MailerPress protects your forms from bots with two built-in tools: a honeypot and IP rate limiting. Both are included in MailerPress (free) and need no third-party service or API key.
Location: MailerPress > Settings > Spam Protection (screen Security & Spam Protection).
What is protected
- MailerPress subscription forms.
- The manage subscription page, where contacts update their lists.
- Contact Form 7 forms connected to MailerPress (honeypot only).
Honeypot protection
The honeypot adds a hidden field to your forms. Visitors don’t see it and leave it empty. Bots usually fill in every field, so when this one is filled, the submission is silently rejected: the bot sees a success message, but no contact is added or updated.
Enable Honeypot Protection is on by default. It needs no setup and doesn’t affect your subscribers: keep it on.
Rate limiting
Rate limiting caps how many forms one IP address (the internet address of a visitor’s connection) can submit in a given time. It stops floods of fake signups, even from bots that get past the honeypot. Enable Rate Limiting is on by default with these values:
| Setting | Default | Allowed values | Description |
|---|---|---|---|
| Maximum Requests | 5 | 1 to 100 | Number of submissions one IP address can send during the time window. |
| Time Window (seconds) | 60 (1 minute) | 10 to 3600 | Rolling period used to count the requests. |
With these defaults, an IP address can submit up to 5 forms per minute. The 6th attempt is blocked and the visitor is asked to try again later.
- Under attack: lower Maximum Requests to 2 or 3.
- Many visitors sharing an IP address (offices, schools, mobile networks): raise it to 10.
- Stricter throttling: set Time Window (seconds) to 300 (5 minutes).
After changing either protection, click Save settings in the top right. Changes apply immediately.
Sites behind Cloudflare or a reverse proxy
A reverse proxy is a server that sits in front of your site and forwards visitors to it (Cloudflare, a load balancer, some hosting setups). By default, MailerPress sees the address of the server that connects to your site. Behind a proxy, that is the proxy’s address: all visitors look like the same IP, and rate limiting can block real subscribers.
For security, MailerPress only reads the real visitor IP passed on by a proxy you trust. Declare your proxy IP addresses with the mailerpress_trusted_proxies filter, for example in a custom plugin:
add_filter( 'mailerpress_trusted_proxies', function ( $proxies ) {
$proxies[] = '203.0.113.10'; // Replace with the IP address of your proxy.
return $proxies;
} );List each proxy IP address individually: the exact address is compared. Ask your host for the IP addresses of your proxy or load balancer.
Troubleshooting
- Real users are blocked: raise Maximum Requests or shorten the Time Window (seconds). If your site is behind a proxy, declare it as explained above.
- You still get spam: check that both toggles are on, then lower Maximum Requests to 2 or 3. Consider enabling sign-up confirmation (double opt-in): new subscribers must click a link in a confirmation email, so fake addresses never become subscribed contacts.