Security, privacy, compatibility, and data-migration update for WordPress 7.1 and Contact Form 7 6.1.7. Back up the site and database before updating.<\/p>"},"ratings":[],"assets_icons":{"icon-256x256.png":{"filename":"icon-256x256.png","revision":3413878,"resolution":"256x256","location":"assets","locale":"","width":512,"height":512}},"assets_banners":{"banner-772x250.png":{"filename":"banner-772x250.png","revision":3413878,"resolution":"772x250","location":"assets","locale":"","width":772,"height":250}},"assets_blueprints":{},"all_blocks":[],"tagged_versions":["1.0.0","1.1.0"],"block_files":[],"assets_screenshots":[],"screenshots":[]},"plugin_section":[],"plugin_tags":[109,1784,1152,598,599],"plugin_category":[54],"plugin_contributors":[251858],"plugin_business_model":[],"class_list":["post-241299","plugin","type-plugin","status-publish","hentry","plugin_tags-antispam","plugin_tags-blacklist","plugin_tags-contact-form-7","plugin_tags-honeypot","plugin_tags-spam","plugin_category-security-and-spam-protection","plugin_contributors-riccardorosignoli","plugin_committers-riccardorosignoli"],"banners":{"banner":"https:\/\/ps.w.org\/digitalezen-antispam-shield-for-cf7\/assets\/banner-772x250.png?rev=3413878","banner_2x":false,"banner_rtl":false,"banner_2x_rtl":false},"icons":{"svg":false,"icon":"https:\/\/ps.w.org\/digitalezen-antispam-shield-for-cf7\/assets\/icon-256x256.png?rev=3413878","icon_2x":"https:\/\/ps.w.org\/digitalezen-antispam-shield-for-cf7\/assets\/icon-256x256.png?rev=3413878","generated":false},"screenshots":[],"raw_content":"\n
DigitaleZen AntiSpam Shield for CF7 protects Contact Form 7 submissions without adding a CAPTCHA or requiring form-tag configuration.<\/p>\n\n
Its checks run through Contact Form 7's supported spam API and include:<\/p>\n\n
Blocked-event data is stored in private WordPress database tables. The default privacy mode stores masked email and IP values together with site-specific HMAC identifiers. Events are removed automatically after 30 days by default; administrators can select a retention period from 1 to 365 days.<\/p>\n\n
The local reputation threshold is deliberately conservative. Learned entries expire after 90 days without new evidence, and administrators can reset all learned reputation after a suspected false positive. The signed JSON blacklist is rebuilt locally with an atomic replacement and a verified database fallback. It contains no plaintext email or IP address.<\/p>\n\n
The dashboard provides local event totals, a text-accessible chart summary, protected CSV export, local-blacklist status, privacy controls, and optional weekly email reports. Weekly reports are disabled by default.<\/p>\n\n
When version 1.1.0 upgrades an existing 1.0.0 installation, it first stores a checksum-verified private backup of known legacy files, imports compatible log and blacklist data, and only then removes those files from the public uploads directory. The original private migration backups remain available for administrator-controlled deletion.<\/p>\n\n
Blocked events are stored locally in WordPress database tables and are subject to the configured retention period. The plugin registers exporters and erasers with the WordPress personal-data tools and adds suggested privacy-policy text under Settings > Privacy<\/strong>.<\/p>\n\n The reputation table and signed local JSON use site-specific HMAC values for email and IP identities. Those values cannot be reused as a shared cross-site blacklist. The JSON is placed in a randomized plugin directory with Apache\/IIS deny rules and a blocking index file; the verified database copy remains the runtime fallback.<\/p>\n\n CSV exports are available only to administrators, require a WordPress nonce, and neutralize spreadsheet formula prefixes.<\/p>\n\n This plugin does not use an external blacklist, CAPTCHA, analytics endpoint, CDN asset, or other external service. All detection, learning, storage, JSON generation, and scheduled cleanup run on the site that installed the plugin.<\/p>\n\n\n No Contact Form 7 form tags or shortcodes need to be added.<\/p>\n\n\n No. The plugin uses an automatic honeypot, signed timing token, rate limiting, and local adaptive blacklist matching.<\/p><\/dd>\n No. The token and honeypot fields are inserted automatically through Contact Form 7 filters.<\/p><\/dd>\n Only submissions classified as spam are logged. By default, the plugin stores the event time, form ID, detection reason, masked email\/IP values, and site-HMAC identifiers. Administrators can choose full identity storage, change retention, export retained events, or delete them.<\/p><\/dd>\n No. Deactivation only removes scheduled tasks. Data is deleted during plugin removal only when the administrator has explicitly enabled Delete all plugin data when the plugin is deleted<\/strong>.<\/p><\/dd>\n No. Weekly CSV reports are opt-in and use the email address selected by an administrator.<\/p><\/dd>\n No. The plugin creates and updates its signed JSON blacklist on the WordPress site itself. It makes no reputation or blacklist request to DigitaleZen, Google, or another provider.<\/p><\/dd>\n Only high-confidence honeypot and repeated rate-limit signals add local reputation evidence. An identity is not promoted to the active blacklist until it reaches the learning threshold. Token errors alone never teach the blacklist, learned entries expire, and an administrator can reset learned reputation.<\/p><\/dd>\n\n<\/dl>\n\n\nExternal services<\/h3>\n\n
\n
\n
Does it require a CAPTCHA?<\/h3><\/dt>\n
Do I need to edit my Contact Form 7 forms?<\/h3><\/dt>\n
What visitor data is stored?<\/h3><\/dt>\n
Does deactivation delete data?<\/h3><\/dt>\n
Are weekly reports enabled automatically?<\/h3><\/dt>\n
Does the blacklist use an external service?<\/h3><\/dt>\n
How does local learning avoid immediate false positives?<\/h3><\/dt>\n
1.1.0<\/h4>\n\n
\n
wpcf7_spam<\/code> API and spam log.<\/li>\n1.0.0<\/h4>\n\n
\n