Stop Fake Form Entries: Email Checks for WordPress

Every WordPress site with a contact or newsletter form ends up with the same pile: [email protected], gmial.com typos, throwaway inboxes and bots filling the field with random text. The messages you can never answer are not just clutter; if they go into a mailing list, they become bounces later. The best moment to stop them is at the form.

Level 1: Make the browser do the basics

Use an email input type so phones show the right keyboard and browsers reject text without an @. Add required. That alone removes the laziest junk. Contact Form 7 does this with its [email* your-email] tag.

Level 2: Catch bots without annoying people

• Honeypot field. A hidden field that humans leave empty and bots fill. Many form plugins include one.
• Time check. Reject a form submitted within a second of loading.
• A privacy-friendly CAPTCHA if the bot traffic is heavy.

These stop automated posts but not a real person who types gmial.com. For that you need an actual address check.

Level 3: Check the address itself

Our API checks one address and answers with a result of valid, invalid, risky or unknown, plus a flag for disposable domains and a typo_suggestion when the domain looks like a misspelling. Create an API key in your account and keep it on the server, never in the page.

Contact Form 7 example

Add this to your theme’s functions.php or a small site plugin. It rejects clearly invalid and disposable addresses and lets everything else through, so a temporary outage never blocks a real customer.

add_filter( 'wpcf7_validate_email*', function ( $result, $tag ) {
    $email = isset( $_POST[ $tag->name ] ) ? sanitize_email( wp_unslash( $_POST[ $tag->name ] ) ) : '';
    if ( ! $email ) { return $result; }

    $response = wp_remote_get(
        'https://mailcut.io/api/v1/verify?email=' . rawurlencode( $email ),
        array( 'timeout' => 6, 'headers' => array( 'Authorization' => 'Bearer ' . MAILCUT_API_KEY ) )
    );
    if ( is_wp_error( $response ) || 200 !== wp_remote_retrieve_response_code( $response ) ) {
        return $result; // fail open: never block on a service error
    }
    $data = json_decode( wp_remote_retrieve_body( $response ), true );

    if ( ! empty( $data['typo_suggestion'] ) ) {
        $result->invalidate( $tag, 'Did you mean ' . $data['typo_suggestion'] . '?' );
    } elseif ( 'invalid' === ( $data['result'] ?? '' ) || ! empty( $data['disposable'] ) ) {
        $result->invalidate( $tag, 'Please use an email address that can receive our reply.' );
    }
    return $result;
}, 20, 2 );

Define MAILCUT_API_KEY in wp-config.php so the key stays out of your theme files. Each call uses one credit.

Decisions that matter more than the code

• Fail open. If the check cannot run, accept the entry. A lost customer costs more than a few bad addresses.
• Be gentle with “risky” and “unknown”. Many corporate domains accept everything and some servers do not answer in time. Accept them, but maybe flag them in your CRM.
• Explain the rejection. A message such as “Did you mean …?” turns a typo into a successful submission.
• Do not check on every keystroke. One call on submit is enough and uses fewer credits.

For newsletters and WooCommerce

The same idea works for newsletter plugins and checkout fields: call the check when the address is submitted and keep the result with the contact. If you already have a big list from before you added the check, run it through bulk verification once to clean what accumulated.

New accounts start with free credits, which is enough to test the snippet on a staging site. When you go live, see the credit packs; credits stay valid for 12 months, so a pack covers a year of sign-ups at a steady pace.