ZapBounce

ZapBounce and WordPress

WordPress form plugins collect addresses from a page anyone on the internet can reach, which makes them the noisiest source of email data most sites have.

Two problems arrive through that door: automated submissions and ordinary typos. Verification helps with both, provided the key stays out of the front end.

A public form is a public endpoint

Contact Form 7, Gravity Forms and WPForms all post to a public endpoint, and automated submissions find them without needing to target your site specifically.

Those submissions use addresses at domains that do not exist, or disposable ones. They inflate your list, trigger any automation attached to the form, and produce bounces when the list is mailed.

The typo problem is quieter and costs more. A real person mistyping their address gets nothing, assumes your site is broken, and does not try again.

How the data moves

  1. Hook into the form plugin's server-side validation

    Every major plugin exposes a validation filter that runs in PHP on submission. That is where the call belongs, not in the theme's JavaScript.

  2. Store the key in wp-config.php

    As a constant, outside the database and outside the theme. A key in a plugin settings field is in the database, which ends up in backups.

  3. Reject only the definite failures

    An invalid result, or a true disposable flag. Blocking catch-all and unknown rejects real people at companies running accept-all servers.

  4. Fail open on a timeout

    WordPress hosting is not fast and the API call is a network round trip. If it times out, accept the submission.

Setting it up

  1. Define the API key as a constant in wp-config.php.
  2. Add a validation filter hook for your form plugin in a small custom plugin, not in the theme's functions.php.
  3. Call the verify endpoint with a two-second timeout using wp_remote_post.
  4. Reject the submission only when the result is invalid or the disposable flag is true.
  5. Accept the submission on any error or timeout, recording the verdict as unknown.
  6. Store the verdict with the entry so you can review what was caught.

WordPress: common questions

Where should the key live?

A constant in wp-config.php. Plugin settings fields are stored in the database and end up in every backup.

Does this stop form spam?

It stops submissions with addresses that do not exist. A rate limit and a honeypot stop more, and the three together stop most.

Theme or plugin?

A small custom plugin. Code in functions.php is lost when the theme is updated or changed.

Reference

Check a WordPress export today

100 free checks a month, no card. Unknown results and duplicates are never billed.

Get an API keySee pricing