MentoGuard protects your WordPress forms from spam bots using behavioral analysis and server-side token verification — completely GDPR-compliant with no data sent to Google or any third party.
Currently supports Contact Form 7, with more form builders coming in future releases.
How It Works
MentoGuard uses three independent protection layers:
- Signed token — every form load generates a one-time server-side token. Bots submitting without loading the page are instantly blocked.
- Page time check — measures time between page load and submission entirely server-side. Bots submit in milliseconds; real users take seconds.
- Behavioral score — JavaScript tracks how the visitor interacts with the form (timing, mouse movement, keyboard vs paste, field order) and assigns a spam score.
Key Features
- GDPR compliant — zero external servers, zero Google, zero third parties
- Contact Form 7 native tag support — place [mentoguard] inside your CF7 form editor
- Scripts load only on pages with active forms — zero SEO or page speed impact on other pages
- Spam log dashboard — see every blocked submission with IP, score, and signals
- Top Spammers page — aggregate view of worst offenders with one-click blacklisting
- IP Blacklist — manually block IPs or CIDR ranges
- Test Mode — see live spam scores without blocking anyone
- Debug Log — step-by-step validation log for diagnosing issues
- Preset modes — Relaxed, Balanced, Strict
- Page time protection — configurable minimum time in seconds or milliseconds
- Fully adjustable — enable/disable each signal, adjust point values
- No tracking, no upsells, no phone-home
Privacy
MentoGuard reads your local WordPress database only. It logs the IP address and behavioral score of blocked submissions. No data is sent to any external server at any time.
Usage with Contact Form 7
Add [mentoguard] inside your CF7 form editor, before the submit button:
[text* your-name]
[email* your-email]
[mentoguard]
[submit “Send”]
