CleanTalk's blog

Sign Up

Stop spam without frustrating your visitors

Create your CleanTalk account and start blocking spam — no CAPTCHA challenges and no impact on visitors.

Security Block Lists

CleanTalk Account

No credit card required • Setup takes less than a minute • Your temporary password will be sent by email.

Category: WordPress

  • GiveWP – Spam Protection guide in 2026

    GiveWP – Spam Protection guide in 2026

    CleanTalk has added spam protection for GiveWP using direct form integration. This makes it a good opportunity to explore how to protect GiveWP against spam submissions using both built-in anti-spam tools integrated into the plugin core and third-party solutions. We will start with CleanTalk and then move on to Akismet, Google reCAPTCHA, Cloudflare Turnstile, honeypot techniques, and universal anti-spam plugins available on WordPress.org.

    Testing spam protection for GiveWP.

    GiveWP – Donation & Fundraising Plugin for WordPress

    In case of any misunderstanding or misinterpretation about which plugin we are referring to, allow me to provide a brief overview of GiveWP

    GiveWP is a powerful WordPress donation plugin that helps nonprofits, charities, and organizations accept online donations directly on their websites. It allows you to create fully customizable donation forms and securely collect one-time or recurring donations without relying on third-party fundraising platforms. GiveWP supports popular payment gateways such as PayPal and Stripe, making it easy for donors to contribute using their preferred payment method. The plugin includes detailed donation reports, donor management tools, and fundraising goal tracking to help you monitor performance and grow contributions. With a wide range of add-ons and integrations, GiveWP scales from small fundraising campaigns to large nonprofit organizations. Designed to follow WordPress best practices, GiveWP is a reliable and flexible solution for online fundraising.

    According to WordPress.org, over 100,000 websites use this plugin.

    Install GiveWP – Donation Plugin and Fundraising Platform

    Show Instructions

    To have the plugin installed follow this steps,

    1. Search for the plugin in WordPress console -> Plugins -> Add plugin -> Search -> givewp

    GiveWP plugin in WordPress catalog.

    2. Install and Activate the plugin.

    3. Add a campaign and forms in WordPress console -> GiveWP -> Campaigns -> Forms.

    GiveWP. First campaign and form.

    That’s all! GiveWP is installed.

    Anti-Spam plugin by CleanTalk for WordPress

    The next plugin we are going to use is the Anti-Spam plugin by CleanTalk. Here is a short description of it,

    CleanTalk Anti-Spam plugin for WordPress protects your site from spam comments, contact forms, registrations, and fake donations without CAPTCHA. It uses cloud-based spam detection and real-time databases to block bots automatically while keeping the experience smooth for real users. CleanTalk works in the background and requires minimal setup, making it a reliable hands-off anti-spam solution.

    CleanTalk has additional features like Block and Allow lists to manage specific Emails, IPs, Countries, custom frontend message to blocked donations and Emails obfuscation which might be helpful during fundraising events.

    According to WordPress.org, over 200,000 websites use this plugin. All features of Anti-Spam plugin for WordPress.

    How to install CleanTalk Anti-Spam plugin

    Show Instructions

    To install the Anti-Spam plugin, go to your WordPress admin panel → Plugins → Add New.

    Then enter «СleanTalk» in the search box and click the Install button for «Spam protection, Anti-Spam, FireWall by CleanTalk».

    After installing the plugin, click the «Activate»‎ button.

    After it is done go to the plugin settings and click the «Get Access Key Automatically» button. Then just click the «Save Settings»‎ button.

    That’s it! GiveWP is completely protected, let’s see how to test the protection.

    How to check spam protection for GiveWP Forms

    You can test the work of Anti-Spam protection for GiveWP by using a test email,

    stop_email@example.com

    1. First, open the form in an Incognito browser tab.
    2. Choose amount to donate.
    3. In the next step fill out the account name data and the stop_email@example.com.
    4. You must see a message as below and in the screenshot.

    *** Forbidden. Fraud prevention. Sender blacklisted. Anti-Spam by CleanTalk. ***

    Testing spam protection for GiveWP.

    In addition, in the Cloud Dashboard you can find extra details regarding all submissions for the donation form,

    • IP, Email of the donator. As well as history of activity a sender among other sites connected to CleanTalk’s cloud.
    • Geolocation of the sender.
    • Date and time of submission.
    • Page (URL) of the submission.
    • Cloud decision – Approved, Denied.
    • Cloud explanation for the decision.
    • Tools to move the sender to Block or Allow lists.
    Anti-Spam log in the CleanTalk's Dashboard.

    What additional anti-spam tools are available for GiveWP?

    Here are a few more tools on the market,

    1. Akismet is a cloud-based anti-spam service that works in the background and has excellent compatibility with WordPress. Most importantly, the GiveWP team has included Akismet integration directly in the core of the plugin, providing a seamless user experience for those who choose Akismet as their anti-spam solution. Akismet settings are located under WordPress console -> GiveWP -> Settings -> Advanced -> Akismet SPAM Protection. Here is full guide how to setup protection.
    2. Honeypot anti-spam techniques protect websites by adding invisible form fields that real users never see but spambots automatically fill in. When these hidden fields are completed, the submission is flagged and blocked, stopping spam without CAPTCHAs or user interaction. GiveWP has built-in honeypot which is located under settings WordPress console -> GiveWP -> Settings -> Security -> Enable Honeypot Field. This option is On in default setting, so should filter some primitive spam bots out of the box.
    3. reCAPTCHA is a spam protection technology by Google that helps protect WordPress websites by distinguishing real users from bots using challenges or behavioral analysis. It reduces automated spam submissions but may require user interaction, such as clicking a checkbox or solving a challenge. GiveWP supports reCaptcha in the core and settings are located by path WordPress console -> GiveWP -> Settings -> General -> Access Control -> reCaptcha. The first step to activate this protection is getting Site and Secret keys, which are available on website.
    4. Turnstile by Cloudflare is another great anti-spam tool which is available for GiveWP. Protects WordPress websites by verifying visitors automatically without CAPTCHAs or puzzles. It blocks bots using browser and behavioral signals while keeping the experience seamless for real users. One drawback is to use Turnstile user must install extra plugin – ‘Give – Cloudflare Turnstile’. The full guide is here.
    5. And we have bunch of standalone, universal, all-in-one plugins like Zero Spam, OOPSpam, hCaptcha for WP which provide anti-spam protection for GiveWP as well. Here is a link to download one of them.

    Here are screenshots for tools above.

    I have questions… (FAQ)

    Does CleanTalk protect against donors emails leak?

    In July 2025, a vulnerability in GiveWP led to an email data leak of Pihole donators. Yes, Anti-Spam by CleanTalk helps protect against such issues. In this case, email addresses were exposed in the HTML code, even though they were invisible on public pages. The plugin prevents this by obfuscating email addresses by default.

    We received hundreds of spam donations immediately after installing GiveWP plugin. How to fix it?

    If you do not have specific anti-spam tool installed. Increasing the minimum donation amount can help stop spam, as bots usually test forms with small payments like $1–$5. Setting a $10+ minimum helps filter out these low-effort automated attacks.

    A donor is trying to submit recurring donations but the transaction isn’t being processed because the donor’s email is considered spam.

    False/positives sometimes happen. In this case just post a support ticket or put this donor in Allow list.

    Final thoughts

    I hope this guide helped resolve all spam issues on your donation form. If not, Sign Up for an account and our CleanTalk team will be happy to help.

    Stop spam without frustrating your visitors

    Create your CleanTalk account and start blocking spam donations — no CAPTCHA challenges and no impact on visitors.

    CleanTalk Account

    No credit card required • Setup takes less than a minute • Your temporary password will be sent by email.

  • Why do contact form 7 users prefer Anti-spam by CleanTalk against reCAPTCHA?

    As a WordPress user let me share my experience of using CAPTCHA less and CAPTCHA style Anti-Spam tools on the example of Contact form 7.

    Is reCAPTCHA good or bad for Contact form 7?

    Contact Form 7 users may prefer Anti-Spam plugin by CleanTalk over reCAPTCHA for several reasons, as each solution has its own advantages and disadvantages. Here are some potential reasons why some users prefer Anti-spam by CleanTalk:

    1. Simplicity: Anti-spam by CleanTalk offers a simpler and more user-friendly solution compared to reCAPTCHA. It doesn’t require users to solve puzzles or click checkboxes, which can be seen as an added step that may deter some visitors from submitting forms.
    2. Reduced User Friction: reCAPTCHA can sometimes lead to a less than ideal user experience, especially for those who find it challenging to complete the visual or interactive challenges. Anti-spam by CleanTalk doesn’t require any user interaction, so it doesn’t add any friction to the form submission process. More drawbacks of CAPTCHA/reCAPTCHA.
    3. Invisible to Users: Anti-spam by CleanTalk works invisibly in the background, so users are not aware of its presence. In contrast, reCAPTCHA typically requires users to complete a task to prove they are not a bot.
    4. Accessibility: Some users have accessibility concerns with reCAPTCHA, as it relies on visual verification. Anti-spam by CleanTalk does not present accessibility challenges in the same way, making it a more inclusive solution.
    5. Accuracy: Anti-spam by CleanTalk uses a combination of methods, including machine learning and a vast database of known spam sources, to identify and block spam submissions. This approach can be effective in detecting and preventing spam without relying on user interaction.
    6. Reduced False Positives: reCAPTCHA, while effective at blocking bots, may occasionally generate false positives, blocking legitimate users. Anti-spam by CleanTalk aims to minimize false positives, ensuring that genuine inquiries are not inadvertently marked as spam.
    7. Customization: Users have the ability to customize Anti-spam by CleanTalk settings to meet their specific needs and preferences, tailoring the spam protection to their site’s requirements.
    8. Integration: Anti-spam by CleanTalk is designed to seamlessly integrate with Contact Form 7 and other popular form plugins, making it easy for users to implement spam protection without significant configuration.
    Anti-Spam by CleanTalk

    It’s important to note that the choice between Anti-spam by CleanTalk and reCAPTCHA may depend on the specific needs and preferences of individual website owners. Some users may prioritize ease of use and a seamless user experience, while others may prioritize the high level of bot detection offered by reCAPTCHA. Ultimately, the choice between these solutions should align with your website’s goals and the user experience you want to provide. Additionally, some users may opt to use both solutions in combination to enhance spam protection further.

    How to install Anti-Spam by CleanTalk?

    To install and configure the “Anti-Spam by CleanTalk” WordPress plugin for your website, follow these steps:

    1. Log in to Your WordPress Dashboard:

    Navigate to your WordPress admin dashboard by entering your site’s URL followed by “/wp-admin” (e.g., “https://yourwebsite.com/wp-admin“).

    2. Access the Plugins Section:

    In the WordPress dashboard, locate and click on the “Plugins” option in the left-hand menu.

    3. Click “Add New”:

    On the Plugins page, click the “Add New” button at the top of the screen. This will take you to the Add Plugins page.

    4. Search for “Anti-Spam by CleanTalk”:

    In the search bar on the Add Plugins page, type “Anti-Spam by CleanTalk” and press Enter. The search results will appear.

    5. Install the Plugin:

    Locate the “Anti-Spam by CleanTalk” plugin in the search results. Click the “Install Now” button next to the plugin’s name.

    6. Activate the Plugin:

    After installation, a new button will appear that says “Activate.” Click this button to activate the Anti-Spam by CleanTalk plugin.

    7. Enter Your Access Key:

    Once the plugin is activated, you’ll need to enter your access key to enable the anti-spam features. You can obtain the access key by signing up for CleanTalk on their website (https://cleantalk.org/) and subscribing to their service. After subscribing, you’ll receive an access key via email.

    a. In the WordPress dashboard, go to “Settings” in the left-hand menu.

    b. Click on “Anti-Spam by CleanTalk” from the submenu.

    c. Enter your access key in the provided field.

    d. Click the “Check Access Key” button to validate your access key.

    8. Configure Settings:

    Once your access key is validated, you can configure the plugin settings according to your preferences. The settings allow you to customize the anti-spam protection for your site, including options for comments, registrations, contact forms, and more.

    9. Save Changes:

    After configuring your settings, don’t forget to click the “Save Changes” button to apply your chosen anti-spam settings.

    10. Verify That It’s Working:

    To ensure that the plugin is effectively blocking spam, just use email stop_email@example.com in a contact form 7. You have to see a special response from Anti-Spam by CleanTalk that describes a reason for blocking. 

    *** Forbidden. Sender blacklisted. ***
    Anti-Spam by CleanTalk shows the reason of blocking form submission.

    11. Periodic Review:

    Periodically review the plugin’s dashboard to check its performance and verify that it’s actively blocking spam submissions. CleanTalk provides statistics on the number of spam attempts blocked.

    That’s it! You’ve successfully installed and configured the “Anti-Spam by CleanTalk” plugin on your WordPress website. This plugin will help protect your site from unwanted spam submissions and improve the overall security and user experience of your WordPress site.

  • WordPress CAPTCHA: Should You Use It or Not? Pros and Cons Explained

    WordPress CAPTCHA: Should You Use It or Not? Pros and Cons Explained

    In today’s digital landscape, protecting your WordPress website from spam and malicious activities is paramount. One of the most common tools used to achieve this is CAPTCHA. However, whether to use CAPTCHA or not can be a topic of debate among website owners. This article will explore the pros and cons of using CAPTCHA on your WordPress site, helping you make an informed decision.

     

    What is CAPTCHA?

    CAPTCHA, which stands for “Completely Automated Public Turing test to tell Computers and Humans Apart,” is a security measure used to determine whether the user is a human or a bot. It typically requires users to solve puzzles, enter text from distorted images, or check a box to verify their humanity.

     

    Types of CAPTCHA

    Before diving into the pros and cons, it’s useful to understand the different types of CAPTCHA you might encounter:

    1. Text-based CAPTCHA
      Users are asked to enter characters from a distorted image.

    2. Image-based CAPTCHA
      Users select images that match a given description (e.g., select all images with traffic lights).

    3. Checkbox CAPTCHA (CAPTCHA)
      Users simply check a box to confirm they are not a robot.

    4. Invisible CAPTCHA
      This version works in the background and only challenges the user if it detects suspicious behavior.
    types of captcha

     

    Pros of Using CAPTCHA on WordPress

    1. Spam Protection
      Benefit: CAPTCHA effectively prevents automated bots from submitting forms, which is crucial for reducing spam in comments, registration forms, and contact forms.
      Explanation: Bots often target forms to post spammy content or create fake accounts. CAPTCHA acts as a gatekeeper, allowing only genuine human interactions.

    2. Enhanced Security
      Benefit: By blocking automated scripts and bots, CAPTCHA adds an extra layer of security to your WordPress site.
      Explanation: This can be particularly important for sites that process sensitive information or have user registration features, as it helps prevent brute-force attacks and data scraping.

    3. Reduced Server Load
      Benefit: Limiting spam and bot traffic can reduce the load on your server, improving overall site performance.
      Explanation: Bots generating excessive requests can slow down your site or even crash it. CAPTCHA helps mitigate this risk by filtering out non-human interactions.

    4. User Verification
      Benefit: CAPTCHA ensures that submissions (like comments or sign-ups) are made by real users, maintaining the quality and integrity of your site’s content.
      Explanation: This is especially useful for sites with user-generated content, where maintaining a community of genuine users is crucial.

    5. Flexible Integration
      Benefit: Many WordPress plugins offer easy CAPTCHA integration for various forms and functionalities.
      Explanation: Popular plugins like Contact Form 7, WPForms, and others allow you to add CAPTCHA to protect your forms with minimal effort.

     

    Cons of Using CAPTCHA on WordPress

    1. User Experience Impact
      CAPTCHA can create friction in the user experience, potentially deterring visitors from completing forms or engaging with your site. Users may find solving CAPTCHA puzzles frustrating or time-consuming, leading to higher abandonment rates, especially on mobile devices.

    2. Accessibility Issues
      CAPTCHA can pose significant challenges for users with disabilities, making it difficult or impossible for them to interact with your site. Visually impaired users, for example, may struggle with image-based CAPTCHAs, while others with cognitive disabilities may find the puzzles confusing. Even audio CAPTCHAs can be problematic for those with hearing impairments.

    3. False Positives
      Sometimes, legitimate users can be incorrectly flagged as bots, preventing them from completing their intended actions. This can happen due to various reasons, such as users failing to solve the CAPTCHA correctly or using certain browser extensions that interfere with CAPTCHA detection.

    4. Maintenance and Compatibility
      CAPTCHA implementations may require ongoing maintenance and updates to remain effective and compatible with your WordPress site. As bots evolve, CAPTCHAs must also be updated to stay ahead. Additionally, plugin conflicts or updates can sometimes cause compatibility issues, requiring troubleshooting and technical know-how.

    5. Increased Load Time
      Adding CAPTCHA can slightly increase page load times, which might impact your site’s performance. Each CAPTCHA requires additional resources to render and validate, which can contribute to longer loading times, particularly if not optimized.

     

    Alternatives to CAPTCHA

    Given the potential drawbacks, you might wonder if there are alternatives to CAPTCHA that can provide security without compromising user experience. Here are a few options:

    1. Anti-Spam Plugins

    How it works: Plugins like CleanTalk analyze form submissions and user behavior to filter out spam without the need for CAPTCHA.
    Benefit: They offer seamless protection with minimal impact on user experience.

    Anti-Spam plugins

    After the Anti-Spam is installed and activated, it protects your website and all forms from spam bots, keeping them from overloading your site. That’s how the website “looks” for spam bots:

    anti-crowler block

    Protection of your forms will also triggered even before a form is submitted, thus protecting your forms from getting spammed. That’s how it “looks”:

    screenshot 2

    “Also, take a look at what we think about the pros and cons of reCAPTCHA in our dedicated post, reCAPTCHA Alternative.”

    2. Honeypot Fields

    How it works: Hidden form fields are added that human users can’t see but bots will fill out. If these fields are completed, the submission is flagged as spam.
    Benefit: This method is invisible to users and doesn’t affect their experience.

    0 QmVE5NjmPv9vu9

    3. Time-Based Methods

    How it works: Measures the time taken to complete a form. Bots typically submit forms almost instantly, whereas humans take longer.
    Benefit: This is a passive method that doesn’t require any action from the user.

    4. JavaScript-Based Solutions

    How it works: Uses JavaScript to detect bots based on behavior and patterns that are unusual for human users.
    Benefit: These solutions operate behind the scenes, making them less intrusive for users.

     

    Conclusion

    CAPTCHA is a simple and free tool that will help you eliminate most spam bots. It is very useful for users in the first stage of launching their WordPress website.

    However, in the next step, you may need a more advanced solution. For example, one that will give much more protection against spam bots to increase the speed of your site, and also, will be completely invisible to save precious time of your site visitors. As such a solution, we recommend CleanTalk Anti-Spam, a service we have been improving for more than 10 years. The full list of features can be found here.

    Consider your audience and the nature of your site when deciding. If your site handles sensitive information or has high spam vulnerability, CAPTCHA could be beneficial. However, for sites focused on user engagement and accessibility, exploring alternatives might be more appropriate.

     

    Try Anti-Spam by CleanTalk for Free

     

  • Security Update: Please Update CleanTalk Anti-Spam to the Latest Version

    Security Update: Please Update CleanTalk Anti-Spam to the Latest Version

    We’re reaching out to let you know about a security vulnerability that was recently disclosed in the CleanTalk Anti-Spam plugin for WordPress. We’ve already released a fix, and we want to make sure you’re protected.

    What happened?

    On February 14, 2026, a vulnerability (CVE-2026-1490) was publicly disclosed affecting CleanTalk Anti-Spam plugin versions 6.71 and earlier. The issue was found in the checkWithoutToken function, which relied on reverse DNS (PTR record) resolution to verify incoming requests. An attacker could spoof a PTR record to impersonate CleanTalk servers, potentially allowing them to install unauthorized plugins on a vulnerable site. In a worst-case scenario, this could lead to remote code execution through a chain of exploits.

    Here’s the important part: this vulnerability only affects sites running with an invalid or expired or missing API key. If your CleanTalk subscription is active and your API key is valid, the exploitable code path is never triggered. That said, we strongly recommend updating regardless – it’s simply good practice.

    What you need to do:

    Update the plugin to version 6.72 or later – the fix is already available in the WordPress plugin repository
    Verify your API key is active and valid in your CleanTalk dashboard at https://cleantalk.org/my  or in your WP Dashboard->Settings->Anti-Spam by CleanTalk.
    If you have auto-updates enabled, you may already be on the latest version — but please double-check

    Keeping plugins up to date is the most effective way to maintain website security.

    What we’ve done on our end:
    We patched the checkWithoutToken function to no longer rely solely on PTR records for authorization. The updated verification process uses stronger validation methods that cannot be spoofed. The fix was released in version 6.72, which is available now.

    References:
    CVE record: https://www.cve.org/CVERecord?id=CVE-2026-1490 
    Wordfence advisory: https://www.wordfence.com/threat-intel/vulnerabilities/id/cb603be6-4a12-49e1-b8cc-b2062eb97f16 
    Plugin changelog: https://wordpress.org/plugins/cleantalk-spam-protect/#developers 

    A note from our team:
    We take security seriously – both yours and our own. No software is immune to vulnerabilities, but what matters is how quickly they’re addressed and how transparently they’re communicated. We identified the issue, developed a fix, and released the update promptly. 

    We’re also conducting an internal review of similar patterns across our codebase to prevent this class of vulnerability from recurring.
    If you have any questions or need assistance updating, our support team is here to help at support@cleantalk.org.

    Best regards,
    The CleanTalk Team

  • wpForo Forum – Spam Protection

    wpForo Forum – Spam Protection

    CleanTalk added spam protection for wpForo Forum multi-layout bulletin board using direct form integration. So in case, you prefer using wpForo be sure to use the most effective Anti-Spam plugin. Read the guide below and learn 4 steps to protect your wpForo Forms from spam.

    Once the CleanTalk Anti-Spam plugin is installed it starts to protect all of the existing forms on your WordPress website. It may not only be wpForo forms but also many others.

    Download CleanTalk Anti-Spam plugin | Download wpForo Forum 

    How to install CleanTalk Anti-Spam plugin

    To install the Anti-Spam plugin, go to your WordPress admin panel → Plugins → Add New.

    Then enter «СleanTalk» in the search box and click the Install button for «Spam protection, Anti-Spam, FireWall by CleanTalk».

    After installing the plugin, click the «Activate»‎ button.

    After it is done go to the plugin settings and click the «Get Access Key Automatically» button. Then just click the «Save Settings»‎ button.

    That’s it! From now you know how to completely protect your wpForo Forum plugin from spam.

    How to check spam protection for wpForo Forms

    You can test the work of Anti-Spam protection for your СonvertKit Forms by using a test email s @ cleantalk.org (without spaces). First, open the form in an Incognito browser tab. Fill in all the required form fields and send a form. After submitting the form, you will see a block message about the block on the form submission.

    If you have any questions, add a comment and we will be happy to help you.

    Create your CleanTalk account – Register now and protect your СonvertKit Forms from spam in 5 minutes

    Update

    The protection works only for website visitors, not for website admins. Be sure to test the form protection using Incognito mode.

    Additional features

    • CleanTalk protects all forms at once: comments, registrations, feedbacks, contacts, reviews.
    • Installation takes about 1-2 minutes.
    • Smart 99% protection against spambots.
    • Always online – 24/7 technical support.
    • Logs, SpamFireWall, personal lists, country filters, stop-words, and many others.

    Discover CleanTalk Anti-Spam plugin features.

  • CleanTalk Malware Scanner — heuristic code analysis

    CleanTalk Malware Scanner — heuristic code analysis

    We have already talked about the launch of security service for WordPress in the previous article. Today we want to talk about the launch of heuristic analysis to detect malicious code.

    The very presence of malicious code can lead to a ban in search results or a warning in the search for that the site is infected, to protect users from potentially dangerous content.

    You can find malicious code on your own, but it’s a lot of work and most WordPress users do not have the necessary skills to find and remove unnecessary lines of code.

    Often, the authors of malicious code disguise it, which makes it difficult to determine by its signatures. The malicious code itself can be located anywhere on the site, for example the obfuscated PHP-code in the logo.png file, and the code itself is called by one inconspicuous line in index.php. Therefore, the use of plugins to search for malicious code is preferable.

    CleanTalk on the first scan scans all WordPress kernel files, plugins and themes. When rescanning, only those files that have changed since the last scan were scanned. This saves resources and increases scanning speed.

    How heuristic analysis works

    One of the main disadvantages of heuristic analysis is that it is quite slow, so we use it only when it is really necessary. First of all, we divide the source code into lexemes (the minimal language construct) and remove all unnecessary:

    1. Space symbols.
    2. Comment of different types.
    3. Not PHP code (outside of tags <?php ?> )

    Next, we recursively simplify the code until there are no “complex constructs”:

    1. Perform concatenation of strings.
    2. Substitution of variables into variables.
    3. and other

    Also, in the process of simplifying the code, we monitor the origin of the variables and many others.

    In the end, we get a clean code that can be analyzed. It is very important that we get the code not in the form of a string, but in the form of lexemes. Thus, we know where the lexeme is a string with the desired text, and where the lexeme function is.

    In the sense of finding “bad constructs” eval for us there is a difference:

    <?php echo 'eval("echo \"some\"")'; ?>

     

    — in this case there will be no lexeme T_EVAL,

    there is a lexeme T_CONSTANT_ENCAPSED_STRING ‘eval (“echo \” eval\”)’

    <?php eval('echo "some"'); ?>

    – and here it is. And this is the version we will find.

    We look for such constructs, we break them down into degrees of criticality:

    Critical:

    • eval
    • include* и require*
      • with bad file extension
      • non-existent files (will be deleted in the next  versions)
      • connecting deleted files

    Dangerous

    • system
    • passthru
    • proc_open
    • exec
    • include* и require*
      • with the error suppression operator (will be deleted in the next versions)
      • with variables depending on POST or GET.

    Suspicious

    • base64_encode
    • str_rot13
    • syslog

    And other.

    We are constantly improving this analysis: adding new constructions to search, reducing the number of false alarm, optimize the simplification of the code.

    In the plans to teach it to detect and decode strings encoded in URL and BASE64 and others.

    The plugin itself is available in the WordPress directory. If you are unsure how to identify, remove, or clean malware using the plugin, you can book a WordPress Malware Removal service with our Security & Pentest team.

  • How to Check wp-content for Malware with Security by CleanTalk?

    How to Check wp-content for Malware with Security by CleanTalk?

    WordPress powers a significant portion of the internet, making it an attractive target for cyberattacks. Ensuring the security of your WordPress website is paramount. One essential aspect of WordPress security is regularly checking your wp-content directory for vulnerabilities. In this article, we’ll guide you through the process of safeguarding your wp-content folder using the powerful Security by CleanTalk plugin.

    Why Checking wp-content for Malware is Crucial?

    Your website’s wp-content directory is a critical part of your WordPress installation. It contains themes, plugins, and uploaded media files, making it an attractive target for hackers. Malicious actors often seek vulnerabilities in this directory to compromise your website’s security.

    Checking wp-content is vital because it allows you to:

    1. Detect Unauthorized Access: Regular checks help you identify any unauthorized changes or suspicious files within your wp-content folder.
    2. Prevent Malware Infections: Detecting malware early can prevent it from spreading throughout your site, damaging your reputation and potentially harming your visitors.
    3. Maintain Website Performance: A compromised wp-content directory can slow down your site and disrupt its functionality. Regular checks help maintain optimal performance.
    4. Protect Sensitive Data: Your wp-content directory may contain sensitive information. Ensuring its security safeguards your data and user information.

    Introducing Security by CleanTalk

    To streamline the process of checking your wp-content directory and enhancing your WordPress security, we recommend installing the “Security by CleanTalk” plugin. This comprehensive security plugin offers a wide range of features to protect your website, including:

    1. Real-time Firewall: Defends your site against malicious traffic and hacking attempts in real-time.
    2. Spam Protection: Blocks spam comments and registrations to keep your site’s content clean.
    3. Malware Scanner: Regularly scans your website for malware, vulnerabilities, and unsafe permissions.
    4. Login Page Security: Protects your login page from brute force attacks.
    5. Two-Factor Authentication (2FA): Adds an extra layer of login security for administrators.
    6. IP and Country Blocking: Allows you to block specific IP addresses or entire countries to prevent malicious access.
    7. Security Audit Trails: Keeps a record of all security-related events on your site for monitoring and analysis.

    How to Install Security by CleanTalk

    Follow these simple steps to install and activate Security by CleanTalk on your WordPress website:

    1. Login to Your WordPress Admin Dashboard: Navigate to your WordPress dashboard by entering your site’s URL followed by “/wp-admin” (e.g., “https://yourwebsite.com/wp-admin“).
    2. Go to Plugins: In the left sidebar, click on “Plugins.”
    3. Add New Plugin: Click the “Add New” button at the top of the Plugins page.
    4. Search for “Security by CleanTalk”: In the search bar, type “Security by CleanTalk” and press Enter.
    5. Install and Activate: When you see the plugin in the search results, click “Install Now,” and then click “Activate” once it’s installed.
    6. Configure Settings: Visit the “Security by CleanTalk” settings page in your WordPress dashboard to configure the plugin’s settings to your liking. Be sure to set up the malware scanner to check your wp-content directory regularly.
    7. Enjoy Enhanced Security: With Security by CleanTalk in place, your WordPress website is now fortified against threats, and your wp-content directory will be regularly monitored for vulnerabilities.
    Security by CleanTalk at WordPress.
    The Malware scanner checked and found an issue with wp-content.
    The Malware scanner cured files at wp-content.

    Conclusion

    Regularly checking your wp-content directory is an essential part of maintaining a secure WordPress website. To simplify this process and ensure comprehensive protection for your site, we recommend installing the “Security by CleanTalk” plugin. With its wide range of security features, this plugin will help you safeguard your website, keeping it safe from threats and ensuring the integrity of your wp-content directory.

    Anyway, if you are unsure how to identify, remove, or clean malware using the plugin, you can book a WordPress malware removal with our Security & Pentest team.

    Don’t leave the security of your WordPress site to chance—take proactive steps today by installing Security by CleanTalk and regularly checking your wp-content folder for peace of mind and a secure online presence.

  • Spam Protection – S2Member Memberships

    Spam Protection – S2Member Memberships

    If you prefer to use s2Member Memberships & Subscriptions registration form be sure to use the most effective Anti-Spam plugin. Read the guide below and learn 4 steps to protect your s2Member Registration Forms from spam.

    Once the CleanTalk Anti-Spam plugin is installed it starts to protect all of the existing forms on your WordPress website. It may not only be registration forms but also contact forms and many others.

    CleanTalk Anti-Spam plugin for WordPress | Download s2Member Registration Form plugin 

    How to install CleanTalk Anti-Spam plugin

    To install the Anti-Spam plugin, go to your WordPress admin panel → Plugins → Add New.

    Then enter «СleanTalk» in the search box and click the Install button for «Spam protection, Anti-Spam, FireWall by CleanTalk».

    After installing the plugin, click the «Activate»‎ button.

    After it is done go to the plugin settings and click the «Get Access Key Automatically» button. Then just click the «Save Settings»‎ button.

    That’s it! From now you How to completely protect your s2Member Registration Form from spam.

    Check the result to save your s2Member Registration Form from spam

    You can test the work of Anti-Spam protection for your s2Member Registration Form by using a test email s @ cleantalk.org (without spaces). First, open the form in an Incognito browser tab. Fill in all the required form fields and send a form. After submitting the form, you will see a block message about the block on the form submission.

    If you have any questions, add a comment and we will be happy to help you.

    Create your CleanTalk account – Register now and protect your s2Member Registration Form from spam in 5 minutes

    Update

    The protection works only for website visitors, not for website admins. Be sure to test the form protection using Incognito mode.

    Additional features

    • CleanTalk protects all forms at once: comments, registrations, feedbacks, contacts, reviews.
    • Installation takes about 1-2 minutes.
    • Smart 99% protection against spambots.
    • Always online – 24/7 technical support.
    • Logs, SpamFireWall, personal lists, country filters, stop-words, and many others.

    Discover the complete list of CleanTalk Anti-Spam plugin features here.

  • Our Client’s Review: BRNDTIME

    Our Client’s Review: BRNDTIME

    We’re happy to share feedback from one of our valued clients — Christophe Thielens, founder of BRNDTIME.

    At CleanTalk, we truly appreciate hearing how our anti-spam solution helps agencies and businesses keep their websites clean, fast, and user-friendly. Reviews like this motivate our team to continue improving our technology and delivering invisible, reliable protection against spam.

    About BRNDTIME

    BRNDTIME is a digital marketing agency based in Belgium, focused on helping SMEs and independent professionals grow their online presence.
    The agency specializes in building high-performance WordPress websites, SEO, online advertising, branding, content creation, and email marketing — always with a strong emphasis on usability, performance, and measurable results.

    Client feedback

    Christophe shared his experience with CleanTalk both on WordPress.org and on the BRNDTIME website:

    “Very good plugin — works very well for my agency.
    No captchas, no false positives, no slowdowns.
    A solid and trustworthy plugin.”

    BRNDTIME – Digital marketing bureau 01 29 2026 03 19 PM
    BRNDTIME – Digital marketing bureau 01 29 2026 03 19 PM

    Using CleanTalk Anti-Spam, BRNDTIME protects WordPress websites from spam submissions without affecting visitor experience. The absence of CAPTCHAs, combined with accurate filtering and no performance impact, allows the agency to focus on building and marketing websites — not cleaning up spam.

    We’d like to thank Christophe Thielens and the BRNDTIME team for trusting CleanTalk to protect their projects and for sharing their honest feedback with the WordPress community.

    🔗 Client website: https://brndtime.be/

    🔗 WordPress.org review: https://wordpress.org/support/topic/very-good-plugin-works-very-wel-for-my-agencie/

    🔗 BRNDTIME article about CleanTalk:
    https://brndtime.be/2026/01/27/cleantalk-anti-spam-plugins-spamvrije-wordpress-website/

CleanTalk

About

Create a support ticket

Contact us

Dashboard

Sign up / Sign in

Anti-Spam

Anti-Spam for Websites

Anti-Spam API

Best Anti-Spam Plugins in 2026

Check IP

Check Email

Filter fake emails

Hide contact data

Security

Website malware scanner

Malware removal service

WordPress Security & Firewall Plugin