{ "title": "CleanTalk Anti-Spam", "seo_title": "CleanTalk Anti-Spam: review, settings and limits", "h1": "CleanTalk Anti-Spam", "description": "CleanTalk Anti-Spam: strengths, limitations, price after the trial, Spam FireWall and form settings, and the patched vulnerabilities of the plugin.", "lead": "CleanTalk Anti-Spam blocks spam in comments, forms, registrations and WooCommerce orders without a CAPTCHA, using a paid cloud service. Our take on its price, its limits, the settings to apply and the vulnerabilities found in the plugin.", "language": "en", "locale": "en-US", "type": "plugin-sheet", "url": "https://www.wp-masquerade.com/features/camouflaged-plugins/cleantalk-anti-spam/", "canonical": "https://www.wp-masquerade.com/features/camouflaged-plugins/cleantalk-anti-spam/", "markdown": "https://www.wp-masquerade.com/features/camouflaged-plugins/cleantalk-anti-spam/index.md", "json": "https://www.wp-masquerade.com/features/camouflaged-plugins/cleantalk-anti-spam/index.json", "published": "2026-11-04T08:00:00+00:00", "modified": "2026-11-05T21:02:59+00:00", "site": { "name": "WP Masquerade", "url": "https://www.wp-masquerade.com/" }, "translations": [ { "language": "en", "hreflang": "en-US", "title": "CleanTalk Anti-Spam", "url": "https://www.wp-masquerade.com/features/camouflaged-plugins/cleantalk-anti-spam/", "markdown": "https://www.wp-masquerade.com/features/camouflaged-plugins/cleantalk-anti-spam/index.md", "json": "https://www.wp-masquerade.com/features/camouflaged-plugins/cleantalk-anti-spam/index.json" }, { "language": "fr", "hreflang": "fr-FR", "title": "CleanTalk Anti-Spam", "url": "https://www.wp-masquerade.com/fr/fonctionnalites/extensions-camouflees/cleantalk-anti-spam/", "markdown": "https://www.wp-masquerade.com/fr/fonctionnalites/extensions-camouflees/cleantalk-anti-spam/index.md", "json": "https://www.wp-masquerade.com/fr/fonctionnalites/extensions-camouflees/cleantalk-anti-spam/index.json" }, { "language": "es", "hreflang": "es-ES", "title": "CleanTalk Anti-Spam", "url": "https://www.wp-masquerade.com/es/funcionalidades/plugins-camuflados/cleantalk-anti-spam/", "markdown": "https://www.wp-masquerade.com/es/funcionalidades/plugins-camuflados/cleantalk-anti-spam/index.md", "json": "https://www.wp-masquerade.com/es/funcionalidades/plugins-camuflados/cleantalk-anti-spam/index.json" }, { "language": "de", "hreflang": "de-DE", "title": "CleanTalk Anti-Spam", "url": "https://www.wp-masquerade.com/de/funktionen/getarnte-plugins/cleantalk-anti-spam/", "markdown": "https://www.wp-masquerade.com/de/funktionen/getarnte-plugins/cleantalk-anti-spam/index.md", "json": "https://www.wp-masquerade.com/de/funktionen/getarnte-plugins/cleantalk-anti-spam/index.json" }, { "language": "it", "hreflang": "it-IT", "title": "CleanTalk Anti-Spam", "url": "https://www.wp-masquerade.com/it/funzionalita/plugin-camuffati/cleantalk-anti-spam/", "markdown": "https://www.wp-masquerade.com/it/funzionalita/plugin-camuffati/cleantalk-anti-spam/index.md", "json": "https://www.wp-masquerade.com/it/funzionalita/plugin-camuffati/cleantalk-anti-spam/index.json" }, { "language": "pt", "hreflang": "pt-BR", "title": "CleanTalk Anti-Spam", "url": "https://www.wp-masquerade.com/pt/recursos/plugins-wordpress-camuflados/cleantalk-anti-spam/", "markdown": "https://www.wp-masquerade.com/pt/recursos/plugins-wordpress-camuflados/cleantalk-anti-spam/index.md", "json": "https://www.wp-masquerade.com/pt/recursos/plugins-wordpress-camuflados/cleantalk-anti-spam/index.json" }, { "language": "nl", "hreflang": "nl-NL", "title": "CleanTalk Anti-Spam", "url": "https://www.wp-masquerade.com/nl/functies/gecamoufleerde-plugins/cleantalk-anti-spam/", "markdown": "https://www.wp-masquerade.com/nl/functies/gecamoufleerde-plugins/cleantalk-anti-spam/index.md", "json": "https://www.wp-masquerade.com/nl/functies/gecamoufleerde-plugins/cleantalk-anti-spam/index.json" } ], "headings": [ { "level": 1, "text": "CleanTalk Anti-Spam" }, { "level": 2, "text": "What CleanTalk Anti-Spam does on your site" }, { "level": 2, "text": "Which sites CleanTalk Anti-Spam suits best" }, { "level": 2, "text": "CleanTalk Anti-Spam strengths and limitations" }, { "level": 3, "text": "Strengths" }, { "level": 3, "text": "Limitations" }, { "level": 2, "text": "The CleanTalk settings we recommend" }, { "level": 2, "text": "Vulnerabilities in CleanTalk Anti-Spam itself" }, { "level": 2, "text": "CleanTalk Anti-Spam FAQ", "id": "faq" } ], "body": "## The essentials\n\n- Best for sites with many forms, or WooCommerce stores, that want spam filtering without a CAPTCHA.\n- Main caveat: no lasting free plan, and every checked submission is sent to CleanTalk.\n- 7-day trial, then $12 per year for one site, with unlimited checks and Spam FireWall included.\n\n## What CleanTalk Anti-Spam does on your site\n\nCleanTalk Anti-Spam, made by CleanTalk Inc., filters comments, registrations, contact forms, WooCommerce orders and the search form without showing a CAPTCHA. The plugin doesn’t judge submissions itself: it sends them to CleanTalk’s cloud service, which combines an invisible JavaScript test, the time taken to fill in the form, and a database of IP addresses, emails and domains flagged on other sites in the network. A submission is rejected only when several of these tests fail.\n\nContact Form 7, WPForms, Gravity Forms, Elementor Forms, Fluent Forms, Formidable Forms and dozens of other form plugins are covered with no extra setup. A hidden field added to forms acts as a [honeypot](https://www.wp-masquerade.com/glossary/honeypot/), and the “Encode contact data” option, on by default, scrambles the email addresses published on your pages so harvesting bots can’t read them. Submissions from your administrators are never checked.\n\nSpam FireWall adds a first line of defense: on every visit, the IP address is matched against a list of active bots that the plugin keeps up to date on your server, and a known bot gets a block page instead of your site. The business model is a subscription service: the plugin is free on wordpress.org, but filtering needs an access key, with a 7-day full trial and no credit card, then $12 per year for one site.\n\n![Diagram: CleanTalk Anti-Spam works on web server, wordpress, database and files. Public traces: signed HTML comments (hidden with Pro); folder name (hidden with Pro); tag IDs (hidden with Pro); JavaScript variables (still visible); cookies (still visible); files served by the vendor (still visible).](https://www.wp-masquerade.com/media/wpm-sheets/cleantalk/diagram-en.svg?v=1da8aa7b)\n\n## Which sites CleanTalk Anti-Spam suits best\n\n- **Sites with several forms** (contact, quote request, newsletter signup) that want one tool for all of them, with no CAPTCHA to scare visitors away.\n- **WooCommerce stores** hit by fake orders, fake customer accounts or spam reviews.\n- **Sites with open registration** (bbPress forums, memberships, online courses) flooded with bot-made accounts.\n- **Freelancers and agencies**: one account manages every site, and the price per site drops as you add sites ($24 per year for 3 sites, $69 for 10).\n\nCleanTalk is a weaker fit for a site that won’t send visitor data to a third-party service, or that has no budget at all: [Antispam Bee](https://www.wp-masquerade.com/features/camouflaged-plugins/antispam-bee/) filters comments locally and for free. For a personal blog that only has comments, [Akismet](https://www.wp-masquerade.com/features/camouflaged-plugins/akismet/) with its name-your-price plan is often enough. Our guide to [WordPress anti-spam](https://www.wp-masquerade.com/wordpress-anti-spam/) compares these approaches.\n\n## CleanTalk Anti-Spam strengths and limitations\n\n### Strengths\n\n- **Almost every form covered.** Comments, registrations, form plugins, WooCommerce and search are protected as soon as the key is entered.\n- **No friction for visitors.** No CAPTCHA and no images to pick: the tests run in the background.\n- **An anti-bot firewall included.** Spam FireWall turns away known bots before your pages load, which also lightens the server load.\n- **A low price and unlimited checks.** $12 per year for one site, with no cap on the number of requests checked.\n- **Cleanup tools.** It finds spam comments and accounts already on the site, and can keep blocked orders so you can restore them.\n\n### Limitations\n\n- **No lasting free plan.** After the 7-day trial, protection requires a paid license.\n- **Data goes to a third party.** Every checked submission is sent to CleanTalk’s servers; mention it in your privacy policy.\n- **Part of the management lives outside WordPress.** The request log and the handling of spam comments are set in CleanTalk’s online dashboard.\n- **A heavy vulnerability record.** Two critical flaws in 2024 and several XSS flaws exploitable without an account in 2026.\n- **Patchy translations.** In other languages, many advanced settings still show in English.\n\n## The CleanTalk settings we recommend\n\nLabels from CleanTalk 6.91. The settings live under Settings > Anti-Spam by CleanTalk, then the “Advanced settings” link at the bottom of the page.\n\n| Setting | Recommended value | Why |\n| --- | --- | --- |\n| **Access key** Settings > Anti-Spam by CleanTalk | Your key, then a test with `stop_email@example.com` | Without a valid key, nothing is filtered. Test while logged out: administrator submissions aren’t checked. |\n| **SpamFireWall** Advanced settings > SpamFireWall features | On (default) | Known bots are stopped before they load your pages. Turn it off only on an AMP site, as the vendor advises. |\n| **Anti-Flood** Same section | Off, unless you see content or price scraping | Past a number of page views per minute (20 by default), the visitor gets a holding page. Test with your own browsing before keeping it. |\n| **Automatically delete spam comments** Advanced settings > Comments and Messages | On | Spam comments older than 15 days are deleted, so the Spam folder doesn’t bloat the database. |\n| **Hide the “Website” field** Advanced settings > Miscellaneous | On for a blog with open comments | This field is mostly used to drop spam links. |\n| **Disable pingbacks and trackbacks** Same section | On if you don’t use them | CleanTalk doesn’t filter pingbacks; this option switches them off using WordPress’s own feature. |\n| **Set cookies** Advanced settings > Data Processing | “Auto” (default) | This mode switches to database storage on its own when a server cache such as Varnish is detected, so filtering doesn’t rely on cached visitor data. |\n| **Store blocked orders** Advanced settings > WooCommerce | On for a store | An order blocked by mistake stays visible under WooCommerce > Orders > Spam and can be restored. |\n| **Protect external forms** Advanced settings > Forms to protect | On only if a form sends its data to a service such as Mailchimp | Off by default. Leave “Capture buffer” off: the vendor warns it can break other plugins and caching. |\n\n- A comment sent from a private window with `stop_email@example.com` is rejected.\n- A real message sent through each of your forms reaches your inbox.\n- Your privacy policy mentions that form data is sent to CleanTalk.\n- After a week, the log in your CleanTalk dashboard shows no genuine messages blocked.\n\n## Vulnerabilities in CleanTalk Anti-Spam itself\n\nThe track record matters here. In November 2024, two critical flaws let a visitor with no account install and activate any plugin: CVE-2024-10542 (reverse DNS spoofing, versions up to 6.43.2) and CVE-2024-10781 (empty API key not checked, versions up to 6.44). In 2026 came flaws that a simple comment or signup could exploit: shortcode execution (CVE-2026-19855, versions before 6.87), then stored XSS flaws such as CVE-2026-103424 (up to 6.88) and CVE-2026-109198 (up to 6.89.1, when registration is open).\n\nWhat to do: run a version later than 6.89.1 and turn on automatic updates for the plugin. WP Masquerade Pro removes CleanTalk’s folder, file addresses and script IDs from your pages, which makes it harder for bots hunting these flaws to spot the plugin without fixing anything; the `ctPublic` JavaScript object, the `apbct_*` cookies and the calls to `fd.cleantalk.org` remain visible.\n\n## CleanTalk Anti-Spam FAQ\n\n**Is CleanTalk Anti-Spam free?**\n\nThe plugin is free; the filtering service is not. You get a 7-day full trial with no credit card, then the license costs $12 per year for one site, with discounted bundles for several sites.\n\n**How do I check that the protection works?**\n\nWhile logged out, send a comment or form with the address `stop_email@example.com`: it should be rejected. For Spam FireWall, open a private window and add `?sfw_test_ip=10.10.10.10` to a page URL: the block page should appear.\n\n**Does CleanTalk work with a caching plugin?**\n\nYes, according to the vendor. Behind a server cache such as Varnish, keep “Set cookies” on “Auto” so visitor data is stored in the database rather than in cookies.\n\n**Should I keep a CAPTCHA or Akismet as well?**\n\nUsually not: the vendor notes that several anti-spam plugins can conflict. Keep one filter, and add a CAPTCHA only on a specific form that still lets bots through.\n\n**Does CleanTalk block AI crawlers?**\n\nNot by default: the Anti-Crawler option lets known bots through, including GPTBot and ClaudeBot. You can block them one by one in the personal lists of your CleanTalk dashboard.\n\n## Key facts\n\n- Category: Security\n- Vendor: CleanTalk Inc.\n- Price: 7-day full trial, then $12 per year for one site ($24 for 3 sites)\n- Active installations (wordpress.org): 200 000+\n- Version: 6.91\n- Official page: https://wordpress.org/plugins/cleantalk-spam-protect/\n\n## What WP Masquerade hides\n\n- Handled by WP Masquerade Pro only\n- With Pro: signed HTML comments, folder name, tag IDs\n- Still visible: JavaScript variables, cookies, files served by the vendor", "catalog": "cleantalk", "essentials": [ "Best for sites with many forms, or WooCommerce stores, that want spam filtering without a CAPTCHA.", "Main caveat: no lasting free plan, and every checked submission is sent to CleanTalk.", "7-day trial, then $12 per year for one site, with unlimited checks and Spam FireWall included." ], "format": "application/json" }