| #1 | Dam Spam | 100 | | 1 | 3k+ | | | unexpected markdown file |
| #2 | Kitgenix CAPTCHA for Cloudflare Turnstile | 100 | | 1 | 700 | | | Missing Version |
| #3 | Email Address Obfuscation | 99 | 3 | 0 | 2k+ | | | wp function not compatible with requires wp |
| #4 | Easy Spam Filter – Privacy-Friendly CAPTCHA Alternative with Turnstile for Contact Form 7, WPForms, BuddyPress, Elementor | 97 | 2 | 14 | 1k+ | | | Dynamic hook name |
| #5 | ActiveLayer Anti-Spam: Spam Protection for Forms & Comments | 95 | | 4 | 9k+ | | | Database parameter is not escaped |
| #6 | Gravity Forms Zero Spam | 94 | 5 | 9 | 100k+ | | | trademarked term |
| #7 | Stop Spammers Classic | 94 | 185 | 1 | 20k+ | | | wp function not compatible with requires wp |
| #8 | BotBlocker Security – Complete security platform | 94 | 1 | 7 | 3k+ | | | Non-prefixed constant |
| #9 | Comment Link Remove and Other Comment Tools | 88 | 8 | 91 | 8k+ | | | Non-prefixed global variable |
| #10 | Antispam Bee | 81 | 1 | 38 | 700k+ | | | Nonce verification recommended |
| #11 | Honeypot Anti-Spam | 78 | 5 | 7 | 10k+ | | | Missing nonce verification |
| #12 | Disable WP Registration Page Spam | 77 | 5 | 12 | 1k+ | | | Nonce verification recommended |
| #13 | En Spam | 75 | 21 | 6 | 500 | | | wp function not compatible with requires wp |
| #14 | WP referrer spam blacklist (fight 2040+ Referrer Spammers in (Google/Matomo) Analytics) | 69 | 9 | 24 | 700 | | | Non-prefixed constant |
| #15 | Forget Spam Comment | 67 | 5 | 10 | 9k+ | | | Input is not sanitized |
| #16 | Anti-Captcha (anti-spam botblocker) | 56 | 23 | 26 | 1k+ | | | rand mt rand |
| #17 | Anti-Spam Protection – No API Key, GDPR Friendly | 49 | 2 | 106 | 1k+ | | | Direct Query |
| #18 | La Sentinelle antispam | 41 | 86 | 46 | 3k+ | | | Output is not escaped |
| #19 | IP Ban | 41 | 29 | 39 | 2k+ | | | Input is not validated |
| #20 | Essential Form – The lightest plugin for contact forms, ultra lightweight and no spam | 41 | 21 | 53 | 500 | | | Missing nonce verification |
| #21 | Antispam | 41 | 11 | 41 | 400 | | | Missing nonce verification |
| #22 | WP Armour – Honeypot Anti Spam | 40 | 54 | 66 | 400k+ | | | Missing nonce verification |
| #23 | Spam Protection | Maspik | 40 | 13 | 168 | 30k+ | | | Missing nonce verification |
| #24 | Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms | 40 | 10 | 300 | 4k+ | | | Direct Query |
| #25 | Universal Honey Pot | 40 | 23 | 94 | 1k+ | | | Missing nonce verification |
| #26 | Blackhole for Bad Bots | 39 | 123 | 69 | 30k+ | | | Output is not escaped |
| #27 | Email Encoder – Protect Email Addresses and Phone Numbers | 38 | 9 | 150 | 90k+ | | | Non-prefixed global variable |
| #28 | Spam Destroyer | 37 | 63 | 43 | 5k+ | | | rand rand |
| #29 | Akismet Anti-spam: Spam Protection | 35 | 31 | 101 | 5m+ | | | Non-prefixed global variable |
| #30 | CM E-Mail Blacklist – Simple email filtering for safer registration | 35 | 269 | 205 | 700 | | | Output is not escaped |
| #31 | Human Presence – Stop Form Spam Without ReCaptcha | 33 | 54 | 65 | 1k+ | | | Request data is not unslashed |
| #32 | Restrict Usernames Emails Characters | 32 | 327 | 367 | 1k+ | | | Output is not escaped |
| #33 | Comments – GraphComment | AI-Moderated Comment System | 32 | 201 | 194 | 400 | | | Unsafe printing function |
| #34 | CloudSecure WP Security | 29 | 74 | 326 | 100k+ | | | Request data is not unslashed |
| #35 | OOPSpam Anti-Spam: Spam Protection for WordPress Forms & Comments (No CAPTCHA) | 26 | 277 | 629 | 6k+ | | | Request data is not unslashed |
| #36 | WPBruiser {no- Captcha anti-Spam} | 25 | 646 | 259 | 10k+ | | | Non Singular String Literal Domain |
| #37 | CF7 Apps – Honeypot, Database, Redirection, Webhook, and Addons for Contact Form 7 | 24 | 1,053 | 1,397 | 300k+ | | | Non-prefixed global variable |
