Title: MentoGuard – Spam Blocker & reCAPTCHA Alternative for Contact Form 7 Author: H. Bakhtiari Published: 29. meje 2026 Last modified: 21. awgusta 2026 --- Tykače pytać ![](https://ps.w.org/mentoguard/assets/banner-772x250.png?rev=3658468) ![](https://ps.w.org/mentoguard/assets/icon-256x256.png?rev=3658468) # MentoGuard – Spam Blocker & reCAPTCHA Alternative for Contact Form 7 Wot [H. Bakhtiari](https://profiles.wordpress.org/hbakhtiari/) [Sćahnyć](https://downloads.wordpress.org/plugin/mentoguard.1.8.6.zip) * [Podrobnosće](https://hsb.wordpress.org/plugins/mentoguard/#description) * [Pohódnoćenja](https://hsb.wordpress.org/plugins/mentoguard/#reviews) * [Instalacija](https://hsb.wordpress.org/plugins/mentoguard/#installation) * [Wuwiće](https://hsb.wordpress.org/plugins/mentoguard/#developers) [Podpěra](https://wordpress.org/support/plugin/mentoguard/) ## Wopisanje Tired of spam emails flooding your inbox from your contact form? MentoGuard is a lightweight, privacy-first spam blocker that protects your Contact Form 7 forms from bots – without annoying your real visitors with image puzzles or checkbox challenges. If you are looking for a reliable reCAPTCHA alternative that is fully GDPR compliant, MentoGuard stops spam bots silently using behavioral analysis and server-side token verification. Zero data is sent to Google or any external server. Ever. Currently optimized for **Contact Form 7 (CF7)**, with support for more form builders coming in future releases. #### How It Works MentoGuard uses five independent protection layers that work together invisibly: 1. **IP Blacklist** – known bad IPs are blocked instantly before any other check runs. Supports IPv4, IPv6, and CIDR ranges. 2. **Signed Token** – every form load generates a unique one-time server-side token. Headless bots that submit without loading the page are blocked immediately. 3. **Submission Timing** – measures the time between page load and form submission entirely server-side. Bots submit in milliseconds; real users take seconds. 4. **Behavioral Score** – JavaScript silently tracks mouse movement, typing patterns, field interaction order, and paste vs keyboard input to generate an accurate spam score. 5. **JS Bypass Detection** – if a bot disables JavaScript entirely to avoid tracking, MentoGuard catches it server-side. Real users pass all five layers without ever knowing they exist. #### Why Choose MentoGuard Over reCAPTCHA? * **No Google dependency** – reCAPTCHA sends visitor data to Google servers. MentoGuard keeps everything on your own server. * **No puzzles, no friction** – real visitors never click a checkbox or identify traffic lights. Protection is completely invisible. * **GDPR-friendly by design** – no cookies, no third-party requests, no data leaving your server. * **Zero page speed impact** – scripts only load on pages that contain an active contact form. Every other page is completely unaffected. * **No monthly fees** – MentoGuard is free and open source. No API keys, no account registration, no renewal. #### Key Features * Native Contact Form 7 tag – place [mentoguard] directly inside the CF7 form editor * Three protection presets – Relaxed, Balanced, Strict – one click to configure * Per-signal control – enable or disable each behavioral signal and adjust its point value * Configurable block threshold – set exactly how aggressive the spam filter should be * Page time protection – configurable minimum time in seconds or milliseconds * Spam Log dashboard – every blocked submission logged with IP, score, signals, and page URL * Top Spammers page – IPs ranked by blocked attempt count with one-click blacklist addition * IP Blacklist – manually add IPs or CIDR ranges permanently blocked before any other check * Test Mode – see live spam scores without blocking anyone, perfect for tuning * Debug Log – step-by-step validation showing exactly what happened for every submission * Bulk log management – select and delete individual entries or clear all at once * Automatic log retention – configurable from 30 days to forever * Translation ready – full i18n support with .pot file included #### Privacy MentoGuard stores only the IP address and spam score of blocked submissions – in your own WordPress database. No data is transmitted to any external service at any time. On uninstall, all data is removed completely. #### Usage with Contact Form 7 Add [mentoguard] inside your CF7 form editor, before the submit button: [text* your-name] [email* your-email] [mentoguard] [submit „Send“] That is all. MentoGuard registers as a native CF7 form tag and activates automatically. ## Fota wobrazowki [⌊Dashboard - spam statistics, recent blocked submissions, and quick actions⌉⌊Dashboard- spam statistics, recent blocked submissions, and quick actions⌉[ Dashboard – spam statistics, recent blocked submissions, and quick actions [⌊Spam Logs - filterable table with date, IP, score, triggered signals, and bulk delete⌉⌊Spam Logs - filterable table with date, IP, score, triggered signals, and bulk delete⌉[ Spam Logs – filterable table with date, IP, score, triggered signals, and bulk delete [⌊Top Spammers - IPs ranked by attempt count with one-click blacklist⌉⌊Top Spammers- IPs ranked by attempt count with one-click blacklist⌉[ Top Spammers – IPs ranked by attempt count with one-click blacklist [⌊Settings - presets, behavioral signals, time protection, IP blacklist, and threshold controls⌉⌊Settings - presets, behavioral signals, time protection, IP blacklist, and threshold controls⌉[ Settings – presets, behavioral signals, time protection, IP blacklist, and threshold controls [⌊Debug Log - step-by-step validation output for every form submission⌉⌊Debug Log- step-by-step validation output for every form submission⌉[ Debug Log – step-by-step validation output for every form submission ## Instalacija 1. Upload the mentoguard folder to /wp-content/plugins/ 2. Activate through the Plugins menu in WordPress 3. Add [mentoguard] inside your CF7 form editor before the submit button 4. Go to MentoGuard > Settings and choose a preset – Balanced is recommended 5. Enable Test Mode first to verify real users score below the block threshold ## HSP ### Is MentoGuard a reCAPTCHA alternative? Yes. MentoGuard replaces reCAPTCHA with server-side behavioral analysis and token verification. No Google account required, no data sent externally, fully GDPR compliant. ### Will it block real users by mistake? MentoGuard uses a scoring system across multiple independent signals. Real users rarely trigger enough signals to reach the block threshold. Enable Test Mode before going live to verify scores on your own site. ### Does it work with Contact Form 7? Yes. MentoGuard registers as a native CF7 form tag. Place [mentoguard] inside the CF7 form editor and it works immediately – no other configuration needed. ### Is it GDPR compliant? Yes. No data leaves your server. Only blocked submissions are logged in your own WordPress database. Log retention period is configurable. All data is deleted on plugin uninstall. ### Does it affect page speed or SEO? No. MentoGuard scripts load only on pages containing a CF7 form with [mentoguard]. All other pages are completely unaffected – no scripts, no styles, no impact. ### Can I block specific IPs permanently? Yes. The IP Blacklist supports individual IPv4 and IPv6 addresses as well as CIDR ranges (e.g. 192.168.0.0/24). Blacklisted IPs are blocked before any other validation runs. ### What is the Debug Log? Enable Debug Mode in Settings, submit a form, then go to MentoGuard > Debug Log. You will see every validation layer – what was checked, what was found, and exactly why the submission was allowed or blocked. ### Will other form builders be supported? Yes. The core protection engine is form-builder agnostic. Contact Form 7 is the first integration. More form builders are planned for future releases. ## Pohódnoćenja Za tutón tykač pohódnoćenja njejsu. ## Sobuskutkowarjo a wuwiwarjo „MentoGuard – Spam Blocker & reCAPTCHA Alternative for Contact Form 7“ je softwara wotewrjeneho žórła. Slědowacy ludźo su k tutomu tykačej přinošowali. Sobuskutkowarjo * [ H. Bakhtiari ](https://profiles.wordpress.org/hbakhtiari/) * [ mentotex ](https://profiles.wordpress.org/mentotex/) [Přełožće „MentoGuard – Spam Blocker & reCAPTCHA Alternative for Contact Form 7“ do swojeje rěče.](https://translate.wordpress.org/projects/wp-plugins/mentoguard) ### Na wuwiću zajimowany? [Přehladajće kod](https://plugins.trac.wordpress.org/browser/mentoguard/), hladajće do [SVN-repozitorija](https://plugins.svn.wordpress.org/mentoguard/) abo abonujće [wuwiwanski protokol](https://plugins.trac.wordpress.org/log/mentoguard/) přez [RSS](https://plugins.trac.wordpress.org/log/mentoguard/?limit=100&mode=stop_on_copy&format=rss). ## Protokol změnow #### 1.8.6 * Update: Plugin display name updated #### 1.8.5 * Fix: IP validation in blacklist Ajax handler uses FILTER_VALIDATE_IP * Fix: min_score filter uses absint() inline * Fix: sanitize_time_value() capped at 9999 #### 1.8.4 * Fix: All inline script tags replaced with wp_add_inline_script() * Fix: Each POST field individually sanitized with sanitize_text_field() and wp_unslash() * Fix: CIDR mask validation now checks 0-32 for IPv4, 0-128 for IPv6 #### 1.8.3 * Fix: Plugin name trademark issue resolved * Fix: Logger queries restructured to satisfy Plugin Check static analysis #### 1.8.0 * Fix: All Plugin Check warnings resolved * Fix: Score badge colors – blocked entries always orange or red, never green * Fix: Emoji replaced with Dashicons throughout admin * Add: README.md for GitHub * Add: Debug Mode and Debug Log page #### 1.7.2 * Fix: CF7 REST API token conflict resolved #### 1.7.0 * Fix: CF7 submits via REST API – switched to wpcf7_spam filter * Add: Token auto-refresh after successful CF7 submission #### 1.6.0 * Add: IP Blacklist with CIDR range support * Add: Top Spammers page with one-click blacklisting * Add: Daily cron job for automatic log retention purge #### 1.5.0 * Fix: All database queries use $wpdb->prepare() * Fix: All input reads include wp_unslash() and inline sanitization * Add: Silence files in all directories * Add: languages/ folder with .pot file #### 1.4.0 * Add: Page time protection – server-side timing check * Add: Configurable minimum time in seconds or milliseconds #### 1.3.0 * Add: Signed one-time server-side token system * Add: JS bypass detection #### 1.2.0 * Add: Bulk delete in Spam Logs * Fix: Score badge color logic * Fix: Server-side blocking reads threshold settings correctly #### 1.0.0 * Initial release ## Meta * Version **1.8.6** * Last updated **1 měsac** * Active installations **Mjenje hač 10** * WordPress version ** 6.0 abo nowši ** * Tested up to **7.0.6** * PHP version ** 8.0 abo nowši ** * Language * [English (US)](https://wordpress.org/plugins/mentoguard/) * Tags * [anti-spam](https://hsb.wordpress.org/plugins/tags/anti-spam/)[bot protection](https://hsb.wordpress.org/plugins/tags/bot-protection/) [contact form 7](https://hsb.wordpress.org/plugins/tags/contact-form-7/)[GDPR](https://hsb.wordpress.org/plugins/tags/gdpr/) [spam](https://hsb.wordpress.org/plugins/tags/spam/) * [Rozšěrjeny napohlad](https://hsb.wordpress.org/plugins/mentoguard/advanced/) ## Pohódnoćenja No reviews have been submitted yet. [Your review](https://wordpress.org/support/plugin/mentoguard/reviews/#new-post) [See all reviews](https://wordpress.org/support/plugin/mentoguard/reviews/) ## Sobuskutkowarjo * [ H. Bakhtiari ](https://profiles.wordpress.org/hbakhtiari/) * [ mentotex ](https://profiles.wordpress.org/mentotex/) ## Podpěra Chceće něšto prajić? Trjebaće pomoc? [Forum pomocy pokazać](https://wordpress.org/support/plugin/mentoguard/)