A disposable address comes from a throwaway inbox service. Someone uses it to grab a download, a coupon or a free trial, and the inbox is gone within hours. On a WordPress site these addresses land in Contact Form 7, WPForms, Gravity Forms and the WooCommerce checkout. The disposable email entry explains how the services work.
Most site owners try a browser check first. A regex in JavaScript only tests the shape of the address, and anyone can switch JavaScript off. The next step is usually a plugin with a fixed list of banned domains. It works on day one, then misses every throwaway domain that appears after it shipped.
Here's the server-side flow that holds up. Your form plugin runs a validation filter in PHP when the visitor clicks submit. The filter sends the address to POST /v1/verify with a short timeout, and ZapBounce returns a result plus a disposable flag. Reject the entry with a clear message when disposable is true or the result is invalid. Let everything else through.
ZapBounce reads its disposable list from the open-source disposable-email-domains project on GitHub, merged with our own additions and refreshed every week. The disposable domains page prints the current domain count and the date of the last update. You don't pay extra for the flags: one check returns the result and every flag for one credit.
Setup takes one small plugin. The WordPress integration page walks through the hook for each form plugin, and the PHP library page shows the request. Rather not write code? Send each new entry to a Zap, and ZapBounce's Zapier action tags it after the fact. Checks cost $5 for 1,000, and every account gets 100 free checks a month with no card.
Related questions
Can I block disposable emails at the WooCommerce checkout?
Yes. WooCommerce runs a checkout validation hook in PHP, and the same API call works there. Stop the order when the disposable flag is true, and show a message asking for a work or personal address.
Do WordPress blocklist plugins catch new disposable domains?
A fixed blocklist only catches the domains it held when it shipped. New throwaway domains appear all the time, so a list needs a regular refresh. ZapBounce refreshes its list every week from the open-source disposable-email-domains project plus its own additions.
Should I check the email in JavaScript or in PHP?
Check it in PHP. A browser check is easy to bypass, and it would put your API key in the page source. Keep the key in wp-config.php as a constant and call the API from the form plugin's server-side validation filter.
How much does it cost to check WordPress form signups?
ZapBounce charges $5 for 1,000 checks, and every account gets 100 free checks a month with no card. Unknown results and duplicates are never billed. Credits never expire, so a quiet month costs nothing.