Anti-Spam, Spam FireWall by CleanTalk

Reviewers are broadly happy, praising how well it blocks spam and how quick and helpful support is, with only a few older complaints about key errors, ticket handling and upgrade emails.

How well this listing is tuned to rank in WordPress.org search, on the factors an owner controls. Not popularity, optimization.

Directory searches this plugin turns up in, and which way each one is moving. WordPress.org publishes no history of search positions, so this starts the day we first tracked a keyword and never backfills.

wp.org is where the directory puts the plugin for that search. On merit is where it would sit if results were ranked on rating, support and updates, without the install boost. The last column is how far the wp.org position moved, from our first reading in the last 90 days to the latest.

3829 searches this plugin appeared in over the last 90 days, 20 listed. 3710 left out as unrelated or noise (years, numbers, stray words).

Directory rank vs rivals

wp.org popularity rank over time · higher is better · when a rival's line climbs above yours, they've overtaken you

How often this plugin actually ships. A steady rhythm is the maintenance signal a single "last updated" date can't show.

Share of active installs on each version of this plugin. Green is the current release; a big slice on older versions is a user base that has stopped updating.

Crossed into this band 4 years ago; the previous band took 2.9 years to cross, which places it about 80% of the way through.

1. ★★★★★ brielyn144

   4mo ago

   CleanTalk is great!

   Read on wp.org ↗
2. ★★★★★ bingokid

   4mo ago

   Plugin saved my site after it was flooded with spam orders. Support is super fast as well.

   Read on wp.org ↗
3. ★★★★★ souej

   4mo ago

   CleanTalk ist ein effektives Plugin. Ich nutze es schon länger auf mehreren Websites und bin sehr begeistert! Schluss mit täglichen, nervigen Spam- oder Phishing-E-Mails. Ich bedanke mich bei den Entwicklern und empfehle CleanTalk gerne weiter.

   Read on wp.org ↗
4. ★★★★★ Jeannine

   4mo ago

   Excellent support. The team investigated the issue thoroughly, kept me updated, and finally resolved the problem. I really appreciated the clear communication and the technical expertise. Thank you very much!

   Read on wp.org ↗
5. ★★★★★ masteringmatrix

   4mo ago

   Satisfied with the plugin. No more unwanted posts in my blogs.

   Read on wp.org ↗
6. ★★★★★ sylvskin

   4mo ago

   I LOVE CleanTalk. It just works! It’s quiet, simple to set up, and does its job without getting in the way. No coding, no complicated setup, just install it and let it work. I removed it for about six months because my hosting provider said their security would cover everything. It didn’t. Spam registrations and bot activity returned. As soon as I reinstalled CleanTalk, the problem disappeared. If you want effective anti-spam protection that’s easy to use and quietly gets on with the job, I highly recommend CleanTalk.

   Read on wp.org ↗
7. ★★★★★ bbdigital78

   4mo ago

   My clients were experiencing massive spam problems on their forms. Cleantalk fixed this quickly. I share a report weekly with them weekly showing all the submissions that were passed through and those that were blocked and we’ve been very pleased with the results. I recently had a support question, Almaz responded quickly and answered my question to my satisfaction.

   Read on wp.org ↗
8. ★★★★★ lorisawaya

   4mo ago

   Dropping a message on my admin page that I can not close — !@#$ you. Immediately deleted the plug in.

   Read on wp.org ↗

Recent releases and news for this plugin

1. — Version 6.84 New. Integration. WooCommerce. Spam order details modal windows implemented. New. Integration. Catch fetch request. Iframe forms of sender.com protected. Fix. Settings. Improve alt storage. Fix. ContactEncoder. Addition 6.84
2. — Version 6.83.1 Upd. Settings. Implement honey test. 6.83.1
3. — Version 6.83 New. Settings. Getting apikey wizard. New. RateLimit. Enabled the RateLimit shared library New. Footer. New link on Website Feedback Plugin Upd. Contacts Encoder. Flow improvements. Upd. ContactEncoder. Improve shortcode 6.83
4. — Version 6.82 New. Integration. Integration with Email Subscribers Fix. Integration. Editing the doBlock method New. Integration. Integration edits when on and off js Fix. Code. Editing the check_value parametere 6.82
5. — Version 6.81 New. Code. Amelia integration Code. Links from backend Fix. Code. Improve statement. Fix. Code. Editing the array key transfer Fix. SFWUpdateLog. Transferring values to placeholders prepare() Fix. SFW. Mixing values in c 6.81
6. — Version 6.80 Fix. catchJqueryAjax. Object as null comparison fixed. Fix. CatchXHR. Mailpoet integration added to provide the event_token. Upd. Bot Detector Service. Added alternative source URL. Upd. Bot Detector Service. Updates. Fi 6.80

All 19 disclosed vulnerabilities are patched in the current version (6.91). Sites still on an older version should update.

1. Patched High · 7.2 Anti-Spam by CleanTalk <= 6.89.1 - Unauthenticated Stored Cross-Site Scripting via 'user_email' Registration Parameter ↗
   2026-10-22 CVE-2026-109198 Improper Neutralization of Input During Web Page Generation Affects <= 6.89.1 Patched in 6.90
2. Patched Medium · 5.4 Anti-Spam by CleanTalk <= 6.88 - Unauthenticated Stored Cross-Site Scripting via Comment Content via ContactsEncoder Greedy Regex ↗
   2026-10-09 CVE-2026-103424 Improper Neutralization of Input During Web Page Generation Affects <= 6.88 Patched in 6.89
3. Patched Medium · 6.5 Spam protection, Honeypot, Anti-Spam by CleanTalk < 6.87 - Unauthenticated Arbitrary Shortcode Execution ↗
   2026-09-07 CVE-2026-19855 Improper Control of Generation of Code Affects < 6.87 Patched in 6.87
4. Patched High · 7.2 Spam protection, Honeypot, Anti-Spam by CleanTalk <= 6.86 - Unauthenticated Stored Cross-Site Scripting via Comment Content aria-label Placeholder ↗
   2026-09-04 CVE-2026-77830 Improper Neutralization of Input During Web Page Generation Affects <= 6.86 Patched in 6.87
5. Patched High · 7.2 Spam protection, AntiSpam, FireWall by CleanTalk <= 6.82 - Unauthenticated Stored Cross-Site Scripting ↗
   2026-07-27 CVE-2026-65437 Improper Neutralization of Input During Web Page Generation Affects <= 6.82 Patched in 6.83
6. Patched High · 7.2 CleanTalk Anti-Spam. Spam Firewall & Bot protection < 6.79 - Unauthenticated Stored Cross-Site Scripting ↗
   2026-06-11 CVE-2026-8071 Improper Neutralization of Input During Web Page Generation Affects < 6.79 Patched in 6.79
7. Patched Critical · 9.8 Spam protection, Honeypot, Anti-Spam by CleanTalk <= 6.71 - Authorization Bypass via Reverse DNS (PTR record) Spoofing to Unauthenticated Arbitrary Plugin Installation ↗
   2026-02-14 CVE-2026-1490 Reliance on Reverse DNS Resolution for a Security-Critical Action Affects <= 6.71 Patched in 6.72
8. Patched Critical · 9.8 Spam protection, Anti-Spam, FireWall by CleanTalk <= 6.43.2 - Authorization Bypass via Reverse DNS Spoofing to Unauthenticated Arbitrary Plugin Installation ↗
   2024-11-25 CVE-2024-10542 Missing Authorization Affects <= 6.43.2 Patched in 6.44
9. Patched High · 8.1 Spam protection, Anti-Spam, FireWall by CleanTalk <= 6.44 - Authorization Bypass due to Missing Empty Value Check to Unauthenticated Arbitrary Plugin Installation ↗
   2024-11-25 CVE-2024-10781 Improper Check or Handling of Exceptional Conditions Affects <= 6.44 Patched in 6.45
10. Patched Medium · 4.3 Spam protection, AntiSpam, FireWall by CleanTalk <= 6.20 - Cross-Site Request Forgery via apbct_settings__update_account_email ↗
    2023-12-27 CVE-2023-51696 Cross-Site Request Forgery Affects <= 6.20 Patched in 6.21
11. Patched Medium · 4.3 Spam protection, AntiSpam, FireWall by CleanTalk <= 6.20 - Cross-Site Request Forgery ↗
    2023-12-27 CVE-2023-51535 Cross-Site Request Forgery Affects <= 6.20 Patched in 6.21
12. Patched Medium · 6.3 Spam protection, AntiSpam, FireWall by CleanTalk <= 6.10 - Missing Authorization ↗
    2023-06-22 CVE-2023-33996 Missing Authorization Affects <= 6.10 Patched in 6.11
13. Patched High · 7.2 AntiSpam by CleanTalk <= 5.185 - Authenticated (Administrator+) SQL Injection ↗
    2022-10-03 CVE-2022-3302 Improper Neutralization of Special Elements used in an SQL Command Affects <= 5.185 Patched in 5.185.1
14. Patched Medium · 6.1 Spam protection, AntiSpam, FireWall by CleanTalk <= 5.173 - Reflected Cross-Site Scripting ↗
    2022-03-30 CVE-2022-28222 Improper Neutralization of Input During Web Page Generation Affects <= 5.173 Patched in 5.174.1
15. Patched Medium · 6.1 Spam protection, AntiSpam, FireWall by CleanTalk <= 5.173 - Reflected Cross-Site Scripting ↗
    2022-03-30 CVE-2022-28221 Improper Neutralization of Input During Web Page Generation Affects <= 5.173 Patched in 5.174.1
16. Patched High · 7.5 Spam protection, AntiSpam, FireWall by CleanTalk <= 5.153.3 - Unauthenticated Blind SQL Injection ↗
    2021-03-05 CVE-2021-24295 Improper Neutralization of Special Elements used in an SQL Command Affects <= 5.153.3 Patched in 5.153.4
17. Patched High · 7.2 Anti-Spam by CleanTalk < 5.149 - Authenticated SQL Injection ↗
    2020-11-20 CVE-2021-24131 Improper Neutralization of Special Elements used in an SQL Command Affects < 5.149 Patched in 5.149
18. Patched Medium · 6.1 Spam protection, AntiSpam, FireWall by CleanTalk <= 5.127.3 - Reflected Cross-Site Scripting ↗
    2019-11-12 CVE-2019-17515 Improper Neutralization of Input During Web Page Generation Affects <= 5.127.3 Patched in 5.127.4
19. Patched Medium · 6.1 Spam protection, AntiSpam, FireWall by CleanTalk < 5.22 - Reflected Cross-Site Scripting ↗
    2015-08-25 Improper Neutralization of Input During Web Page Generation Affects < 5.22 Patched in 5.22

Translated into 39 languages, 11 at 90% or more

Plus 15 more locales with partial translations.

Whether ChatGPT and Claude name this plugin when asked the category question, and whether the readme gives them something to quote.

Growth timeline

Install-tier crossings we have observed, and how long each tier took to outgrow

1. 2022-11-19 100K+ → 200K+ up after 1044 days in tier
2. 2020-01-10 90K+ → 100K+ up after 221 days in tier
3. 2019-06-03 80K+ → 90K+ up after 153 days in tier
4. 2019-01-01 70K+ → 80K+ up after 245 days in tier
5. 2018-05-01 60K+ → 70K+ up after 209 days in tier
6. 2017-10-04 50K+ → 60K+ up after 274 days in tier
7. 2017-01-03 40K+ → 50K+ up after 399 days in tier
8. 2015-12-01 30K+ → 40K+ up after 189 days in tier

Competes with

The plugins that solve the same job, ranked by shared tags then reach, closest match first. The letter on the right is each plugin's health grade (A best, F worst).

Embed this report card

Drop a live Pulse card for Anti-Spam, Spam FireWall by CleanTalk into a readme, a review or a deck. It updates itself.

Anti-Spam, Spam FireWall by CleanTalk: 200K+ active installs, 4.8★ (3,221 reviews). Plugin Pulse (WP Mayor), as of 2026-11-03. https://plugins.wpmayor.com/plugin/cleantalk-spam-protect