MDL Spam Filter is an anti-spam plugin for site owners who rely on contact forms and want spam stopped before it reaches an inbox.
It works with Contact Form 7, WPForms, Gravity Forms, Elementor forms, and most other form plugins without needing per-plugin setup, and it screens submissions on the server rather than adding a CAPTCHA or any friction for visitors.
Detection runs through a sequence of checks starting with fast, free methods such as an allow and deny list, a honeypot field, a minimum submit time, rate limiting, a language guard, and keyword matching.
Optional AI classification runs last, using a provider you choose: Anthropic Claude, OpenAI’s GPT models, or any OpenAI-compatible custom endpoint, connected with your own API key entered in the plugin’s settings. When AI is not enabled, no external service is contacted at all, and results of every check appear in the plugin’s own dashboard, review queue, and filter log inside WordPress.
Powered by Fabio ChatBot
Is MDL Spam Filter yours?
Tell readers what is limited and unlimited in the free version, and what the AI does in your plugin. Help them decide faster and reach the people already looking at it. In return, you answer their questions.
Key Features of MDL Spam Filter
Detection Methods
Layered, cost-ordered checks. Submissions pass through allow/deny lists, a honeypot field, a minimum submit time, rate limiting, a language guard, and keyword matching before any AI call, so most spam is stopped instantly and at no cost.
Keyword filtering. A built-in library of over 200 keywords organized into toggleable categories can be combined with unlimited custom terms, including regular-expression patterns, and each keyword shows a hit counter so ineffective ones are easy to spot.
Optional AI classification. When enabled, submission text is sent to Anthropic, OpenAI, or a custom OpenAI-compatible endpoint for a yes/no spam verdict, with a keyword fallback if the provider is unreachable so an outage does not let spam through.
Custom detection rules. Detection rules for the AI check can be written by hand or drafted automatically with a rule-generating assistant based on a plain-language description of the business, combining built-in and custom rules as needed.
Blocking and Bot Traps
Silent or visible blocking. Blocked visitors can either see the form’s normal success message with the submission quietly dropped, or a message telling them it was flagged as spam.
Language and script guard. Submissions can be blocked or allowed by language or alphabet, and the plugin also traps words that mix Latin characters with look-alike Cyrillic letters, a common trick used to evade keyword filters.
Allow and deny lists. Senders can be permanently allowed or blocked by email, domain, or IP, with one-click actions available directly from the log and review screens.
Outgoing email suppression. When a submission is judged spam, every email it would trigger, including the admin notification and any autoresponder, is suppressed so nothing reaches an inbox.
Review, Logging and Reporting
Review queue. Keyword and AI-flagged submissions can be held for manual review rather than dropped, letting an admin accept, block, or manage the sender directly from the queue.
Private filter log. Blocked submissions can optionally be recorded in a dedicated, searchable log with CSV export, hashed IP storage for privacy, and automatic cleanup after a configurable retention period.
Notifications and digest. A central notification address can receive alerts for held submissions, provider errors, and an optional weekly digest summarizing blocked totals and detection activity.
Analytics dashboard. A dashboard shows blocked-submission trends, detection-method breakdowns, top blocked senders, and a system-health overview covering protection status and scheduled maintenance.
How to Install MDL Spam Filter
Step 1: Install and activate. In the WordPress dashboard go to Plugins > Add New Plugin, search for MDL Spam Filter, click Install Now, then Activate.
Step 2: Open the settings page. Go to the MDL Spam Filter menu in the admin sidebar and open Settings to begin configuring detection.
Step 3: Choose a detection mode. Under Settings > Detection engine, pick keywords only, AI only, or keywords followed by AI.
Step 4: Connect an AI provider (optional). If using AI detection, select a provider such as Anthropic or OpenAI, or a custom OpenAI-compatible endpoint, and enter your API key.
Step 5: Set targeting and notifications. Optionally limit scanning to specific forms under Form targeting, then set a notification email under Settings > Notifications and send a test message.
Step 6: Test and monitor. Submit a test message through a contact form to confirm it is processed, then watch the Review and Filter Log screens as real submissions arrive.
Good to Know About MDL Spam Filter
The documentation notes that no API key is required for keyword-only detection, since AI classification is only contacted when explicitly enabled or when the rule-generating assistant is used.
Blocked submissions are stored only in the plugin’s own database table, never in the connected form plugin’s entries or email log, and submitter IPs are kept as one-way hashes. Fields whose names suggest passwords, tokens, or payment details are excluded from both AI requests and stored log excerpts.
API keys can be defined in wp-config.php instead of the database and are never included in settings exports. The developer also notes that WordPress cron only runs when the site receives visits, so scheduled cleanup on quiet sites may show as overdue until a real cron job is configured.
Download MDL Spam Filter on WordPress.org