ZapBounce

ZapBounce and WordPress

To block disposable and fake emails on a WordPress or WooCommerce form, check the address on the server when the form is submitted. A small plugin calls the ZapBounce API from the form plugin's validation hook, and it rejects the entry when the result is invalid or the disposable flag is true.

The check runs in PHP, so your key never reaches the browser. It works with Contact Form 7, Gravity Forms, WPForms and the WooCommerce checkout. If you'd rather not write code, send each new entry to a Zap and let a Zapier webhook step calling ZapBounce tag it after the fact.

A public form is a public endpoint

Every WordPress form posts to an address anyone can reach, and bots find those forms without targeting your site. They fill them with made-up domains and throwaway inboxes, then your list and your automations pay for it.

Disposable addresses are the other leak. Someone grabs a coupon or a download with an inbox that dies in an hour, and the address bounces on your next send. ZapBounce sets a disposable flag from a maintained list of throwaway domains, which you can browse on the disposable domains page.

The typo problem is quieter and costs more. A real buyer who types gmial.com gets no receipt, decides your store is broken, and doesn't come back.

How the data moves

  1. Hook into server-side validation

    Contact Form 7, Gravity Forms and WPForms each run a validation filter in PHP on submit, and WooCommerce runs one at checkout. That's where the call belongs, not in the theme's JavaScript.

  2. Keep the key in wp-config.php

    Define it as a constant, outside the database and outside the theme. A key in a plugin settings field is stored in the database and ends up in every backup.

  3. Reject only the definite failures

    Block an invalid result or a true disposable flag. Let catch_all and unknown through, since those are often real people at companies that run accept-all mail servers.

  4. Offer the typo fix

    When the result is invalid, say so in the form error. The visitor fixes one letter and the entry goes through.

Setting it up

  1. Define the API key as a constant in wp-config.php.
  2. Create a small custom plugin and add the validation filter for your form plugin, or for the WooCommerce checkout.
  3. Call POST /v1/verify with wp_remote_post and a two-second timeout. The PHP library page shows the request.
  4. Reject the submission when the result is invalid or the disposable flag is true, and ask the visitor to retype the address.
  5. Accept the submission on a timeout or an error, and record the result as unknown.
  6. Save the result with the entry so you can review what the check caught.

WordPress: common questions

How do I block disposable emails on a WordPress form?

Call ZapBounce's verify endpoint from your form plugin's validation hook and reject the entry when the disposable flag is true. The flag comes from a maintained list of throwaway domains, and each check costs one credit.

Does this work on the WooCommerce checkout?

Yes. Run the same check in WooCommerce's checkout validation hook, block invalid and disposable addresses, and ask real buyers to retype an invalid email before paying.

Where should the API key live?

In wp-config.php as a constant. Plugin settings fields are stored in the database, and the database ends up in every backup.

Will the check slow my form down?

Set a two-second timeout and accept the entry if it runs out. The visitor never waits longer than that, and you can check the unknown rows later.

Reference

Check a WordPress export today

100 free checks a month, no card. Unknown results are refunded.

Get an API keySee pricing