0–1, default 0.3) above which the language guard blocks. * `mdlsf_log_max_rows` / `mdlsf_quarantine_max` (filters) — adjust the filter-log row cap and review-queue size cap. * `mdlsf_ai_prompt` (filter) — modify the classification prompt sent to the AI provider, receiving the full prompt text and the sampled submission content. * `mdlsf_allow_insecure_custom_endpoint` (filter) — permit an http:// custom AI endpoint (e.g. a trusted local model). * `mdlsf_submission_blocked` (action) — fires when a submission is blocked, passing the submitter email and the detector verdict. * `mdlsf_submission_quarantined` (action) — fires when a flagged submission is held in the review queue, passing the submitter email and the detector verdict. ## Reviews There are no reviews for this plugin. ## Contributors & Developers “MDL Spam Filter” is open source software. The following people have contributed to this plugin. Contributors * [ Monday Digital Lab ](https://profiles.wordpress.org/mondaydigitallab/) [Translate “MDL Spam Filter” into your language.](https://translate.wordpress.org/projects/wp-plugins/mdl-spam-filter) ### Interested in development? [Browse the code](https://plugins.trac.wordpress.org/browser/mdl-spam-filter/), check out the [SVN repository](https://plugins.svn.wordpress.org/mdl-spam-filter/), or subscribe to the [development log](https://plugins.trac.wordpress.org/log/mdl-spam-filter/) by [RSS](https://plugins.trac.wordpress.org/log/mdl-spam-filter/?limit=100&mode=stop_on_copy&format=rss). ## Changelog #### 1.0.1 * Documented the mdlsf_ai_prompt filter in the developer hook list. * Reorganised the readme into grouped feature sections, added a “how a submission is checked” walkthrough and a post-activation quick start, and grouped the FAQ by topic. #### 1.0.0 * Initial release. ## Meta * Version **1.0.1** * Last updated **35 minutit ago** * Active installations **Fewer than 10** * WordPress version ** 6.2 or higher ** * Tested up to **7.0.3** * PHP version ** 7.4 or higher ** * Language * [English (US)](https://wordpress.org/plugins/mdl-spam-filter/) * Tags * [AI](https://et.wordpress.org/plugins/tags/ai/)[anti-spam](https://et.wordpress.org/plugins/tags/anti-spam/) [contact form](https://et.wordpress.org/plugins/tags/contact-form/)[spam](https://et.wordpress.org/plugins/tags/spam/) [spam filter](https://et.wordpress.org/plugins/tags/spam-filter/) * [Advanced View](https://et.wordpress.org/plugins/mdl-spam-filter/advanced/) ## Ratings No reviews have been submitted yet. [Your review](https://wordpress.org/support/plugin/mdl-spam-filter/reviews/#new-post) [See all reviews](https://wordpress.org/support/plugin/mdl-spam-filter/reviews/) ## Contributors * [ Monday Digital Lab ](https://profiles.wordpress.org/mondaydigitallab/) ## Support Got something to say? Need help? [View support forum](https://wordpress.org/support/plugin/mdl-spam-filter/)