Description
A CAPTCHA proves the sender is a human being. It does not stop a human being
whose job is to send sales pitches through other people’s contact forms. If you
run a small business in Japan, that is most of what arrives in your inbox.
Robse Form Guard reads each submission and scores its wording. Japanese
business-to-business sales boilerplate — 貴社, ご担当者様, 初期費用,
導入実績 and the like — is language a private customer asking about your work
simply does not use. When enough of it piles up in one message, the submission
is stopped.
Blocked submissions are kept, and can be forwarded to you. Each blocked
submission is saved in a history on your own site (Settings > Robse Form Guard >
History) for 30 days by default, with the reason, the score and the words that
matched. With forwarding turned on (the default), it is also emailed in full to
the site administrator or an address you choose. The history shows whether
each email went out, and can send any entry again, so a copy is not lost when
your site cannot send mail. The visitor is shown a phone number or address you
choose, so a real customer caught by mistake can still reach you.
What it checks
- A honeypot. A field a person cannot see and a script fills in.
- Too fast. A form sent within a few seconds of being shown (3 by
default) was not typed by a person. Cached pages are never caught by this. - A rate limit. Repeated submissions from one address in a short time.
- The wording. Each keyword carries points; the submission is stopped when
the total reaches the score you set. The starting list and every weight are
editable, and you can add your own words. Forms of address and greetings
(貴社, ご担当者様, と申します, 弊社 and so on) are written by companies asking
for a quote as well as by salespeople, so a message that matches only those
is never stopped: something being sold, or a link, has to be there too.
The wording is compared after folding the ways a word can be written:
full-width and half-width letters, upper and lower case, and spaces or
invisible characters slipped into a word (ＳＥＯ, seo, 御 社) all count.
Links are found in http(s)://, www. and example.com/page forms, but a
visitor’s own email address is never counted as a link.
Try it before you trust it
A new installation starts in watch only: it records, and emails you, what
it would have blocked while letting everything through. Run that for a week,
look at the History tab, then turn blocking on. Sites that used an earlier
version keep the mode they had.
Which form plugins
- Contact Form 7
- Snow Monkey Forms
It sits alongside reCAPTCHA, Akismet or Turnstile rather than replacing them:
those stop machines, this stops people who are paid to write to you.
For Japanese sites
The keyword list is Japanese and the plugin is aimed at Japanese-language
sites. On a site in another language, replace the list with your own wording
under Settings.
Privacy
When a submission is stopped (or, in watch-only mode, would have been), the
plugin stores its full contents, the time and the submitting IP address in a
database table of its own ({prefix}robse_form_guard_log). Entries are deleted
automatically after the number of days set on the settings screen (30 by
default, at most 5,000 entries), and can be deleted by hand at any time. The
history can be turned off. It is included in WordPress’s personal data export
and erasure tools, matched by the email address in the submission, and the
plugin suggests wording for your privacy policy.
When forwarding is turned on (the default), the same contents are emailed to
the address configured on the settings screen, which defaults to the site’s
own administration email address. That email is sent by WordPress from the
site itself. No data is transmitted to the plugin author or to any third
party, and the plugin makes no outbound network requests.
The rate limit stores a hashed form of the submitting IP address in a
transient, which expires on its own within the window you configure. The
too-fast check adds a hidden field holding the time the form was shown and a
signature; nothing about the visitor is stored for it.
Uninstalling the plugin removes its settings and the history table.
Installation
- Install and activate the plugin.
- Go to Settings > Robse Form Guard.
- Fill in how a real customer can still reach you — a phone number is the
usual choice. Do not skip this: it is the only way out for someone the
plugin wrongly stops. - The plugin starts in watch only. Leave it so for the first week and read
the History tab (or the emails it sends you). - Switch to block once the verdicts look right.
Rolling it out to many sites
These constants in wp-config.php win over the settings screen, so a
deployment script can configure a site without touching its database:
define( 'ROBSE_FORM_GUARD_TEL', '03-0000-0000' );
define( 'ROBSE_FORM_GUARD_QUARANTINE', 'you@example.com' );
define( 'ROBSE_FORM_GUARD_THRESHOLD', 4 );
define( 'ROBSE_FORM_GUARD_MODE', 'block' ); // or 'monitor'
FAQ
-
It blocked a real customer.
-
Open the History tab, or the email it sent you — both list the words that
matched and the score, and the history keeps what they wrote so you can reply.
Either lower the points on the word that misfired, or raise the score needed
to match. Both are on the settings screen. -
Will it stop bots?
-
The honeypot will stop simple ones. For machine submissions in general, keep
reCAPTCHA, Turnstile or Akismet switched on as well. This plugin is aimed at
the sales messages a human being typed. -
Does it send my form data anywhere?
-
No. Blocked submissions are kept in your own site’s database. The only
message it sends is the copy of a blocked submission, by email and only while
forwarding is turned on, to the address you set on the settings screen — your
own site’s administrator address unless you change it. Nothing is sent to the
plugin author or to any other server. -
The blocked copies are filling my inbox.
-
Read them for the first few weeks. After that you can filter the subject line
into a folder, or turn forwarding off and use the History tab instead. -
Can I use it on a site that is not in Japanese?
-
Yes, but the built-in list will not match anything. Replace it with the sales
boilerplate used in your language.
Reviews
There are no reviews for this plugin.
Contributors & Developers
“Robse Form Guard” is open source software. The following people have contributed to this plugin.
Contributors
“Robse Form Guard” has been translated into 1 locale. Thank you to the translators for their contributions.
Translate “Robse Form Guard” into your language.
Interested in development?
Browse the code, check out the SVN repository, or subscribe to the development log by RSS.
Changelog
2.3.0
- New History tab: every blocked submission, and in watch-only mode every one
that would have been blocked, is kept on your site with the reason, the score,
the matched words and whether the forwarding email went out. Entries can be
read, emailed to you again or deleted, and are deleted automatically after
30 days (adjustable, or turn the history off). - New “too fast” check: a form sent within 3 seconds of being shown is stopped.
The number of seconds can be changed, or the check turned off. - The wording is now compared after folding full-width/half-width letters,
upper/lower case and spaces or invisible characters inside a word, so ＳＥＯ,
seo and 御 社 now match SEO and 御社. Latin-letter keywords such as SEO match
as whole words only. Your saved keyword list keeps working as it is. - Links written as www.example.jp, example.com/page or a defanged hxxp:// now
count as a link. A visitor’s email address never does. - A new installation now starts in watch-only mode. Sites updating from an
earlier version keep their mode.ROBSE_FORM_GUARD_MODEcan set it from
wp-config.php. - A failed forwarding email is now detected and shown in the history.
- Uninstalling now also removes the history table and its scheduled clean-up.
- Requires WordPress 6.2 or later (was 6.0).
2.2.0
- A message whose matches are only forms of address and greetings (貴社,
御社, ご担当者, 担当者様, 代表者様, ご担当者各位, と申します, 突然のご連絡,
初めてご連絡, 弊社, 業者様) is no longer blocked, whatever it scores.
Companies asking for a quote write like this too. The honeypot and the rate
limit are unchanged. The list can be changed with the
robse_form_guard_context_words filter. - と申します, 突然のご連絡 and 初めてご連絡 now carry 1 point instead of 2 in the
starting list. Your saved settings are not changed by the update: if you have
ever pressed Save on the settings screen, the keyword list was saved with the
old points and stays as it is. Edit those three lines, or clear the box to
use the new starting list. - Reworded the settings screen, the plugin description and this readme so that
forwarding of blocked submissions is described as a setting that depends on
your site sending mail, not a guarantee.
2.1.1
- Removed the bundled Japanese translation files. Translations are handled by
translate.wordpress.org.
2.1.0
- First public release.
- Settings screen: mode, score, keyword list, honeypot, rate limit, quarantine
address and the contact route shown to blocked visitors. - Blocked submissions are emailed to the site’s own administrator by default.
- Watch-only mode for tuning before blocking.
2.0.0
- Contact Form 7 support alongside Snow Monkey Forms.
1.0.2
- Internal release for Snow Monkey Forms.