Invisible traps
A hidden field and a timing check that only scripts trip. Real visitors never see them. Submissions that skip your page's JavaScript entirely are recorded as a signal.
WordPress · Elementor Pro forms
Form spam filter that keeps every real inquiry.
TW Form Guard checks each Elementor Pro form submission in three layers: invisible traps, rules learned from 29,361 real submissions, and an AI judge. The free plugin runs that judge on your own provider key — the submission goes from your server to the provider you chose, and never reaches us at all.
September 2026 benchmark, 88 real submissions: 63 of 69 spam caught, 19 of 19 genuine inquiries kept. Read the methodology
Free needs no account, and with your own key nothing reaches StoreFixKit — we do not route, see or store the submission. Premium is for owners who would rather not obtain a key at all: we host the judging, $79 per site per year or $9 per site per month.
Benchmark · 88 production submissionsSept 2026
Spam caught
63of 69 spam submissions
Genuine kept
19of 19 real inquiries (0 false positives)
AI judge latency
1.35 smedian, 1.76 s at p95
When the AI is unreachable
Submissionpasses
Log entryai_unavailable
Your formunchanged
Sample: 69 spam and 19 genuine inquiries taken verbatim from live exporter sites. Rules and AI judge combined, measured with deepseek-v4-flash — another model will score differently, which is what the plugin's built-in 12-sample self-test is for.
Freetraps, rules and AI on your own provider key — nothing reaches us
Fail-openoutage or used-up quota means your forms keep working
14-dayrefund on Premium, no questions asked
How it works
Three layers. Nothing for a human to solve.
No CAPTCHA, no puzzles, no delay for the buyer. Each submission is scored in order, and the first layer with a clear answer decides.
Rules, in plain PHP
Fifteen rules distilled from replaying 29,361 submissions across our own exporter sites: invalid emails, throwaway domains, template spam in 28 languages, link drops, scam phrases, repeat offenders. Runs locally in under a millisecond.
AI judge
What the rules cannot decide is put to a language model as one question: SPAM or HAM. The answer is one word; nothing else the model says is used. Point it at your own provider, or let us host it.
Fail-open by design. If the provider is unreachable, your monthly quota is used up, or the model returns anything but a clear answer, the submission passes and is logged as ai_unavailable. TW Form Guard never blocks a form because an AI call failed.
Start in Dry-run. Nothing is blocked; everything is logged with its reason. Switch to Block once the log shows no false positives. Blocked submissions are quarantined, and any of them can be released with one click.
Layer 2 · the AI judge
Your key, or ours.
Same prompt, same one-word answer, same fail-open behaviour. What differs is whose key pays for the call — and, more to the point, where your enquiries travel.
| My own AI provider · Free | Hosted · Premium | |
|---|---|---|
| The enquiry goes | Straight to your provider | To our relay, then the model |
| Does it reach us? | Never. Not routed, seen or stored | In memory only, never written down |
| You arrange | Base URL, key, model name | Nothing at all |
| Contract with | Your provider. We add no sub-processor | Us, under the DPA |
| Cost | Your provider's tokens, cents a month | $79 a year, 10,000 a month |
| Available in | Free and Premium | Premium only |
Which model? Any provider that publishes an OpenAI-compatible /chat/completions endpoint over https will do — OpenAI, DeepSeek, Moonshot (Kimi), Zhipu, Qwen, Groq and OpenRouter all document one, and so do local runtimes such as Ollama, vLLM and LM Studio, in which case the text never leaves your own network. Model quality varies, so the plugin ships twelve real production messages (six spam, six genuine enquiries) and scores your chosen model against them on demand. How to set it up
Pricing
Free does the job, AI included. Premium hosts it for you.
The AI judge is in the free plugin — you bring the key. Premium is for owners who would rather not deal with a provider at all. Each Premium license covers one site; Stripe hosts checkout and billing, and Free keeps working if a subscription ends or the license service is unavailable.
Free
TW Form Guard
$0 forever
- Layer 0 traps and all Layer 1 rules
- AI judging with your own provider key — straight from your server to your provider, never through us
- 12-sample self-test to score the model you picked
- Dry-run and Block modes with a reason log
- Quarantine and one-click release
- Custom block keywords and trusted domains
- WordPress privacy export and erase support
- No account, no license, nothing sent to us
GPL. Requires WordPress 6.0+, PHP 7.4+, Elementor Pro.
Premium
TW Form Guard + hosted AI
$79 per site per year
or $9 per site per month
- Everything in Free
- Hosted AI judging — no key to obtain, no model to choose, no per-call bill
- Includes 10,000 judgements per month, then falls back to rules — never blocks your forms
- Automatic updates through the WordPress updater
- Priority email support
- License bound to one site; move it any time
- 14-day refund
- Card Visa · Mastercard · Amex
- Alipay yearly plan
- WeChat Pay yearly plan
- Billed by Stripe
What counts as a judgement: one submission that the traps and rules could not decide and that the relay accepted for an answer. Rule-blocked and trusted-domain submissions never reach the relay and never count; requests the relay refuses (quota reached, rate limit) do not count either. Past 10,000 in a calendar month (UTC) the plugin simply runs rules only until the month resets. On your own key there is no quota from us at all — we count nothing, cap nothing and bill nothing; your provider meters the calls.
FAQ
Before you install
Which forms does it protect?
Version 2.0 protects Elementor Pro forms, including popup forms. Contact Form 7, WPForms and Gravity Forms adapters are planned but not shipped; do not buy Premium for those yet.
Will it block real customers?
In the September 2026 benchmark of 88 real submissions, all 19 genuine inquiries passed and 63 of 69 spam submissions were caught, measured with deepseek-v4-flash. That is a measurement on one model and one sample, not a guarantee: a different model will score differently, which is why the plugin can run twelve real messages through your model and show you the score. Start in Dry-run, read the log for a week, and only then switch to Block. Anything blocked stays in quarantine and can be released.
Do I have to pay to use the AI judge?
No. "Use my own AI provider" is in the free plugin: you paste a Base URL, an API key and a model name, and the plugin calls that endpoint directly. Premium exists for owners who do not want to obtain a key, pick a model or watch a per-call bill — we host the judging instead, and include 10,000 judgements a month.
What is sent to the AI, and where?
Nothing at all unless you switch the AI judge on; it is off after installation, and the traps and rules never send anything anywhere. With your own provider key the plugin posts the sender name, email address and message text (up to 1,500 characters) from your own server directly to the endpoint you configured — it does not pass through StoreFixKit, we never see it, and we add no sub-processor to your data flow; what happens to it next is between you and the provider you chose. With hosted judging the same three fields go to our relay in the United States, which passes them to the model provider, DeepSeek in China, and returns one word. Either way the visitor's IP address and your other form fields are never sent. Full detail, including sub-processors, in the privacy policy.
How do I know the model I picked is any good?
Run the self-test on the settings page. It sends twelve verbatim production messages — six spam that reached real inboxes, six genuine enquiries that must never be blocked — through your configured backend and shows how many of each it got right, including which ones it missed. It bypasses the cache, so it costs twelve calls on your key each time you run it.
What happens after 10,000 judgements in a month?
On Premium the hosted AI layer pauses and the plugin runs traps and rules only until the first day of the next month. Your forms keep accepting submissions and nothing is charged extra. On your own key we impose no quota at all.
Can I move a license to another site?
Yes. Deactivate it on the old site (or from the settings page) and activate on the new one. One license is active on one production site at a time; staging copies do not count while they are not activated.
What if I cancel or stop paying?
Hosted judging stops at the end of the paid period and the plugin drops back to Free automatically. Your log, settings and quarantine stay in your database, and the AI judge itself need not stop: switch the backend to your own provider key and it keeps running on the free build.
Do I still need a CAPTCHA?
No. TW Form Guard adds nothing visible to the form and does not slow the buyer down. You can keep an existing CAPTCHA if you want; the plugin runs after Elementor's own validation.
Refunds?
14 days from purchase, no questions asked. Email support@storefixkit.com with the checkout email.
Questions before you install? One address for setup, bugs and billing.
WordPress · Elementor Pro 表单
过滤表单垃圾，一条真询盘都不丢。
TW Form Guard 对每条 Elementor Pro 表单提交做三层判断：隐形陷阱、从 29,361 条真实提交中提炼的规则、AI 判定。免费版的 AI 判定用你自己的模型密钥：提交从你的服务器直连你选的供应商，完全不经过我们。
2026 年 9 月 88 条真实询盘基准：垃圾捕获 63/69，真询盘 19/19 保住。查看测试方法
免费版不用注册账号；用你自己的密钥时，提交不经过 StoreFixKit——我们不中转、不查看、不存储。付费版是给不想自己搞密钥的站长准备的：判定由我们托管，每站每年 $79，或每站每月 $9。
基准 · 88 条生产环境真实提交2026 年 9 月
垃圾捕获
63共 69 条垃圾提交
真询盘保住
19共 19 条真询盘（0 误伤）
AI 判定耗时
1.35 秒中位数，p95 为 1.76 秒
AI 连不上时
该条提交放行
日志记录ai_unavailable
你的表单不受影响
样本：69 条垃圾 + 19 条真询盘，全部取自外贸站的原始提交。规则层与 AI 层合并统计，用 deepseek-v4-flash 实测——换个模型分数会不一样，这正是插件内置 12 条样本自测的用途。
免费陷阱 + 规则 + 用你自己密钥的 AI 判定，数据不经过我们
不断服服务故障或额度用完，表单照常工作
14 天付费版无理由退款
工作原理
三层判断，买家什么都不用做。
没有验证码、没有拼图、不让买家多等一秒。每条提交按顺序过三层，哪一层先给出明确结论就以哪一层为准。
隐形陷阱
一个隐藏字段和一个提交时间检查，只有脚本才会触发，真人访客根本看不到。完全绕过页面 JavaScript 的提交会被记录为信号。
规则，纯 PHP
回放我们自己外贸站的 29,361 条提交后提炼出 15 条规则：无效邮箱、一次性域名、28 种语言的模板垃圾、链接堆砌、诈骗话术、重复来源。在你的服务器本地运行，耗时不到 1 毫秒。
AI 判定
规则拿不准的提交交给语言模型，只问一个问题：SPAM 还是 HAM。回答只有一个词，模型说的其他内容一概不采纳。可以指向你自己的供应商，也可以交给我们托管。
设计上就不断服。供应商连不上、当月额度用完、或模型没给出明确回答，这条提交一律放行，日志记为 ai_unavailable。TW Form Guard 绝不会因为一次 AI 调用失败就拦住你的表单。
先用 Dry-run（只记录）模式。什么都不拦，每条都记下原因。看一周日志确认没有误伤，再切换到 Block（拦截）。被拦的提交进隔离区，随时一键放行。
第 2 层 · AI 判定
用你的密钥，还是用我们的。
同一套提示词、同样只回一个词、同样不断服。区别只有两点：谁的密钥付这笔调用费，以及——更要紧的——你的询盘会经过谁。
| 用我自己的供应商 · 免费 | 托管判定 · 付费 | |
|---|---|---|
| 询盘发到哪里 | 直连你选的供应商 | 先到我们的中转，再到模型 |
| 会经过我们吗 | 完全不会：不中转、不看、不存 | 只在内存里，绝不落盘 |
| 你要准备什么 | Base URL、密钥、模型名 | 什么都不用 |
| 合同在谁那里 | 你的供应商。我们不加子处理者 | 我们，适用 DPA |
| 花多少钱 | 供应商按 token 计费，一月几分钱 | 每年 $79，每月 10,000 次 |
| 哪个版本有 | 免费版和付费版 | 仅付费版 |
选哪个模型？任何提供 OpenAI 兼容 /chat/completions 接口、且是 https 的服务都行——OpenAI、DeepSeek、月之暗面（Kimi）、智谱、通义千问、Groq、OpenRouter 都有公开文档；本地跑的 Ollama、vLLM、LM Studio 同样可以，那样正文根本不出你自己的网络。模型好坏差别很大，所以插件内置了 12 条真实生产样本（6 条垃圾、6 条真询盘），随时可以给你选的模型打分。怎么配置
价格
免费版连 AI 一起给，付费版帮你托管。
AI 判定就在免费版里，密钥你自己出。付费版是给不想跟模型供应商打交道的人准备的。每个付费 license 绑定一个站点，结账和账单由 Stripe 托管；订阅到期或 license 服务不可用时，免费版功能照常。
免费版
TW Form Guard
$0 永久
- 第 0 层陷阱 + 第 1 层全部规则
- 用你自己密钥的 AI 判定——从你的服务器直连供应商，不经过我们
- 12 条样本自测，给你选的模型打分
- Dry-run / Block 两种模式，日志带原因
- 隔离区 + 一键放行
- 自定义拦截关键词和信任域名
- 支持 WordPress 隐私导出与擦除
- 不注册、无 license、不向我们发送任何数据
GPL 协议。需要 WordPress 6.0+、PHP 7.4+、Elementor Pro。
付费版
TW Form Guard + 托管 AI
$79 每站 / 年
或每站每月 $9
- 免费版全部功能
- 托管 AI 判定——不用申请密钥、不用选模型、没有按次账单
- 每月含 10,000 次判定，超出后自动回退到规则层——绝不拦你的表单
- 走 WordPress 更新器自动升级
- 优先邮件支持
- license 绑定一个站点，随时可迁移
- 14 天退款
- 支付宝 年付
- 微信支付 年付
- 银行卡 Visa · Mastercard · Amex
- Stripe 收款
什么算一次判定：陷阱和规则都拿不准、并且被中转服务受理的一条提交。被规则拦下的和信任域名的提交根本不会发到中转，不计数；被中转拒绝的请求（额度已满、触发限速）也不计数。一个自然月（UTC）超过 10,000 次后，插件只跑规则，到下月自动恢复。用你自己的密钥时，我们这边没有任何额度——不计数、不设上限、不收费，调用由你的供应商计量。
常见问题
安装前先看这里
支持哪些表单？
2.0 版只支持 Elementor Pro 表单（含弹窗表单）。Contact Form 7、WPForms、Gravity Forms 的适配在计划中但还没发布，用这些表单的站先别买付费版。
会不会误拦真客户？
2026 年 9 月 88 条真实提交的基准里，19 条真询盘全部放行，69 条垃圾拦下 63 条，用的是 deepseek-v4-flash。这是一个模型、一份样本上的实测，不是保证：换模型分数会变，所以插件可以拿 12 条真实消息跑你选的模型并把成绩给你看。先用 Dry-run 看一周日志，确认没误伤再切 Block。拦下的提交都在隔离区，随时可放行。
用 AI 判定必须付费吗？
不必。「用我自己的模型供应商」就在免费版里：填 Base URL、API key 和模型名，插件直接调你填的那个地址。付费版是给不想申请密钥、不想选模型、不想看按次账单的人：判定由我们托管，每月含 10,000 次。
发给 AI 的是什么数据，发到哪里？
不开 AI 判定就什么都不发（默认关闭），陷阱和规则两层任何时候都不外发。用你自己的密钥时，插件从你自己的服务器把发件人姓名、邮箱和留言正文（最多 1,500 字符）直接发到你配置的那个地址——不经过 StoreFixKit，我们看不到，也不给你的数据链路增加任何子处理者；之后这些内容怎么处理，是你和你选的供应商之间的事。用托管判定时，同样这三项发到我们在美国的中转，中转再交给模型供应商 DeepSeek（中国），拿回一个词。两种方式都不发访客 IP 和表单其他字段。子处理者等完整细节见隐私政策。
怎么知道我选的模型够不够用？
在设置页跑自测。它把 12 条原样的生产消息（6 条真进过客户邮箱的垃圾、6 条绝不能拦的真询盘）送进你配置的后端，告诉你各答对多少条、错在哪几条。自测绕过缓存，所以每跑一次就在你的密钥上花 12 次调用。
当月 10,000 次用完了怎么办？
付费版的托管 AI 层暂停，插件只跑陷阱和规则，到下月 1 号自动恢复，表单照常收询盘，不额外收费。用你自己的密钥则完全没有我们这边的额度限制。
license 能换站吗？
能。在旧站停用（或在设置页解绑），到新站激活即可。一个 license 同一时间只能在一个生产站激活，没激活的测试站不占名额。
取消订阅或不续费会怎样？
托管判定到当期结束停止，插件自动回到免费版。日志、设置、隔离区都还在你的数据库里；AI 判定本身也不必停——把后端切成你自己的密钥，免费版照样跑。
还需要验证码吗？
不需要。TW Form Guard 不在表单上加任何可见元素，也不拖慢买家。已有的验证码可以保留，插件在 Elementor 自己的校验之后运行。
退款怎么办？
购买后 14 天内无理由退款。用下单邮箱发信到 support@storefixkit.com 即可。