🛡️ DK SPAM SHIELD • OFFICIAL DOCUMENTATION
Zero-Bloat Anti-Spam & Security Engine
Everything you need to know about setting up multi-layer defense, invisible honeypot traps, cryptographic time-gates, Cloudflare Turnstile, Google reCAPTCHA, and native form integrations.
Why Choose DK Spam Shield?
Lightweight, bulletproof, and privacy-first anti-spam architecture built for speed and security.
Zero Bloat & Fast
Executes locally in pure PHP with sub-millisecond overhead. No remote API lookups required in local mode.
4-Layer Local Pipeline
Invisible Honeypot, cryptographic Time-Gate, dynamic JS token, and accessible Math Challenge puzzles.
Turnstile & reCAPTCHA
Seamless native integration with Cloudflare Turnstile (Managed/Interactive) and Google reCAPTCHA v2/v3.
Deep Form Integrations
Works out of the box with WordPress Core, WooCommerce, Elementor Pro Forms, CF7, WPForms, and Gravity Forms.
Bulk Comment Cleaner
Purge thousands of spam, pending, or trash comments with 1-click batch cleanup directly from comments screen.
IP Access Control
Whitelist and Blacklist IP rules with single-click actions, exact IPs, wildcards (*), and CIDR ranges.
Quick Start in 3 Easy Steps
- Step 1: Install and activate DK Spam Shield from WordPress Admin (Plugins > Add New).
- Step 2: Go to Settings > DK Spam Shield and choose your Protection Mode (Local Defense is ready by default).
- Step 3: Toggle your desired Form Integrations (WordPress, WooCommerce, Elementor, CF7, WPForms).
- Step 4: Save settings. Your website forms are now protected from automated spam bots!
Performance At A Glance
Protection Modes Deep Dive
Select the ideal protection strategy based on your privacy and user experience requirements.
Local Protection Engine
The local engine operates completely on your WordPress server without transmitting IP addresses or user data to third parties.
- Invisible Honeypot: Injects a hidden form field that is invisible to human visitors (hidden via CSS and aria-hidden). Automated bot scripts scan and populate all fields, causing instant rejection.
- Cryptographic Time-Gate: Calculates the duration between form load and submission using an HMAC-signed token. Submissions under the threshold (default: 3 seconds) are blocked as automated speed bots.
- Dynamic JS Challenge: A dynamic browser execution token ensuring the client is a real web browser with JavaScript enabled, preventing cURL/python spam scripts.
- Accessible Math Challenge: User-friendly arithmetic questions (e.g. 5 + 3 = ?) with one-click AJAX refresh.
Cloudflare Turnstile Integration
Cloudflare Turnstile delivers privacy-preserving, friction-free security verification that replaces traditional image CAPTCHAs.
- How it works: Evaluates browser telemetry seamlessly without asking users to click fire hydrants or traffic lights.
- Setup: Create a free account at Cloudflare, navigate to Turnstile, generate a Site Key and Secret Key, and paste them into DK Spam Shield settings.
- Modes supported: Managed, Interactive, and Non-interactive widgets.
Google reCAPTCHA v2 & v3
Full support for Google’s industry standard CAPTCHA APIs with customizable score thresholds.
- reCAPTCHA v2 (Checkbox): Displays the familiar “I’m not a robot” checkbox challenge.
- reCAPTCHA v3 (Invisible): Executes in the background and assigns each visitor a risk score between 0.0 (bot) and 1.0 (human).
- Score Threshold: Configure sensitivity under plugin settings (default: 0.5 recommended).
Comprehensive Form Integrations
Toggle spam protection on all standard WordPress entry points with single-click switches.
WordPress Native
- Login Form (wp-login.php)
- User Registration
- Lost Password Screen
- Post Comments Form
- Pingback & Trackback Filter
WooCommerce Store
- Customer Account Login
- Customer Registration
- Lost Password Flow
- Checkout Order Submission
- AJAX Checkout Interception
Form Builders & APIs
- Elementor Pro Forms
- Contact Form 7 (CF7)
- WPForms & Gravity Forms
- REST API Comment Endpoints
- XML-RPC Attack Blocker
IP Access Control & Subnets
DK Spam Shield supports robust IP whitelist and blacklist rules with support for single IPs, wildcard subnets, and standard CIDR notation:
192.168.1.50— Single IP address192.168.1.*— Wildcard class C range10.0.0.0/24— Standard CIDR subnet mask
Bulk Comment Cleaner
Clean up existing spam without installing bulky separate cleaner plugins. Safely purge comments in batches:
- Spam Cleaner: Deletes all comments marked as Spam in one click.
- Pending Cleaner: Purges unmoderated pending queue.
- Trash Cleaner: Empties the comments trash bin.
- Comments Screen Button: Quick action button on the native WordPress comments list screen.
Frequently Asked Questions
Answers to commonly asked questions and configuration tips.
No. When operating in Local Protection mode, all verification checks (Honeypot, Time-Gate, Math, JS Token) execute in pure PHP and vanilla JavaScript with sub-millisecond response times. No external network requests or tracking scripts are loaded.
The plugin injects an invisible input field that is hidden from human visitors via CSS position and aria-hidden attributes. Automated spam bots automatically scan and fill all inputs on a page. If this hidden field contains any text upon submission, the request is immediately blocked as a spam bot.
Automated scripts submit forms within milliseconds of loading a page. The Time-Gate generates an HMAC-signed timestamp token on render. When submitted, the plugin calculates the elapsed time. You can customize the minimum required duration (default: 3 seconds) under Settings > General.
Navigate to Settings > DK Spam Shield > IP Rules tab. Enter your IP address (e.g. 192.168.1.100) or your network subnet in the Whitelist box and save. Whitelisted IPs bypass all security challenges completely.
Log into your Cloudflare Dashboard, go to Turnstile, and create a new widget with your website domain. Copy your Site Key and Secret Key, then switch Protection Mode to “Cloudflare Turnstile” in DK Spam Shield settings and paste the keys.
Yes! Simply ensure the respective switches (“Elementor Pro Forms” and “Contact Form 7”) are enabled under Settings > Form Integrations. The plugin hooks directly into the validation pipelines without requiring shortcodes.
Need Help or Have Feature Requests?
DK Spam Shield is free and open-source. For assistance, reach out on the WordPress support forums or support the developer below.