Spam protection, Honeypot, Anti-Spam by CleanTalk

How well this listing is tuned to rank in WordPress.org search, on the factors an owner controls. Not popularity, optimization.

Directory rank vs rivals

wp.org popularity rank over time · higher is better · when a rival's line climbs above yours, they've overtaken you

How often this plugin actually ships. A steady rhythm is the maintenance signal a single "last updated" date can't show.

Share of active installs on each version of this plugin. Green is the current release; a big slice on older versions is a user base that has stopped updating.

Refined from the date this plugin crossed into its current band.

No paid tier is visible, so we don't put a figure on revenue or sale value: that would be guessing. The install base is a real asset to an acquirer, just not one public data lets us price. A declining trend compresses what a buyer would pay.

1. ★★★★★ brielyn144

   1mo ago

   CleanTalk is great!

   Read on wp.org ↗
2. ★★★★★ bingokid

   1mo ago

   Plugin saved my site after it was flooded with spam orders. Support is super fast as well.

   Read on wp.org ↗
3. ★★★★★ souej

   1mo ago

   CleanTalk ist ein effektives Plugin. Ich nutze es schon länger auf mehreren Websites und bin sehr begeistert! Schluss mit täglichen, nervigen Spam- oder Phishing-E-Mails. Ich bedanke mich bei den Entwicklern und empfehle CleanTalk gerne weiter.

   Read on wp.org ↗
4. ★★★★★ Jeannine

   2mo ago

   Excellent support. The team investigated the issue thoroughly, kept me updated, and finally resolved the problem. I really appreciated the clear communication and the technical expertise. Thank you very much!

   Read on wp.org ↗
5. ★★★★★ masteringmatrix

   2mo ago

   Satisfied with the plugin. No more unwanted posts in my blogs.

   Read on wp.org ↗
6. ★★★★★ sylvskin

   2mo ago

   I LOVE CleanTalk. It just works! It’s quiet, simple to set up, and does its job without getting in the way. No coding, no complicated setup, just install it and let it work. I removed it for about six months because my hosting provider said their security would cover everything. It didn’t. Spam registrations and bot activity returned. As soon as I reinstalled CleanTalk, the problem disappeared. If you want effective anti-spam protection that’s easy to use and quietly gets on with the job, I highly recommend CleanTalk.

   Read on wp.org ↗
7. ★★★★★ bbdigital78

   2mo ago

   My clients were experiencing massive spam problems on their forms. Cleantalk fixed this quickly. I share a report weekly with them weekly showing all the submissions that were passed through and those that were blocked and we’ve been very pleased with the results. I recently had a support question, Almaz responded quickly and answered my question to my satisfaction.

   Read on wp.org ↗
8. ★★★★★ lorisawaya

   2mo ago

   Dropping a message on my admin page that I can not close — !@#$ you. Immediately deleted the plug in.

   Read on wp.org ↗

Recent releases and news for this plugin

1. — Version 6.84 New. Integration. WooCommerce. Spam order details modal windows implemented. New. Integration. Catch fetch request. Iframe forms of sender.com protected. Fix. Settings. Improve alt storage. Fix. ContactEncoder. Addition 6.84
2. — Version 6.83.1 Upd. Settings. Implement honey test. 6.83.1
3. — Version 6.83 New. Settings. Getting apikey wizard. New. RateLimit. Enabled the RateLimit shared library New. Footer. New link on Website Feedback Plugin Upd. Contacts Encoder. Flow improvements. Upd. ContactEncoder. Improve shortcode 6.83
4. — Version 6.82 New. Integration. Integration with Email Subscribers Fix. Integration. Editing the doBlock method New. Integration. Integration edits when on and off js Fix. Code. Editing the check_value parametere 6.82
5. — Version 6.81 New. Code. Amelia integration Code. Links from backend Fix. Code. Improve statement. Fix. Code. Editing the array key transfer Fix. SFWUpdateLog. Transferring values to placeholders prepare() Fix. SFW. Mixing values in c 6.81
6. — Version 6.80 Fix. catchJqueryAjax. Object as null comparison fixed. Fix. CatchXHR. Mailpoet integration added to provide the event_token. Upd. Bot Detector Service. Added alternative source URL. Upd. Bot Detector Service. Updates. Fi 6.80

15 disclosed vulnerabilities on record for this plugin, all fixed in the current version. Sites on older versions stay exposed until they update.

1. High · 7.2 Spam protection, AntiSpam, FireWall by CleanTalk <= 6.82 - Unauthenticated Stored Cross-Site Scripting ↗
   2026-07-27 CVE-2026-65437 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 6.82 Patched in 6.83
2. High · 7.2 CleanTalk Anti-Spam. Spam Firewall & Bot protection < 6.79 - Unauthenticated Stored Cross-Site Scripting ↗
   2026-06-11 CVE-2026-8071 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects < 6.79 Patched in 6.79
3. Critical · 9.8 Spam protection, Honeypot, Anti-Spam by CleanTalk <= 6.71 - Authorization Bypass via Reverse DNS (PTR record) Spoofing to Unauthenticated Arbitrary Plugin Installation ↗
   2026-02-14 CVE-2026-1490 Reliance on Reverse DNS Resolution for a Security-Critical Action Affects <= 6.71 Patched in 6.72
4. Critical · 9.8 Spam protection, Anti-Spam, FireWall by CleanTalk <= 6.43.2 - Authorization Bypass via Reverse DNS Spoofing to Unauthenticated Arbitrary Plugin Installation ↗
   2024-11-25 CVE-2024-10542 Missing Authorization Affects <= 6.43.2 Patched in 6.44
5. High · 8.1 Spam protection, Anti-Spam, FireWall by CleanTalk <= 6.44 - Authorization Bypass due to Missing Empty Value Check to Unauthenticated Arbitrary Plugin Installation ↗
   2024-11-25 CVE-2024-10781 Improper Check or Handling of Exceptional Conditions Affects <= 6.44 Patched in 6.45
6. Medium · 4.3 Spam protection, AntiSpam, FireWall by CleanTalk <= 6.20 - Cross-Site Request Forgery via apbct_settings__update_account_email ↗
   2023-12-27 CVE-2023-51696 Cross-Site Request Forgery (CSRF) Affects <= 6.20 Patched in 6.21
7. Medium · 4.3 Spam protection, AntiSpam, FireWall by CleanTalk <= 6.20 - Cross-Site Request Forgery ↗
   2023-12-27 CVE-2023-51535 Cross-Site Request Forgery (CSRF) Affects <= 6.20 Patched in 6.21
8. Medium · 6.3 Spam protection, AntiSpam, FireWall by CleanTalk <= 6.10 - Missing Authorization ↗
   2023-06-22 CVE-2023-33996 Missing Authorization Affects <= 6.10 Patched in 6.11
9. High · 7.2 AntiSpam by CleanTalk <= 5.185 - Authenticated (Administrator+) SQL Injection ↗
   2022-10-03 CVE-2022-3302 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Affects <= 5.185 Patched in 5.185.1
10. Medium · 6.1 Spam protection, AntiSpam, FireWall by CleanTalk <= 5.173 - Reflected Cross-Site Scripting ↗
    2022-03-30 CVE-2022-28222 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 5.173 Patched in 5.174.1
11. Medium · 6.1 Spam protection, AntiSpam, FireWall by CleanTalk <= 5.173 - Reflected Cross-Site Scripting ↗
    2022-03-30 CVE-2022-28221 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 5.173 Patched in 5.174.1
12. High · 7.5 Spam protection, AntiSpam, FireWall by CleanTalk <= 5.153.3 - Unauthenticated Blind SQL Injection ↗
    2021-03-05 CVE-2021-24295 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Affects <= 5.153.3 Patched in 5.153.4
13. High · 7.2 Anti-Spam by CleanTalk < 5.149 - Authenticated SQL Injection ↗
    2020-11-20 CVE-2021-24131 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Affects < 5.149 Patched in 5.149
14. Medium · 6.1 Spam protection, AntiSpam, FireWall by CleanTalk <= 5.127.3 - Reflected Cross-Site Scripting ↗
    2019-11-12 CVE-2019-17515 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 5.127.3 Patched in 5.127.4
15. Medium · 6.1 Spam protection, AntiSpam, FireWall by CleanTalk < 5.22 - Reflected Cross-Site Scripting ↗
    2015-08-25 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects < 5.22 Patched in 5.22

Automated install-time checks, tested on PHP 8.1.12 · WP 7.0.1

Translated into 36 languages, 9 at 90% or more

Plus 12 more locales with partial translations.

Growth timeline

Install-tier crossings we have observed, and how long each tier took to outgrow

1. 2022-11-19 100K+ → 200K+ up

Competes with

The plugins that solve the same job, ranked by shared tags then reach, closest match first. The letter on the right is each plugin's health grade (A best, F worst).

• Kama SpamBlock 4K+ installs · 4.5★ · 4 shared tags A
• Honeypot Plus for Contact Form 7 800+ installs · 3.8★ · 4 shared tags B
• Gravity Forms Zero Spam 100K+ installs · 4.2★ · 3 shared tags A
• hCaptcha for WP 70K+ installs · 4.5★ · 3 shared tags A
• Maspik – Multi-Layer Spam Protection 30K+ installs · 4.6★ · 3 shared tags A
• Friendly Captcha for WordPress 10K+ installs · 3.9★ · 3 shared tags B

Embed this report card

Drop a live Pulse card for Spam protection, Honeypot, Anti-Spam by CleanTalk into a readme, a review or a deck. It updates itself.

Spam protection, Honeypot, Anti-Spam by CleanTalk: 200K+ active installs, 4.8★ (3,204 reviews). Plugin Pulse (WP Mayor), as of 2026-08-25. https://plugins.wpmayor.com/plugin/cleantalk-spam-protect