Robse Form Guard

A CAPTCHA proves the sender is a human being. It does not stop a human being
whose job is to send sales pitches through other people’s contact forms. If you
run a small business in Japan, that is most of what arrives in your inbox.

Robse Form Guard reads each submission and scores its wording. Japanese
business-to-business sales boilerplate — 貴社, ご担当者様, と申します,
初期費用, 導入実績 and the like — is language a private customer asking about
your work simply does not use. When enough of it piles up in one message, the
submission is stopped.

Nothing is thrown away. Every blocked submission is emailed to you in full,
with the score and the words that matched, so that if the plugin gets it wrong
you still have the message. The visitor is shown a phone number or address you
choose, so a real customer caught by mistake can still reach you.

What it checks

1. A honeypot. A field a person cannot see and a script fills in.
2. A rate limit. Repeated submissions from one address in a short time.
3. The wording. Each keyword carries points; the submission is stopped when
   the total reaches the score you set. The starting list and every weight are
   editable, and you can add your own words.

Try it before you trust it

Set it to watch only and it will email you what it would have blocked
while letting everything through. Run that for a week, look at what arrives,
then turn blocking on. This is the recommended way to start.

Which form plugins

• Contact Form 7
• Snow Monkey Forms

It sits alongside reCAPTCHA, Akismet or Turnstile rather than replacing them:
those stop machines, this stops people who are paid to write to you.

For Japanese sites

The keyword list is Japanese and the plugin is aimed at Japanese-language
sites. On a site in another language, replace the list with your own wording
under Settings.

Privacy

The plugin stores no personal data of its own and creates no database tables.

When a submission is stopped, its full contents are emailed to the address
configured on the settings screen, which defaults to the site’s own
administration email address. That email is sent by WordPress from the site
itself. No data is transmitted to the plugin author or to any third party, and
the plugin makes no outbound network requests.

The rate limit stores a hashed form of the submitting IP address in a
transient, which expires on its own within the window you configure.