Threat Intelligence Log
Deep dives into botnet behavior, spam trends, and security best practices from our research team.
The Zero Spam Threat Intelligence Log is a free research hub covering website spam and abuse: how botnets probe WordPress forms, why CAPTCHA services keep changing their terms, and which fixes actually hold. Every article is written by the team that has tracked global spam reputation data since 2018, and revised as threats change.
- Protecting sites since 2018
- Free WordPress.org plugin
- Written by practitioners, not marketers
Reputation lookup
Check an IP or email address right now
Paste an address from your form submissions and see what the Zero Spam network knows about it — abuse history, first and last sighting, and the blocklists it appears on.
Browse by topic
Pick the shelf you need
Keep junk out of your forms, keep attackers out of your site, or build the reputation network into your own stack.
Spam Protection
Contact form spam, comment spam, CAPTCHA alternatives, Turnstile and reCAPTCHA troubleshooting.
15 articlesSite Security
Malware, compromise cleanup, incident response, and the long-run data on how website abuse is shifting.
14 articlesBuild on the API
Not an article category — the reputation endpoint itself, with quotas, response fields, and client examples.
Developer docsExplore by problem
What is actually going wrong?
AI (6) AI bots (4) bot protection (6) CAPTCHA (6) conversion optimization (1) email security (2) form security (8) fraud prevention (4) Google Cloud (3) incident response (8) malware (1) privacy & compliance (2) reCAPTCHA (4) security hardening (20) SEO spam (3) social engineering (1) threat intelligence (17) user experience (3) website security (18) WordPress security (19)
The archive
Every article, newest first

Gravity Forms CVE-2026-84434: Check Hidden Upload Fields
Gravity Forms 3.1.0.4 and older let anyone upload files through a hidden File Upload field (CVE-2026-84434, CVSS 9.8). Update to 3.1.1+, then…

Visual Composer CVE-2026-12227: Are You on 45.16.1+?
Visual Composer 45.16.0 and older let unauthenticated attackers run files on your server (CVE-2026-12227). The fix shipped quietly in July. Update to…

Elementor CVE-2026-62062: One Link Can Add an Admin
Elementor 4.3.0 and 4.3.1 let one clicked link create an admin account (CVE-2026-62062). Update to 4.3.2 and check for admins added since…

cPanel CVE-2026-87899: What WordPress Hosts Should Check
CVE-2026-87899 lets any cPanel login run code as root. Update cPanel to a fixed build, update WP Toolkit to 6.11.3 separately, and…

Comment2Shell: Check WordPress Comments for CVE-2026-93485
Comment2Shell (CVE-2026-93485) lets an anonymous comment run script in an admin’s browser. Update to WordPress 7.1.1+, then sweep stored comments.

WordPress 7.1.2: Check for CVE-2026-87902 Now
WordPress 7.1.2 fixes CVE-2026-87902, an unauthenticated flaw attackers began probing within hours. Update, then check your theme, PHP settings, and logs.

Hide reCAPTCHA Badge in WordPress (2026)
Hide the reCAPTCHA badge in WordPress safely. Use the required disclosure text, and prep for the April 2, 2026 terms change.

reCAPTCHA Terms Change (Apr 2, 2026)
Using reCAPTCHA? April 2, 2026 changes its legal terms. See what to update in WordPress and how to block spam with fewer…
Stop reading, start blocking
Plans that fit the article you just read
Every plan uses the same reputation network the research above is based on. Start free, upgrade only when your request volume asks for it.
Explorer API License
Best for trying it out.
- 10 requests/month
- Single site/app license
- Threat confidence
- Basic source info
Essentials API License
Best for small sites/apps.
- 10,000 requests/month
- Single site/app license
- Threat confidence
- Source intelligence
- Activity history
Business API License
Best for busy businesses.
- 50,000 requests/month
- Single site/app license
- Everything in Essentials
- IP abuse reports
- Email abuse reports
Platform API License
Best for unlimited coverage.
- Unlimited requests/month
- Covers 3 sites/apps
- Everything included
- Priority support
- Integration support
Explorer API License
Best for trying it out.
- 10 requests/month
- Single site/app license
- Threat confidence
- Basic source info
Essentials (Yearly)
Best for small sites/apps.
- 10,000 requests/month
- Single site/app license
- Threat confidence
- Source intelligence
- Activity history
Business (Yearly)
Best for busy businesses.
- 50,000 requests/month
- Single site/app license
- Everything in Essentials
- IP abuse reports
- Email abuse reports
Platform (Yearly)
Best for unlimited coverage.
- Unlimited requests/day
- Covers 3 sites/apps
- Everything included
- Priority support
- Integration support
Questions
About this hub
Yes. Zero Spam checks the reputation of the IP address and email address behind each submission against a network of known abusive actors, so most spam is rejected before a human is ever asked to prove anything. Many sites remove reCAPTCHA or Turnstile entirely; others keep a challenge as a last resort for high-risk traffic only.
Incident write-ups are published as we confirm the details and are amended if the attack changes. Evergreen guides with a year in the title are reviewed at least quarterly, and the review date appears at the top of each article.
No. Every guide is free to read, and the free Explorer plan covers a small number of reputation requests a month, which is enough to check suspicious addresses by hand. Paid plans start when you want the plugin or API checking every submission automatically.
Ben Marshall, full-stack developer and engineering manager, writes and maintains the log, drawing on Zero Spam network data. Zero Spam is a service provided by Highfivery Studio and has been tracking spam reputation since 2018.
Get protected
Reading about form spam will not stop it
Install the plugin, connect a free key, and let the network reject known abusive traffic before it reaches your inbox. No puzzles for your visitors.









