Zero Spam is a free anti-spam plugin for WordPress that stops spam bots before they post: no captchas, no moderation queue, nothing to clean up. It protects your comments, logins, registrations and the forms you already use, and it runs on more than 20,000 WordPress sites.

Bots bounce. People get through.

Most anti-spam tools either let spam in and leave you to sort it, or make every visitor prove they are human. Zero Spam does neither. It checks each comment, login, sign-up and form submission quietly in the background and turns bots away at the door. Real visitors never see a puzzle, and your comment queue and inbox stay clean.

Why site owners choose Zero Spam

No captchas. Visitors don’t click on traffic lights, so you keep the comments, sign-ups and sales a captcha drives away.
No moderation queue. Spam is refused before it is saved, so there is nothing to review or delete.
Protected in about a minute. Activate it and a short guided setup turns on the recommended protection.
See exactly what was stopped. A clear overview, a searchable activity log and reports by day, hour, type and country.
You can’t lock yourself out. Your own address is never blocked, and if anything goes wrong an emailed rescue link gets you back in.
Light on your site. Built-in checks run on your own server, and answers from outside services are cached, so a visitor is looked up once, not on every page.
Free and open source. GPL licensed, on WordPress.org since 2014, with every line of code on GitHub.

What Zero Spam protects

Comments, including bots that post without ever loading your form.
Logins on wp-login.php, and XML-RPC, which bots use to try many passwords at once (turned off by default).
Registrations, including fake accounts and throwaway email addresses.
Your forms, from contact and newsletter forms to checkout and donation forms (the full list is below).
Your whole site, if you choose: block known bad addresses, or whole countries, regions and cities, from every page.

How it stops spam

Zero Spam uses layers, so a bot that gets past one meets the next. Every layer can be turned on or off.

Built-in bot checks: a hidden check that bots fail and people never notice, blocked words, and a list of disposable email domains.
Reputation checks (optional, free): Stop Forum Spam and Project Honeypot recognise addresses already reported for spam.
Your own rules: block addresses, countries, regions, cities or postcodes, for good or for a set time. Location rules use a free key from ipbase, IPinfo or ipstack.
Enhanced Protection (optional, paid): real-time checks against the Zero Spam network’s reputation database. It needs a license key from zerospam.org.

Works with the plugins you already use

Forms: Contact Form 7, WPForms, Gravity Forms, Formidable Forms, Fluent Forms and Elementor Pro forms.
Stores and donations: WooCommerce customer registrations, and GiveWP donation forms, where it helps stop card testing with stolen cards.
Memberships and newsletters: ProfilePress registrations and Mailchimp for WordPress sign-ups.

Setup switches on protection for each one it finds; turn on any you add later under Zero Spam › Protection › Integrations.

Built for agencies, hosts and networks

Multisite: set network defaults, lock the settings sites can’t change, apply templates, compare sites, read an audit log and block an address on every site at once.
Automation: manage settings with the REST API and WP-CLI, and extend Zero Spam with documented hooks.
Behind a CDN or proxy: Cloudflare is recognised automatically, and you can list any other proxy, so Zero Spam sees each visitor’s real address.

Your data stays yours

Zero Spam works without any outside service, and its activity log stays in your own database. Services that receive data about your site or visitors are only contacted once you choose them, either in setup, which shows you what each one receives, or in the settings. The External services section below lists exactly what each one receives, with its terms of use and privacy policy.

Get started

Install Zero Spam from Plugins › Add New and activate it.
Open Zero Spam in the admin menu, below Comments.
Follow the short setup. Your site is protected as soon as you finish.

Questions? The built-in Help screen has every guide, and the wiki covers the developer reference.

Source code and build

The plugin’s complete source code is on GitHub: Highfivery/zero-spam-for-wordpress. The admin scripts and styles in assets/dist/ are built from the human-readable sources in assets/src/ with @wordpress/scripts. To build them yourself, check out the repository and, with Node.js 22, run npm ci && npm run build. The sources in assets/src/ and the build tools are not part of the plugin download (they are listed in .distignore); get them from the repository. The fonts in assets/fonts/ (Plus Jakarta Sans and JetBrains Mono, SIL Open Font License 1.1) are included unmodified; their sources are listed in assets/fonts/FONTS.md.

External services

Zero Spam works without any external service. The services below are only contacted when the feature that uses them is turned on, and only send what is listed. The only one on by default is the Zero Spam news feed, which sends nothing about your site or visitors. Stop Forum Spam is offered, with what it sends, in first-run setup; Usage Data Sharing starts off.

Zero Spam news (zerospam.org)

When the “Zero Spam News” setting is on (it is by default), the Zero Spam admin screens show the latest articles and security notices from zerospam.org. Your server downloads the public feed at https://www.zerospam.org/articles/feed/ at most once every six hours (once for a whole network), and at most once an hour after a failed download. The request carries only a generic user agent (“Zero Spam for WordPress/” and the plugin version): no site address, no user or visitor data. Turn it off under Settings, or with the zerospam_news_feed_enabled filter. Terms of use, privacy policy.

Zero Spam API (zerospam.org)

Used for Enhanced Protection and for sharing detections. Terms of use, privacy policy.

License check: when you save a license key, and to show its status in the admin (cached for up to 12 hours), the key is sent to https://www.zerospam.org/wp-json/v2/get-license.
Enhanced Protection: when it is on and a license key is set, the IP address of a visitor who is not logged in is sent with your license key to https://www.zerospam.org/wp-json/v3/query to check its reputation. Answers are cached on your site.
Test my protection: with Enhanced Protection on, running “Test my protection” sends a fixed test IP address with your license key to https://www.zerospam.org/wp-json/v3/query.
Usage Data Sharing: off unless you turn it on (in the setup or under Settings). When it is on, each detection is reported to https://www.zerospam.org/wp-json/v6/report/ in the background: the detection type and reason, the visitor’s IP address, the email address, names and username entered in the blocked submission (if any), and your site’s domain, name, tagline, administrator email address, language, WordPress version and plugin version.

Stop Forum Spam

When the Stop Forum Spam check is on, the following are sent to https://api.stopforumspam.org/ to check their reputation, unless the visitor is logged in or on your allowlist: the visitor’s IP address (on page requests, the login and registration forms and XML-RPC), the email address of a comment author (when comments are protected), and the email address and IP address of a new registration (when registrations are protected, on single sites: a network’s sign-up page is not checked; usernames are never sent). Running “Test my protection” sends a fixed test IP address instead. Like every WordPress request, these also carry your site’s address in the user agent. Answers are cached on your site: for a day when nothing is listed, otherwise for the Cache Expiration you set (14 days by default). After repeated failures, lookups pause for 10 minutes. Terms of use, privacy policy.

Project Honeypot

When a Project Honeypot http:BL access key is set, the visitor’s IPv4 address (reversed) and your access key are looked up by DNS under dnsbl.httpbl.org. Terms of use, privacy policy.

Geolocation: ipbase, IPinfo and ipstack

When you enter an API key for one of these services, the IP address of visitors who are not logged in (on page requests, and for each logged detection) is sent with your key to look up its location (country, region, city), which is used for location blocks and stored with detections in the log. Answers are cached on your site for the Cache Expiration you set (14 days by default, or 30 days for ipbase with the recommended settings).

ipbase: https://api.ipbase.com/. Terms of service, privacy policy.
IPinfo: https://api.ipinfo.io/. Terms, privacy policy.
ipstack: http://api.ipstack.com/ (ipstack’s free plan does not offer HTTPS). Terms, privacy policy.

Addresses you configure

API usage alerts: when you enter a webhook address under API Monitoring, alerts are posted to it with the alert type, message, your site’s address and name and the usage figures. Addresses on your own server or private network are refused unless a developer allows them.
Email checks: to tell whether an email address can receive mail, the domain of email addresses entered in protected forms is looked up through your server’s DNS resolver.