Open Source — Code You Can Trust

September 28, 2026

TL;DR: Open source means you can read the program that runs on your server. Our WordPress plugins are GPLv2, and the version on GitHub is the version a customer installs.

Table of Contents

What open source is for

A plugin runs in your PHP process, with the rights of the site. Closed code asks you to trust a zip. Open code lets you check it.

Read the behavior. A block, a firewall rule, a file scan are functions you can open.
Let someone else read it. Your developer or your host sees the same code. A bug report points at a line.
Keep the copy. Under a free license the installed files stay yours to study and run.

Our plugins

CleanTalk WordPress plugins are that code. Both are GPLv2. The license line is in readme.txt of each plugin. The public repositories hold the release a customer receives: every file in the release is in the repository, byte for byte. The repository also carries tests and build files that are not shipped. Not a demo and not an old snapshot.

Anti-Spam is 6.88 on GitHub and 6.88 on WordPress.org. 200,000+ active installations.
Security is 2.188 on GitHub and 2.188 on WordPress.org. 40,000+ active installations.

The version line is the plugin header: Version: 6.88 in cleantalk.php, Version: 2.188 in security-malware-firewall.php. Those are the numbers you see on the Plugins screen after installing from the directory.

The plugin is open. The cloud is a service. Spam reputation and firewall lists are not in the zip. In the Security plugin the call is in the source: SPBC_API_URL is https://api.cleantalk.org. You can read the request. The database behind the answer is not shipped.

How to check your site

Read the version in wp-admin, open the same Version line in the repository, then compare one file with wp-content/plugins. An older install matches its version tag in the repository history. The release you received is on github.com/CleanTalk.

Suggestions and corrections

They are welcome in the repository. Open an issue or a pull request on Anti-Spam or Security. A wrong line, a missing case, or a patch is enough. We read every one of them.