AIS FormGuard

The administration screens are available in Japanese only. Paid cloud sales-email detection is intended for Japanese-language inquiries only; local protection works regardless of language.

AIS FormGuard protects your Contact Form 7 forms from bot spam, and is designed for site owners who do not have an engineer on staff. A three-step setup wizard checks your environment, lets you choose a protection level, and verifies that everything works. It starts in monitor mode, which only records what it would have blocked, so you can confirm that no real inquiry is affected before you switch to defense mode.

What makes AIS FormGuard different

• It tags, it does not block, anything that could be a real inquiry. Many spam plugins discard whatever they dislike. If you turn on the optional external service, messages that look like sales solicitations are delivered with a tag in the subject line (and, if you wish, to a different recipient), so a genuine inquiry that is misjudged is never lost. Only clear bot signals are blocked.
• See before you block. It starts in monitor mode, which records what it would have blocked without blocking anything. You switch to defense mode only after you have checked the results.
• Several independent signals, on your own server, with nothing to register or buy. Honeypot, signed token, minimum submission time, rate limit, link counter and duplicate detection all run locally and are free. Only the optional sales-email detection needs an API key from a paid plan. There is no CAPTCHA, the plugin adds no JavaScript or stylesheet to your pages, and it contacts an external server only when the site administrator enters an API key and turns on the optional integration.
• Repeat offenders are blocked automatically. Sources that keep triggering strong bot signals are blocked temporarily. While blocked, their submissions are treated as spam by Contact Form 7 and no email is sent. Similar events are grouped into one log line, and a safety check keeps the feature off when the site is behind a proxy it cannot identify.
• Built for people without an engineer. A three-step wizard, plain-language reasons for each detection, a weekly summary email, and a diagnostic summary that never contains message content.

Protection that runs entirely on your own site

• Hidden honeypot field.
• Signed timestamp token that detects forged forms and submissions made too quickly after the form was displayed.
• Per-IP rate limit.
• URL count and duplicate-message checks.
• Automatic temporary blocking of sources that keep triggering strong bot signals (see below).

Automatic blocking of attack sources (defense mode only)

When the same source repeatedly triggers a strong bot signal (a filled honeypot field or a missing token) within a short time, it is blocked for a limited time. While a source is blocked, its form submissions are treated as spam by Contact Form 7, so no email is sent, and the other checks are skipped. The dashboard lists blocked sources, lets you unblock them, and gives you a copy-and-paste list that you can add to your firewall or CDN.

To avoid blocking all visitors by mistake, automatic blocking is disabled when the site appears to be behind a proxy or CDN (such as Cloudflare) and you have not told the plugin which proxies to trust.

Dashboard for non-engineers

• Seven-day totals and a day-by-day graph.
• Reasons for each detection, shown in plain language.
• Similar events are grouped into one line with a counter, so a large attack does not flood your database.
• Weekly summary email.
• One-click return to monitor mode, and a diagnostic summary you can send to support (it contains no message content).

Optional: sales-email detection with an external service

With an API key from a paid plan, the plugin can ask the AIS FormGuard judgement service whether a message that passed the local checks looks like a sales solicitation. Messages judged to be sales solicitations are not blocked. They are delivered with a tag in the subject line (for example “【営業の可能性】”), optionally to a different recipient, so that a genuine inquiry that is misjudged is never lost. This feature is off by default. See “External services” below for exactly what is sent.

Fail-open by design

If anything goes wrong (for example, the optional service is unreachable or slow), the message is allowed through instead of being blocked.

What it does not do

• It is not a CAPTCHA. It can be used alongside Cloudflare Turnstile, Akismet or reCAPTCHA.
• By itself, the plugin does not read the wording of messages. Judging whether a message is a sales solicitation is done only by the optional external service.
• It works with Contact Form 7 only.

Language

The administration screens are currently available in Japanese only. Paid sales-email detection is intended for Japanese-language inquiries only.

Privacy

Data stored on your site

• A log table ({prefix}aisfg_log) that records the time, form ID, decision, reason codes, a hit counter, and the visitor’s IP address with its last part masked (the last octet for IPv4, the lower 80 bits for IPv6). The content of messages is never stored. Log entries are deleted after 30 days by default.
• A table of blocked sources ({prefix}aisfg_ban) that records the full IP address of each blocked source, the reason, counters, and timestamps. Entries are deleted 7 days after the block expires, or when you unblock the source.
• Short-lived counters (WordPress transients) keyed by a hash of the IP address.
• Plugin settings. If you use the optional service, the API key you enter is stored in the WordPress options table.

IP addresses can be personal data under some privacy laws. We recommend mentioning the use of this plugin in your site’s privacy policy.

Data sent to external services

Only if you enable the optional sales-email detection. See “External services”.
AI judgement uses Amazon Bedrock (AWS Tokyo region); see External services.

External services

This plugin can optionally connect to the AIS FormGuard judgement service, operated by AIStream Corporation (https://www.aistream.co.jp/), to check whether an enquiry looks like a sales or solicitation email. This feature is off by default. The plugin connects only after a site administrator enters an API key and turns on “Use sales-email detection”.

• Service endpoint: https://vtrsplxud8.execute-api.ap-northeast-1.amazonaws.com/prod (operated by AIStream Corporation on Amazon Web Services, Tokyo region).
• When a Contact Form 7 form is submitted, the plugin sends the site URL, form ID, the visitor’s IP address with the last part masked, simple submission signals (such as time to submit and message length), and the submitted field values with email addresses and phone numbers replaced by placeholders. The message text may be processed by Amazon Bedrock (AWS, Tokyo region) for AI judgement. The message text is not stored on the server.
• When the integration is turned on, and when the settings screen is opened or saved (and at most once per hour during submissions), the plugin sends the site URL, plugin version and WordPress version to check the plan and bind the API key to the site.
• The API key is sent in an HTTP header with every request.
• The purchase button only opens our purchase page (https://d3a2ozkjmvji3q.cloudfront.net/buy.html) in the administrator’s browser; the plugin itself does not request it. Payment is handled by Stripe Checkout.

Nothing is sent unless the optional integration is turned on. WordPress user accounts and passwords are never sent.

• AIS FormGuard Terms of Use: https://www.aistream.co.jp/ais-form-guard-tou/
• AIStream Corporation Privacy Policy: https://www.aistream.co.jp/privacy-policy/
• AWS: https://aws.amazon.com/service-terms/ , https://aws.amazon.com/privacy/
• Stripe: https://stripe.com/legal/ssa , https://stripe.com/privacy

This plugin does not contact Cloudflare. Cloudflare Turnstile, if used, is configured in Contact Form 7.