Name: FormGhost
Author: byabdalla

The spam never happened. FormGhost is a privacy-first WordPress antispam plugin that makes spam quietly disappear: bots are shown a fake success page and walk away believing they got through, while you never receive a thing. No CAPTCHA is shown unless you choose to add one, nothing is sent to anyone but you (FormGhost emails you through your site’s own mail setup, and talks to a third party only if you switch on the optional CAPTCHA), and what FormGhost keeps stays in your own database: held submissions encrypted for a limited time, IP addresses only as keyed hashes. Spam goes into the Vault. Real users never see anything.

Every feature is free. There is no Pro version, no license key, no upsell.

Why FormGhost

No CAPTCHAs. No “select all the buses.” No “I’m not a robot” checkbox.
No cloud dependency — the spam detection itself makes no external HTTP calls. The only optional exceptions (CAPTCHA verification, MX lookup) are off by default and documented under External services.
GDPR / DSGVO friendly. IP addresses are hashed with a per-site secret before storage. Form payloads are encrypted (AES-256-GCM) in the vault.
Ghost Response: bots see a fake success message and walk away thinking the submission worked. You never get the email.
Nobody real gets lost silently: when a held message passed every bot check, FormGhost flags it under “Needs review”, counts it in the admin menu and emails you.
Blocked something legitimate? Find it in the Vault by name, email or a word from the message and forward it to the inbox it was headed to in a couple of clicks.

How it works

Every submission is checked by up to nine independent layers, plus an identity check that notices one mailbox sending under many names. Each layer adds to a spam score. A score of 50 or more is held, and a filled-in honeypot is held straight away — unless the timing, proof-of-work and behaviour checks all show a person, because a browser’s auto-fill sometimes writes into hidden fields. FormGhost then usually answers with a silent Ghost Response, so the bot never learns it was blocked.

Honeypot — Daily-rotated, site-suffixed hidden fields. Different on every FormGhost site; resistant to “fill every field” bots.
Timing — Encrypted submission timestamp. Submissions that arrive too fast (or with a replayed token) fail this layer.
Proof-of-Work — Lightweight browser challenge solved by a WebWorker. Stops curl / wget / scripted submissions cold.
Behavioral fingerprint — Mouse curvature, keystroke variance, scroll, focus and touch signals computed entirely in the browser. Only the resulting score is transmitted.
Rate limiting — Per-IP limits for each kind of form (contact forms, comments, registration, WooCommerce, password reset) within a time window, a separate failed-login limit per account and per IP address, and whitelisting of single IPs or CIDR ranges.
Disposable email detection — Curated disposable-domain blocklist (extensible with your own block/allow lists), optional MX heuristic.
Content patterns — Casino / SEO / pharma phrase detection with a self-learning twist.
WordPress hardening — Disable XML-RPC, harden the REST users endpoint, generic login errors, optional Application Passwords lockdown.
Optional CAPTCHA — Turnstile / hCaptcha / ALTCHA on the core WordPress forms you choose (comments, login, registration, password reset) if you want a visible challenge as a last line of defence. Off by default.

Form plugin compatibility

Built-in adapters for:

WordPress core comments, login, registration, password-reset
Contact Form 7
WPForms
Gravity Forms
Elementor Pro Forms
WooCommerce checkout & registration
Fluent Forms
Ninja Forms
Formidable Forms
Forminator
HTML Forms
Jetpack Forms
Bricks Builder forms
Kadence Blocks forms
Divi contact forms
BuddyPress signup & activity
bbPress topics & replies

Custom forms POSTing to wp-admin/admin-post.php or wp-admin/admin-ajax.php are picked up automatically by the generic adapter.

The Vault

Blocked submissions are stored encrypted for 30 days (configurable). Review them in the admin: see who sent what, why it was held (in plain language), which page it was submitted from, and which inbox the notification was headed to. Search by name, email address, words from the message, domain or entry number; filter by form, reason and date; switch between form submissions, held, delivered and reviewed entries, and login attempts. Mark false positives as legitimate and forward them by email in a couple of clicks — the sender’s address becomes the Reply-To, so answering in your mail client reaches the person who filled the form. The forwarded email treats the submission as untrusted: links and addresses in it are broken up so they cannot be clicked by accident. Passed (legitimate) submissions are logged too, so you can audit both sides of every decision.

Needs review. A Ghost Response shows the sender a success message, so a real person caught by mistake would never find out. When a held submission passed every bot check — a real browser, a person typing — only the content or volume checks held it. FormGhost flags such entries under “Needs review”, shows the count in the admin menu, and emails you (at most ten a day; Settings Notifications).

Self-learning

When you mark a Vault entry as “spam” the engine extracts the sender’s address, the email domain, the domains of links in the message and distinctive phrases (and the hashed IP address), and stores them in a learned-rules table with a score modifier. Marking an entry as legitimate does the opposite: that sender and the matching signals get negative weights. Future submissions matching those signatures get extra points, automatically. Auto-confirmed rules from repeat offenders are added too. Rules FormGhost learns by itself add at most 40 points together, so they never hold a message on their own, and nothing is learned from a submission that passed every bot check. Decay over time keeps the rule set fresh. Review, re-weight, deactivate or delete every learned rule from the Learned Rules screen, or add your own (trust a partner’s domain, block an address); a rule you switch off stays off.

Privacy

The nine detection layers, the Vault and the self-learning system run entirely on your server. Two optional, off-by-default features talk to the outside: CAPTCHA verification (Cloudflare Turnstile / hCaptcha) and the DNS MX check — see “External services” below.
IPs are stored only as sha256(site_secret + "|" + ip), never as the address itself. The secret is kept in the same database, so the hash stops anyone from simply reading an address; someone with a full copy of the database could still work an IPv4 address out by trying every possible one.
Vault payloads are encrypted at rest with AES-256-GCM (authenticated encryption).
Uninstalling the plugin removes every option, every table and every cron event. Nothing is left behind.

External services

FormGhost’s spam detection runs entirely on your own server. Two optional features, both off by default, connect to third parties. Nothing is sent unless you enable them in the settings.

Cloudflare Turnstile (Layer 9, optional CAPTCHA provider)
When you enable the CAPTCHA layer with Turnstile for a form, the plugin renders the widget container on that form (you add Cloudflare’s widget script https://challenges.cloudflare.com/turnstile/v0/api.js to your site yourself — the plugin does not load any vendor script), and on every submission of that form the plugin sends the widget’s response token, your Turnstile secret key and the visitor’s IP address to https://challenges.cloudflare.com/turnstile/v0/siteverify to verify the challenge.
Terms: https://www.cloudflare.com/terms/ — Privacy: https://www.cloudflare.com/privacypolicy/

hCaptcha (Layer 9, optional CAPTCHA provider)
When you enable the CAPTCHA layer with hCaptcha for a form, the plugin renders the widget container on that form (you add hCaptcha’s widget script https://js.hcaptcha.com/1/api.js to your site yourself — the plugin does not load any vendor script), and on every submission of that form the plugin sends the widget’s response token, your hCaptcha secret key and the visitor’s IP address to https://api.hcaptcha.com/siteverify to verify the challenge.
Terms: https://www.hcaptcha.com/terms — Privacy: https://www.hcaptcha.com/privacy

ALTCHA (Layer 9, optional CAPTCHA provider) is self-hosted: the challenge endpoint and the verification run on your server (admin-ajax.php?action=formghost_altcha_challenge); no data is sent anywhere. You add the ALTCHA widget script to your site yourself.

DNS MX lookup (Layer 6, optional “Check MX records” setting)
When enabled, the plugin asks your server’s DNS resolver for the MX records of the submitted email address’s domain (PHP getmxrr). This is a standard DNS query from your server, not a request to a third-party API; the email address itself is not transmitted, only its domain.

Privacy

FormGhost is designed for privacy-conscious operators.

Data stored on your server.

{prefix}formghost_vault — form submissions FormGhost held (and, if “Store passed submissions” is on, the ones it let through), encrypted with AES-256-GCM using the per-site secret; encryption is on by default and can be switched off in Settings. Each entry also records, unencrypted: the sender’s email domain, the page the form was submitted from, the inbox it was headed to, and keyed hashes of the IP address, browser, sender address and sender name — never the address or IP itself. Configurable retention (default 30 days, at most 10,000 form submissions; login and password-reset attempts are kept 7 days, at most 2,000). Removed on uninstall.
Versions before 1.2.6 stored IP addresses in plain text. Contrary to what this readme said, the stored copy of every WordPress comment FormGhost checked included the commenter’s IP address and browser identification (user agent) as plain text — see the 1.2.6 changelog for which sites and since when. 1.2.6 stops storing them, and updating removes them from entries already in the Vault.
FormGhost’s own technical fields that arrive with a submission — the behavior score and its one-time nonce, and CAPTCHA response tokens — are not stored in the Vault. Entries saved by version 1.2.5 or earlier are cleaned automatically in the background after the update.
{prefix}formghost_learned_rules — score modifiers learned from your reviews and from spam FormGhost caught on its own (honeypot, proof-of-work, bot checks). A rule may hold the sender email address of such a submission, or an IP address stored only as sha256(site_secret + "|" + ip). Rules decay when stale and can be deleted from the Learned Rules screen. Removed on uninstall.
{prefix}formghost_log — one row per decision (blocked / passed, layer, form type) for the dashboard, with a hashed IP address. Purged on the Vault retention schedule. Removed on uninstall.
formghost_template_samples (option) — one sample text per learned message template (at most 500), taken only from submissions held as bots or confirmed as spam, to show on the Learned Rules screen. Removed on uninstall.
formghost_login_watch (option) — daily counts of held login attempts that used an author’s display name, author address name or login name, per user account, for 14 days. No IP address, no password. Removed on uninstall.
{prefix}formghost_counters — failed-login counters for the login rate limit, keyed by keyed hashes of the IP address and of the account; no address, username or password is stored. Each counter lapses after its window (15 minutes by default) and old rows are purged daily. Removed on uninstall. Rate-limit counts for other forms are kept in short-lived WordPress transients under hashed keys.
formghost_site_secret (option) — 64-char random secret used for IP / UA hashing, payload encryption and CSS class derivation. Removed on uninstall.

Emails FormGhost sends. Only to you, through your site’s own mail setup (wp_mail): review alerts (on by default; Settings Notifications) contain the held sender’s name, email address and the first part of their message, so you can recognise a real person; and submissions you forward from the Vault yourself. Links and addresses from the submission are broken up so they cannot be clicked.

Data sent to third parties. None by default. Only the optional services listed under “External services” send anything, and only after you enable them.

Cookies. FormGhost does not set cookies.

For full source, audit, and integration docs, see https://byabdalla.com/lab/formghost.