LynBro Plugins
/ Anti-Spam
LynBro Plugins
/ Anti-Spam
Twelve checks run on your own server and add up to a score. Two thresholds decide: hold it for you, or refuse it. And the log names the check that fired — so when it gets one wrong, you can see it and put it back.
Free forever. No account, no card. Sends nothing anywhere unless you choose a challenge provider and enter your own keys.
independent checks, every one of them running on your own site.
Akismet needs a paid plan the moment your site is commercial. Every check here runs on your own server, on every submission, forever.
Every anti-spam tool guesses wrong sometimes. The ones that cost you customers are the ones that guess wrong invisibly — so ours shows you the message, the reason and a button to release it.
No submission is shipped off for a third party to judge. The throwaway-domain list ships inside the plugin and is read from disk.
No "Pro" tier, no nag screens. The features other plugins paywall are here from day one.
A field real visitors never see. Only a script fills it in.
Fetched when the page loads, so it survives a full-page cache — and a bot posting straight to your endpoint arrives without one.
The clock starts when your server issued the token, not when the browser claims it did.
Link stuffing, your own blocked-word list, and script tags in a plain message field.
A bundled list of disposable-mail domains, sub-domains included, checked locally.
The same text arriving over and over — counted from the third, so pressing send twice is never held against anyone — and too many submissions from one address.
An address, a whole domain, an IP or a CIDR range. An allow-list hit ends the checks at once.
Comments, login, registration, lost password, Contact Form 7, WPForms, Forminator, Fluent Forms, Formidable Forms, Ninja Forms, Elementor and WooCommerce accounts.
Cloudflare Turnstile, Google reCAPTCHA v3 or hCaptcha — optional, off by default, on your own keys, with a key test. If the provider is down, the submission is scored on the local checks alone.
When a contact form message is held, the form sends you nothing. Here the whole message waits in the log, opened for you, with “Send to my inbox” and “Reply by e-mail” — and a small counter in the menu instead of nag banners.
Someone who already has an approved comment starts the next one a few points in credit, so a blocked script does not send a regular reader to moderation.
Tools → Export and Erase Personal Data include the log, and the Policy Guide gets a paragraph describing what is stored. A switch in wp-config.php turns everything off if you ever need it.
The two tools most WordPress sites reach for — and what each of them asks of you in return.
| Feature | Lynbro Antispam Guard | Akismet free | Simple Cloudflare Turnstile |
|---|---|---|---|
| Works with no third-party account at all | ✓ | — | — |
| Free to use on a commercial site | ✓ | — | ✓ |
| Submissions are judged on your own server | ✓ | — | — |
| Local checks beyond a challenge widget | ✓ | — | — |
| Every block names the check that fired | ✓ | — | — |
| One click releases a mistake and allow-lists the sender | ✓ | — | — |
| Thresholds you set yourself (hold vs refuse) | ✓ | — | — |
| Comments, login and contact forms | ✓ | ✓ | ✓ |
| A held contact-form message can still be read and answered | ✓ | — | — |
No. Every check runs on your own server. A challenge provider — Cloudflare Turnstile, Google reCAPTCHA v3 or hCaptcha — is the one optional extra, and it uses your own keys.
The defaults are deliberately forgiving. A visitor who types slowly, or whose browser blocks our script, is held rather than refused; someone who presses send twice because nothing confirmed the first attempt is not stopped at all; and signing in, registering or asking for a new password are only ever refused outright, never held. Whatever is held or refused shows up in the log with the reason, and one click puts it back.
Yes. The page markup carries no timestamp and no per-visitor value — the token is fetched separately when the page loads, so the same cached HTML works for everybody. That is usually the first thing a time trap breaks on.
Their submission scores as “no token”, which by default holds it for review rather than refusing it, and never keeps them from signing in or registering. If your whole site’s REST API is unreachable, the overview screen says so in plain words — so you hear it from the plugin, not from a customer who never got an answer.
Because a shopper who has filled a cart and reached for their card is not the risk worth taking. A false positive at checkout costs a sale, not a comment. Registration, log in and lost password are guarded.
Contact Form 7, WPForms, Forminator, Fluent Forms, Formidable Forms, Ninja Forms and Elementor forms work out of the box. For anything else — Gravity Forms included — there are two functions to call: one in the form, one on submit.
In the Anti-Spam log, opened in full. “Send to my inbox” e-mails it to you with the sender as reply-to, “Reply by e-mail” starts an answer, and “Not spam” allow-lists the sender. A counter next to Anti-Spam in the menu shows how many arrived since you last looked.