The 9 Dollar Comment Spam Mute

readme.txt

=== The 9 Dollar Comment Spam Mute ===
Contributors: the9dollarplugins
Donate link: https://buymeacoffee.com/t.9.p
Tags: comment spam, anti-spam, spam protection, spam comments, spam filter
Requires at least: 6.0
Tested up to: 6.9
Requires PHP: 7.4
Stable tag: 1.0
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Auto-discard comment spam before it ever hits your database. Zero-Touch protection — no API keys, no external calls, 

== Description ==

**The 9 Dollar Comment Spam Mute** is your silent, Zero-Touch spam-fighting sidekick. It catches spam comments before they even think about touching your database. No moderation queue. No spam folder. No admin drama.
Set it up once. Let it work. Never think about spam again.

**Why you’ll like it**
Most anti-spam plugins ship your comment data off to who-knows-where, demand an API key, or just shuffle spam into a folder that slowly turns into a digital landfill. This one does things differently: everything runs on your own server, zero external requests, and spam comments are gone before they ever arrive.
No spam folder to clean. No pending queue. No cloud. No key. No fuss.

**How it kicks spam to the curb**
The plugin hooks into WordPress at the earliest possible moment — right before a comment would be saved. If something looks like spam, it’s silently discarded. You get to choose what happens next: with Silent Mode on, bots see a fake success message and never realize they’ve been blocked (so they won’t change tactics). With Silent Mode off, the comment is rejected with a normal error message. Either way: zero database clutter.

**Heads-up (important!)**
Discarded spam comments are gone for good. That’s why there’s a mandatory opt-in step — so you’re fully aware before spam protection goes live. You keep full control over all detection settings, and comments only get discarded once you explicitly arm the plugin.

**Why this plugin exists**
Most anti-spam plugins:
- send your data to external APIs  
- require API keys and accounts  
- store spam in folders nobody cleans  
This plugin does none of that. Everything runs locally on your server. No external calls. No cloud dependency. No unnecessary complexity.
Spam is not stored. It’s gone.

**Features (LITE — free)**
- **No external API calls** — fully GDPR-compliant by design
- **No API key, no account, zero setup fuss** — just install, configure once, arm it, and you're done
- **No external API calls** — all spam detection runs locally on your server
- **GDPR-compliant by design** — no data leaves your site; IP addresses stored for spam detection only, auto-deleted after 90 days
- **Universal coverage** — protects comments on posts, pages, custom post types, WooCommerce product reviews, and all native WordPress comment types
- **Comments get intercepted and discarded before they ever hit the database** — no spam folder to clean, ever
- **Silent Mode** — bots get a fake success message and never realize they’ve been blocked (keeps them from adapting)
- **Set once, runs automatically** — after you arm it, you’re done
- **Works with all native WordPress comment types** — posts, pages, custom post types, attachments, WooCommerce reviews
- **Mandatory opt-in** — you’re always in control
- **Arm / Disarm control** — activate or pause spam protection instantly without losing settings
- **Rate limiting** — automatically blocks IPs that submit comments too frequently
- **Discarded comments log** — last 50 entries with date, IP, author and reason, auto-pruned after 90 days
- **Sleek & slim** — one PHP file, one CSS file, one JS file. No classes, no autoloader, no framework baggage
- **Honeypot trap** — invisible field silently catches automated spam bots
- **Speed check** — discards submissions faster than any human could type
- **Time token validation** — rejects replayed or forged submission tokens older than one hour
- **Link limit** — discards comments containing too many links, a classic spam signal
- **Keyword blacklist** — case-insensitive spam keyword list, fully customisable, one word per line
- **Whitelist: Email / IP / User-Agent** — never block your trusted commenters
- **Daily report email** — optional morning summary of discarded spam, sent straight to your inbox

**PRO version extras**
Upgrade to PRO and level up your spam defense:
- **Self-learning IP Blocklist** — automatically flags repeat offenders (PRO only)
- **Custom Regex Patterns** — build your own advanced spam rules (PRO only)
- **Smart Learning Spam Filter** — trains itself on your site’s own comment history (PRO only)
- **Adjustable log size** — keep as many or as few entries as you like (PRO only)
- **CSV log export** — download your discarded comments log anytime (PRO only)
- **WooCommerce Verified Buyer Whitelist** — verified customers get a free pass (PRO only)
- **Statistics Dashboard Widget** — see your spam stats at a glance (PRO only)
- **Priority support** — fast help when you need it (PRO only)

**How it all works**
1. Install and activate the plugin.
2. Go to **Spam Mute** in your WordPress admin sidebar.
3. Read the opt-in notice and confirm you’re cool with the fact that spam comments will be permanently discarded.
4. Tweak your detection settings — honeypot, speed check, link limit, keyword blacklist.
5. Set Spam Protection to **Active** and let the silence begin.

That’s it. The 9 Dollar Comment Spam Mute works in the background, quietly doing its thing. Zero-Touch.

== Important notice ==

Spam comments are permanently deleted.
There is no recovery, no trash, no undo.
A mandatory opt-in ensures you understand this before activation. Nothing happens unless you explicitly enable it.

== Screenshots ==

1. Opt-in notice — you confirm before anything gets armed.
2. Arm / Disarm control with live status indicator.
3. Settings — all spam detection options in one clean view.
4. Discarded comments log — last 50 entries with date, IP, author, and reason.

== Installation ==

1. Upload the plugin folder to `/wp-content/plugins/` or install directly from the WordPress Plugins screen.
2. Activate it.
3. Head to **Spam Mute** in your WordPress admin sidebar.
4. Confirm the opt-in, tweak your settings, then arm the plugin.

== Frequently Asked Questions ==

= Will discarded spam comments end up in trash or spam? =
Nope. Once The 9 Dollar Comment Spam Mute discards a comment, it’s gone for good — no trash, no spam folder, no second chances.

= What’s the deal with Silent Mode? =
Silent Mode (recommended) = spam comments are discarded and bots see a fake success message. They never figure out they’ve been blocked, so they won’t switch up their attack patterns. Silent Mode off = spam comments are rejected with a normal error message. Either way, your database stays clean.

= Can real comments ever get caught by accident? =
It’s possible — no spam filter is 100% perfect. That’s why the opt-in step makes this crystal clear. The keyword blacklist and link limit are the usual suspects if false positives happen. Tune them to fit your audience.

= Does it work with WooCommerce product reviews? =
You bet. WooCommerce reviews use the same WordPress comment hook, so all LITE features cover them automatically. No extra setup.

= Does this thing call home (external APIs)? =
Never. Every spam check runs locally on your server. No data leaves your site.

= Is this GDPR/DSGVO friendly? =
Absolutely. No data ever leaves your server. The discarded comments log stores only IP, author name, email, and a short content preview — all inside your own database. IPs are kept for spam detection and security analysis (legitimate interest under GDPR Art. 6(1)(f)), never shared, never shown publicly. Log entries auto-delete after 90 days, and you can clear them manually anytime.

= How is this different from Akismet? =
Akismet sends every comment to an external cloud for analysis and needs an API key. The 9 Dollar Comment Spam Mute runs entirely on your own server, requires no account or key, and discards spam before it reaches your database — instead of dumping it into a spam folder that just fills up.

= What's the difference between Armed and Disarmed? =
Disarmed = the plugin is installed and configured, but no comments are discarded. Armed = protection is active, and spam comments are silently discarded on submission — they never reach the database.

= Can I pause spam protection without losing my settings? =
Yep. Just set Spam Protection to "Inactive" anytime. All your settings stick, and you can re-arm in one click.

= Does the plugin protect against repeated spam attempts from the same IP? =
Yes. The LITE version includes automatic rate limiting — any IP that submits more than 5 comments within an hour is automatically blocked for the remainder of that hour. This stops the most common bot patterns without affecting legitimate users.

= What happens when I uninstall the plugin? =
By default, all plugin data stays in your database. If you check "Delete data on uninstall" in settings, everything (settings + log) gets permanently removed when you uninstall.

= Do I need an API key or an account? =
Nope. The LITE version is completely free — no registration, no key, no account. Just install and go.

== Changelog ==

= 1.0 - 2026-03-24 =
* Initial release.
* Honeypot trap, speed check, link limit, and keyword blacklist spam detection.
* Silent Mode — bots get a fake success response and never realize they’re blocked.
* Discarded comments log — last 50 entries, auto-pruned.
* Mandatory opt-in with explicit Arm/Disarm control.