Antispam Core

This is a main component of the Antispam group of features, and it can’t be disabled. It holds various elements needed for the antispam components to work.

Every other Antispam feature is using the Core feature to run individual antispam checks. This allows you to only activate Antispam features you need, and the Core component has minimal impact on the website overall performance, because it is passive until actually needed.

All the individual Antispam features are listed here, and each feature has own settings, so if you want, you can use some protections only with some of the features.

Antispam Protections

Plugin includes various methods to detect spam, and most other features use every or most of these methods.

Most of these protection methods are pretty straightforward to use, and have only to be enabled, with few of the methods having additional settings.

Every filter and option, includes additional information and related links on the Feature settings panel, so make sure to check that out. And, this article includes some more in-depth information for some of the more specific filters and options.

Additional Information

Trust, Special and Basic Filters

Special antispam filters are made for specific content in mind. When it comes to basic filters, we have the check for existing spam, that can be done with comments, bbPress content and Gravity Forms entries only.

But, the filter that checks for BBCode formatted URLs, that is pretty interesting one, because BBCodes can be expected to be part of forums only, and it should not be present in any other contact for or comments. Any such content with BBCode URLs can be considered spam.

Advanced Filters

These are pretty much all self-explanatory filters, but one filter that stands out is the Unicode Scripts Filter.

Unicode Scripts Filter

Antispam will run series of regular expressions to find any text in the content that contains one or more of the selected unicode character ranges. This is targeting use of other languages in the content.

For example, you run English only website or forum, you would expect and most likely, require, use of english only, and that would be limited to use of Latin character range only. And, spammers will often push large content (as comments, or contact form content) that may contain Russian, Chinese or other languages that will clearly stand out among Latin based characters that english or other languages use.

• This filter detects use of characters in the Unicode range, it can’t detect actual language used.
• Experiment with lower unicode coverage, because in a lot of cases, spammers drop large content that is mostly in english, with small parts written in other unicode ranges.
• You can select one or more unicode scripts to check for.
• The coverage value is total coverage value of all selected unicode scripts.
• Plugin doesn’t calculate individual unicode scripts coverage, because it would be much slower process, required to run each script expression individually.
• Make sure not to select unicode script range for language or languages you do allow on your website.

Domain URL and Email Filters

coreSecurity plugin includes always up-to-date list of TLDs (Top Level Domains). This list is very useful to determine exact domain and subdomain for each email used, and based on that, we can apply different antispam measures.

There are few types of emails spammers and spam-bots use, but they all have one thing in common, they all look real. And, yes, sometimes spam-bots use real emails. But, most of the time, these emails are fake, they can use disposable email servers, they can have email address crafted with fake TLD, or they can use email on a subdomain.

• Common Email usually looks like this: email@domain.tld and the subdomain Email looks like this: email@subdomain.domain.tld.
• It is highly unusual to have email address registered with the subdomain and most legitimate email servers and private email domains don’t use subdomain, so use of the subdomain usually points to the spam source.
• In some cases, subdomains can be valid for use with the email, if they are part of the .gov, .ac, or .edu domains, and they will be allowed regardless.
• If this option is active, it will also check if the email domain is on the allowed list, so if you want to use this option, but you still want to allow specific subdomain emails, you can add those domains to the allow list.

Regular Expressions Filters

While plugin now has only some regular expressions filters added, more will be included in the future, and most importantly, plugin allows you to add any number of regular expressions to check email, content, name or URL. Depending on your website, and the content you expect, you can make your own expressions that will help eliminate a lot of spam that may be specific to your website.

All this can be done via the Dictionary panel, where you can add any number of new filters. Antispam features settings will have direct links to the filtered dictionary entries.

External Services Filters

DNS checks can introduce a bit of slower antispam processing speed, since it depends on getting results from DNS service, but plugin caches these, so it is not that critical of the time used to check for validity of DNS entries for email used.

One of the best and most accurate spam lists is StopForumSpam website, and it is highly recommended to use this option as a method to find spam.

Captcha Support

While the plugin does support several captcha systems, use of captcha is optional and not really needed for most websites, and other antispam measures give overall better results. Before you decide on using captcha protection, make sure to check out this article:

If you choose to use Captcha, it will be displayed to all visitors (users that are not logged-in), and all users, except the user roles you can select for skipping the captcha for.

Right now, captcha is implemented for Comments, bbPress Topics and bbPress Replies. Most of the forms plugins already include captcha support, and there are no plans at this time to add captcha to forms plugins with coreSecurity Pro.

Antispam Limitations

There is no guarantee that every spam message will be caught. And, also, it is possible that some false positives will catch messages that are legitimate as spam.

• No antispam measure is always effective, and that’s why coreSecurity employs many different filters to try and catch as much as possible. Still, even with that, from previous experience, plugin filters combined have 98% effectiveness.
• Depending on the content, it is possible that some types of content will trigger antispam filters, even if the message is valid. This is rare, but it does happen.
• Make sure to check antispam logs from time to time and review what messages have been marked as spam, and if needed, manually approve them later.