Data443 Anti-Spam

Data443 Anti-Spam extracts every URL from a comment and classifies it against the Data443 classification API. A comment linking to malware, phishing, or another flagged category is held for moderation or sent straight to spam — your choice. The verdict comes from live URL classification, so there are no keyword rules to maintain and no local list of bad words.

What it does

• Checks comments as they are submitted, before the comment row is written — and comments inserted programmatically by importers, WP-CLI, or other plugins.
• Checks Contact Form 7 submissions when that plugin is active. A flagged submission is marked as spam, with the reason recorded in Contact Form 7’s own spam log.
• Records the verdict, the matched categories and a timestamp on each comment, shown in an “Anti-Spam Status” column. Opening a comment shows every link that was classified and what the API said about it.
• Adds Comments → Anti-Spam Stats: totals, the last 30 days as a chart, and the comments where your moderation disagreed with the plugin. Readable by anyone who can moderate comments.
• Sweeps existing comments on demand, and includes a Test URLs tool for checking links by hand.
• Has a Check Connection button that tests each step between your site and the API in order and names the first one that fails.
• Holds a comment for moderation if the API cannot be reached and retries it in the background, rather than publishing something nothing has checked.
• Reports misconfiguration instead of failing quietly, with each notice linking to the fix and shown only to users who can apply it — plus one master switch that turns everything off.

Requirements

The Data443 classification API is a paid service with a free 30-day trial. A card is required to start the trial, but nothing is charged during it: cancel before the 30 days are up and you are charged nothing at all, and after that you can cancel any time. The endpoint comes filled in and subscribing is two clicks — the credentials install themselves, with nothing to copy or paste. Until the site is subscribed nothing is evaluated and WordPress moderates comments exactly as before.

Multisite

Runs per site. Each site has its own endpoint, subscription, settings and results, and one subscription covers one site. There is no network settings screen and nothing for a network administrator to do.

External Services

Data443 classification and subscription API

The plugin sends the URLs found in comments and Contact Form 7 submissions to https://websecjd-rest.data443.io/ to have them classified, and uses the same service to set up and manage this site’s subscription. The classification is what decides whether a comment is spam, so the plugin cannot do its job without it. Clearing the API Endpoint setting stops every request below.

What is sent, and when:

• Complete URLs, including their paths and query strings, with an access token — whenever a comment or Contact Form 7 submission containing a link is checked, when an administrator runs the bulk sweep or the Test URLs tool, and when a comment held by an earlier failure is retried in the background. A URL can itself contain personal information in its path or query. Comment text, author names and email fields are not sent.
• https://example.com/, as a probe — when an administrator clicks Check Connection.
• A random site identifier generated by this plugin, and a one-time claim token — when an administrator starts a subscription, so that the credentials issued at checkout can be collected by this site afterwards.
• The client ID and secret Data443 issued to this site, exchanged for a short-lived access token at Data443’s identity provider, https://keycloak.data443.io/ — whenever the cached token expires.
• No other content is added by the plugin, though WordPress attaches its standard user-agent header, which includes your site’s address.

This service is provided by Data443 Risk Mitigation, Inc.: terms of service / EULA, terms for support and maintenance services, privacy policy.

Stripe

Subscribing and managing billing open Stripe-hosted pages in the administrator’s browser, and Stripe reports the resulting subscription status back to Data443. The purchaser gives Stripe an email address, card details and whatever billing information Stripe requires; the plugin neither sees nor stores any of it. Nothing reaches Stripe unless an administrator opens one of those pages.

This service is provided by Stripe, Inc.: consumer terms of service, Stripe services agreement, privacy policy.