Disposable Email Guard

Yes. Every check runs on your own server against domain lists stored inside the plugin, so no visitor email ever leaves your site. There is no third-party processor, so there is no DPA to sign with us or with anyone else.

Blocked and flagged attempts (email, domain, reason and IP address) are kept in a local detection log for your review: 90 days by default, configurable from 7 to 365 days, exportable as CSV. Mention that log in your privacy policy. Similar considerations apply under other privacy laws; check your own obligations.

Never. Validation is a local lookup against the lists that ship inside the plugin. The optional dead-domain check sends one DNS query for the domain part only, never the address. Paid services such as ZeroBounce or Verifalia, by comparison, send every checked address to their cloud and bill you per check.

Not in its default configuration. By default the plugin makes no outbound connections: the five lists are bundled snapshots loaded from disk. Only if you opt into auto-update, or click Update now, does it download the public list files from GitHub. Those requests carry no email addresses, no user data and not your site URL.

Every plugin release bundles refreshed snapshots, so updating the plugin updates the lists. Auto-update is off by default; if you enable it, it runs daily at a quiet hour (03:00 by default) and can be set to hourly, twice-daily or weekly instead.

Nothing breaks. The bundled lists keep working, and a failed refresh never disables protection: the plugin keeps the previous successful copy until the next attempt succeeds.

About 13,000. Two well-known lists are switched on by default and load from snapshots inside the plugin, so they are detected from the moment you activate the plugin. For stricter coverage, switch on three more bundled lists on the Lists & Sources tab: about 98,000 domains with all five.

No. Each check is a single lookup in an in-memory map that is loaded once per request and cached for an hour, rather than a database query or a call to an external service. That stays instant even with all five lists switched on.

Only the first sign-up from a new domain waits for one DNS lookup. The result is cached for 24 hours (1 hour after a failed lookup), so most sign-ups hit the cache. The check is optional and off by default, and if your DNS resolver is down it lets the email through rather than blocking it.

Flag lets the sign-up through but tags it so you can review it. Block stops it immediately and shows the visitor an error message. Log only records every match without changing anything. The default mode is Flag: matches are let through and tagged until you switch to Block in the setup wizard or in Settings.

Flagged users are marked on their profile. Flagged comments are tagged, and flagged orders get an order note, a notice in the billing panel and a Flagged filter above the Orders list.

Yes. Set the mode to Log only. The plugin records every match in the dashboard and the detection log without rejecting or tagging anyone. After a few days you will know what would have been caught, and you can switch to Flag or Block with confidence.

No. Logging in is never checked; the plugin validates only new submissions such as registrations, checkouts, comments, profile email changes and the forms you enable. Existing accounts keep working even if their email provider later appears on a blocklist, and a password reset by username is always allowed. If long-standing members use a provider you now block, add that domain to the allowlist.

No, never. It only blocks new submissions or flags them for your review. Removing a user, order or comment is always a manual action in the normal WordPress and WooCommerce screens.

Only if you choose to. Anonymous email services such as Proton and Tutanota are off by default, so their users are not affected unless you turn the option on. Even then, you can add specific addresses or domains to your allowlist.

Add specific addresses (spammer@example.com) or simple wildcards: *@example.com matches every address at that domain, *@*.ru every .ru domain, and spam*@* any address whose name starts with “spam”. The allowlist always wins, so you can make exceptions to your own rules.

It checks the email everywhere WooCommerce takes one: customer registration, checkout (the billing email), the My Account page when a customer changes their email, and product reviews. The block-based checkout is validated server-side on the Store API with the same rules, messages and logging as the classic checkout.

It refuses to apply a coupon when the billing email at checkout is on a blocklist, even if your overall mode is Flag or Log. That stops the common pattern of grabbing a fresh throwaway email to redeem the same first-time-customer coupon again. It is on by default, works on both the classic and the block-based checkout, and can be turned off with one switch.

It is off by default. When you turn it on, any order placed with a flagged email is set to On hold the moment it is created. That stops automatic fulfilment and gives you a chance to review the order before it ships, which suits stores that do not want to hard-block customers at checkout but still want a safety net.

Flagged orders get an order note and a notice in the billing panel, and you can list them with the Flagged filter above the Orders list (classic and HPOS).

Yes. It works with both the classic WooCommerce order storage and High-Performance Order Storage (HPOS), and with both the classic and the block-based checkout. There is nothing to configure.

Yes, both are built in with nothing to configure. Emails submitted through those forms are checked the same way as registrations and checkouts, and your chosen mode (Flag, Block or Log) applies to them too.

They work too, with a few lines of PHP. Call the wpcdeg_check filter from your form plugin’s email-validation hook:

$result = apply_filters( 'wpcdeg_check', null, $email );
if ( is_array( $result ) && ! empty( $result['blocked'] ) ) {
    // $result['reason'], $result['domain'], $result['message']
}

Yes. The wpcdeg_validate_email filter receives every decision with the email and the context it came from, so you can override it for your own rules. There are WP-CLI commands for operations (refresh, test, stats, log, sources, clear-log), and settings can be exported and imported as JSON. The plugin’s Help tab and its readme on WordPress.org have the details.

Yes. An optional setting filters WordPress’s global is_email() function, so disposable addresses are caught everywhere that function is used, including places other plugins add later. It is off by default because it can be too strict for some setups.

Yes. No Pro version, no paid upgrade, no feature behind a paywall and no account. Every feature on this page is in the free download, and the plugin is open source under the GPL, the same license as WordPress itself.

Paid services such as ZeroBounce, Verifalia, NeverBounce or Kickbox charge for every email they check, typically fractions of a cent each, so the cost grows with your sign-ups. Every visitor email is also sent to a third party, which usually means a data-processing agreement and a privacy-policy update. Disposable Email Guard does the disposable-email part of that job on your own server, for free.

Small free plugins usually ship a short hard-coded list that changes only when the plugin is updated, and check only the registration form. Disposable Email Guard bundles five lists (two on by default, about 13,000 domains), adds wildcards and custom rules, Flag and Log modes, a coupon-abuse blocker, auto-hold for flagged WooCommerce orders, a dashboard, a digest and a detection log with CSV export, and can refresh its lists from upstream if you opt in.