Onar Alili

Onar Alili

Co-founder & Engineer at oopspam

Onar Alili is the co-founder of oopspam and the engineer behind its spam detection API.

He started oopspam in 2017 as a cybersecurity project while completing his Master’s degree at Sapienza University of Rome, where his thesis work was part of PANOPTESEC, a cybersecurity research project funded by the European Commission. What began as an open-source tool grew into the oopspam API, the oopspam Anti-Spam plugin for WordPress, and integrations with Zapier, Make and Bubble.

Onar builds the detection that keeps spam, fraud and abuse out of forms, sign-ups and checkouts without CAPTCHAs or storing visitor data. On this blog he writes technical guides on spam filtering and the API, and reviews other posts for technical accuracy. Read more about how oopspam started.

Posts by Onar (72)

Introducing OOPVulns - The WordPress Vulnerability Scanner Plugin

Keeping WordPress secure means constantly tracking updates across core, plugins, and themes. It’s easy to miss something critical.

Updated 3 min read

Defending WooCommerce: How we blocked 450,000 card testing attempts in one week

We recently stopped the largest WooCommerce card testing attack we’ve seen. Attackers targeted PayPal, credit, and debit card processors across multiple stores, creating thousands of failed orders marked with Origin = “Unknown.”

5 min read

How to Prevent Fake Orders in Shopify with Shopify Flow and oopspam

In our previous article, I discussed how nearly 90 apps in the Shopify store claim to block countries and offer similar blocking features, yet most are ineffective and easily bypassed. After exploring Shopify further to find a truly reliable solution, I discovered Shopify Flow.

6 min read

Why Shopify Country Blocking Apps Don't Actually Block Countries?

At oopspam, we started looking into Shopify as a potential integration with our API. I knew nothing about the Shopify app system, how it works, or its capabilities.

3 min read

So, you're using oopspam and still getting spam?

No solution is going to offer 100% protection, but we can get pretty close.

Updated 5 min read

Introducing Context-Aware Spam Detection: Now evaluating messages against your website's purpose

When you have a form on your website, you don’t always have enough background information from the sender for a traditional spam detector to properly filter.

Updated 5 min read

Card Testing Attacks: A New Threat Vector Through WooCommerce Block-based Checkout

Recent incidents have highlighted a concerning trend in e-commerce security: card testing attacks specifically targeting WooCommerce stores using the Block-based Checkout feature. While this modern checkout experience offers enhanced flexibility and user experience, it has…

Updated 4 min read

The Best Turnstile Alternatives & Competitors in 2026, Compared

While Cloudflare’s Turnstile is a popular choice, there are several other options available that might better suit your requirements. Let’s explore some of the top Turnstile alternatives and see how they stack up.

Updated 4 min read

The Best CAPTCHA Alternatives & Competitors in 2026, Compared

While traditional CAPTCHA and reCAPTCHA is a popular choice, there are several other options available that might better suit your requirements. Let’s explore some of the top CAPTCHA alternatives and see how they stack up.

Updated 6 min read

The Best reCAPTCHA Alternatives & Competitors in 2026, Compared

While reCAPTCHA is a popular choice, there are several other options available that might better suit your requirements. Let’s explore some of the top reCAPTCHA alternatives and see how they stack up.

Updated 5 min read

The Best CleanTalk Alternatives & Competitors in 2026, Compared

While CleanTalk is a popular choice, there are several other options available that might better suit your requirements. Let’s explore some of the top CleanTalk alternatives and see how they stack up.

Updated 5 min read

The Best Akismet Alternatives & Competitors in 2026, Compared

While Akismet is a popular choice, there are several other options available that might better suit your requirements. Let’s explore some of the top Akismet alternatives and see how they stack up.

Updated 5 min read

Adding Spam Protection To ASP.NET Core Web App Forms Using C#

.NET Core is one of the most popular platforms out there. It comes with everything you need to get going with building applications, including authentication, authorization, and identity management.

10 min read

How to Add hCAPTCHA to Elementor Forms

There are many ways to protect your Elementor forms from spam, and one of them is hCAPTCHA. Unfortunately, Elementor Forms doesn’t natively support hCAPTCHA.

4 min read

4 ways to protect your Ninja Forms from spam

Ninja Forms Lite is the most popular of all paid form builders with over 800,000 active installations. It is known to be beginner friendly.

Updated 5 min read

6 Ways to Block Spam & Card Testing Attack in MemberPress Checkouts

MemberPress is a popular WordPress membership plugin that allows you to create and manage subscription-based content, courses, and communities. While it offers robust features for membership sites, it’s important to protect your MemberPress installation from spam registrations…

Updated 5 min read

WS Form: Advanced User Blocking to Enhance Form Security

All form builders, including WS Form, offer some level of spam protection. WS Form provides built-in spam protection.

5 min read

WPForms: Advanced User Blocking to Enhance Form Security

All form builders, including WPForms, offer some level of spam protection. WPForms provides built-in spam protection.

5 min read

Gravity Forms: Advanced User Blocking to Enhance Form Security

All form builders, including Gravity Forms, offer some level of spam protection. Gravity Forms provides built-in spam protection like reCAPTCHA and hCAPTCHA.

5 min read

Fluent Forms: Advanced User Blocking to Enhance Form Security

All form builders, including Fluent Forms, offer some level of spam protection. Fluent Forms provides built-in spam protection.

5 min read

Elementor Forms: Advanced User Blocking to Enhance Form Security

All form builders, including Elementor Forms, offer some level of spam protection. Elementor Forms provides built-in spam protection.

5 min read

Troubleshooting WS Form Not Sending Email Notifications

You’re not alone if you’re NOT receiving email notifications from your WS Form on your website. The plugin uses the built-in wp_mail function to send your email notifications.

6 min read

Troubleshooting Fluent Forms Not Sending Email Notifications

You’re not alone if you’re NOT receiving email notifications from your Fluent Forms on your website. The plugin uses the built-in wp_mail function to send your email notifications.

6 min read

Troubleshooting Elementor Forms Not Sending Email Notifications

You’re not alone if you’re NOT receiving email notifications from your Elementor Forms on your website. The plugin uses the built-in wp_mail function to send your email notifications.

6 min read

Troubleshooting Gravity Forms Not Sending Email Notifications

You’re not alone if you’re NOT receiving email notifications from your Gravity Forms on your website. The plugin uses the built-in wp_mail function to send your email notifications.

6 min read

Troubleshooting WPForms Not Sending Email Notifications

You’re not alone if you’re NOT receiving email notifications from your WPForms on your website. The plugin uses the built-in wp_mail function to send your email notifications.

5 min read

The WordPress Security Checklist Most Developers Wish They Knew Sooner

Building a secure WordPress website is crucial for protecting your data and ensuring a smooth user experience. Many developers learn the hard way that implementing robust security measures from the start can save time and prevent headaches later on.

Updated 5 min read

Slow Bricks Site? 7 Hacks to Improve Website Performance

In our previous article, we talked about performance issues with WordPress and how to speed up your website no matter what page builder you are using. If you haven’t checked out the article, please do so before continuing, as it provides general speed optimization tips that…

8 min read

Don't Optimize for Speed - Load reCAPTCHA v3 on Every Page (Here's Why)

Let’s talk about something that’s been causing some confusion in the web dev community – the proper way to implement reCAPTCHA v3 on your website.

2 min read

Slow Elementor Site? 7 Hacks Experts Use to Drastically Improve Page Speed

In our previous article, we talked about performance issues with WordPress and how to speed up your website no matter what page builder you are using. If you haven’t checked out the article, please do so before continuing, as it provides general speed optimization tips that…

8 min read

The Tricks Spammers Use to Fool CAPTCHAs

You’ve probably encountered those annoying little puzzles that websites make you solve before letting you in – you know, the ones where you have to select all the images with traffic lights or type out some distorted text. Yeah, those are CAPTCHAs, and they’ve been around since…

5 min read

What No One Tells You About Cloudflare Turnstile

Cloudflare Turnstile is a relatively new CAPTCHA alternative designed to protect websites from spam and abuse. While it promises a more user-friendly experience than traditional CAPTCHAs, there are some hidden truths about Turnstile that often go unmentioned.

3 min read

Common reCAPTCHA Errors And How To Solve Them

Getting errors with reCAPTCHA can be frustrating. However, don’t worry!

4 min read

5 Ways to Block Spam in Ultimate Member Registration Forms

Ultimate Member is a popular membership plugin for WordPress. It extends standard WordPress login, registration features and add more comprehensive user profile.

7 min read

How to Hide the reCAPTCHA Badge?

The reCAPTCHA badge typically appears at the bottom right corner of the web page where the reCAPTCHA widget is embedded. It usually looks like a small badge with the Google logo and the text “Protected by reCAPTCHA” or “This site is protected by reCAPTCHA and the Google Privacy…

3 min read

How spammers abuse GitHub, Microsoft, and Google

oopspam has recently mitigated spam campaigns that target our customers with lots of links to popular companies like Microsoft, GitHub, SoundCloud, MIT, ConvertKit and others. These spam attacks sometimes didn’t contain much information, just simple links to these platforms,…

2 min read

8 Best WordPress Form Plugins in 2026: Speed & Accessibility Tested

We’ve been working with WordPress forms for over five years, mainly integrating the oopspam WordPress anti-spam plugin with them. This involves coding, creating forms and testing them.

Updated 28 min read

You're Doing WordPress Performance WRONG. Here's Why.

Slow websites are a big concern because they have a huge impact on your website and business. Here are some of them:

Updated 5 min read

3 ways to protect your Beaver Builder Contact Form from spam

Beaver Page Builder is one of the most used and popular page builders for WordPress. It comes with generous free and paid Pro versions.

7 min read

Building Accessible Forms: 6 Tips

When considering accessibility on your website it’s important to consider your web forms— whether it is a contact form, sign-up form or newsletter form. Accessible forms are important for high conversion, better SEO and user experience.

Updated 10 min read

4 Ways to Stop Fake Account Sign-Ups

If you run a business with a website and a signup form, you may already be getting spam signups. From a custom SaaS application to a WordPress blog, almost everyone is affected in one way or another.

Updated 6 min read

Stop spam on Netlify Forms using Zapier and oopspam

Netlify is a leading website deployment platform known for its ability to deliver highly scalable websites. It simplifies the build process and makes it possible to deploy websites quickly.

Updated 7 min read

How to Remove the 'Deceptive Site Ahead' Browser Warning

If you’re seeing the “Deceptive Site Ahead” warning on your website, don’t worry. This warning is a sign that your website has been flagged by Google and possible other providers as potentially harmful or deceptive.

Updated 3 min read

Securing Bricks Form: Effective Strategies for Spam Prevention

Bricks is a popular new website builder for WordPress. Like other page builders, it includes a form element.

Updated 7 min read

Breakdance Forms Spam Protection: A Step-by-Step Guide

Breakdance is a new and popular site builder for WordPress. Like other page builders, it comes with a form builder.

Updated 7 min read

Introducing: Domain Reputation Watch

Our team has been working on something great and we’re excited to share with you. Introducing: Domain Reputation Watch.

Updated 2 min read

Stop spam on Typeform using Zapier and oopspam

Typeform is a popular form builder used for creating various types of forms such as contact forms, feedback forms, sign-up forms, surveys, and more. However, when it comes to spam protection, Typeform doesn’t provide any built-in options.

Updated 8 min read

Securing Your Forminator Contact Forms: Proven Tactics for Spam Prevention

Forminator is another popular contact form builder packed with features. It has a generous free plan and a pro plan with extra features like Stripe integration, E-signature, and better support.

Updated 8 min read

Stop spam on HubSpot contact forms using Zapier and oopspam

HubSpot is a popular CRM solution that offers many different tools for businesses, including form creation. HubSpot’s forms can be used as contact forms, support tickets, or to generate leads, but they can also be targeted by spammers.

Updated 7 min read

5 ways to protect your Gravity Forms from spam

Gravity Forms is prepays the most popular contact form builder for WordPress, packed with a range of features that include online payment methods, automation, and conditional logics. One area where it truly stands out is the vast range of spam protection options it provides.

Updated 10 min read

3 ways to protect your Kadence Form Block from spam

Kadence is a well-known company in the WordPress community that has a couple of different products, including Kadence Theme and Kadence Blocks for building with Gutenberg. Their blocks work well and the theme is optimized for speed.

Updated 7 min read

Stop spam on Webflow forms using Zapier and oopspam

Webflow is a popular website builder that allows users to create websites through a drag-and-drop interface. While the platform provides a reCAPTCHA field to add spam protection to its contact forms, this may not always be effective. reCAPTCHA and other CAPTCHA solutions are…

Updated 6 min read

5 Ways To Prevent Spam On WS Form

WS Form is one of the most feature-rich form builders for WordPress. It supports over 55 field types, 100 ready-to-go templates, and all other good stuff like conditional logic and multi-step forms.

Updated 8 min read

Does hCAPTCHA slow down your website?

Slow websites are a big concern because they have a huge impact on your website and business. Here are some of them:

Updated 5 min read

Does reCAPTCHA slow down your website?

reCAPTCHA is a popular CAPTCHA solution. It’s hard to imagine anyone who hasn’t solved or seen at least one reCAPTCHA.

Updated 4 min read

What are Overpayment scams, and how to protect yourself?

Overpayment scam is a common fraud for online businesses. We have seen many web agencies targeted with this type of fraud.

3 min read

5 ways to stop spam orders and registrations in WooCommerce

WooCommerce is a go-to e-commerce plugin for WordPress. It supports different payment methods including Paypal, Stripe via add-ons, and standard payments like credit cards even cash & check payments.

Updated 11 min read

4 ways to protect your GiveWP Donation Forms from spam

GiveWP (aka Give) is one of the most popular donation form builder out there. It comes with generous free and paid versions.

Updated 8 min read

5 effective ways to protect your Formidable Forms from spam

Formidable Forms is one of the most popular contact form builder out there with over 13M downloads. It has everything you need to build a complex form from payment gateway integrating (Stripe etc.) to conditional logic and more.

Updated 8 min read

PHP Contact Form with Validation & Spam Protection

Every website has some way for its visitors to contact the site owner. It could be an email address, a contact form, or a live chat.

Updated 28 min read

4 ways to protect your Fluent Forms from spam

Recently, we added Fluent Forms support to oopspam WordPress plugin after one of our customers requested it on the WordPress support forum. Compare to other contact form plugins, Fluent Forms is lightweight with many features.

Updated 7 min read

5 ways to protect your WPForms from spam

Recently, we added WPForms support to oopspam WordPress plugin after one of our customers requested it on the support forum. No wonder we got this plugin requested as WPForms is one of the most used contact form plugins for WordPress.

Updated 7 min read

5 ways to protect your Elementor Forms from spam

Elementor Page Builder is one of the most used and popular page builders for WordPress. It comes with generous free and paid Pro versions.

Updated 8 min read

Spam protection for Bubble.io

I love no-code platforms. Bubble.io is perhaps one of the first and leading no-code solutions out there.

Updated 8 min read

7 ways to stop spam on your website

Feeling overwhelmed by the amount of spam you are getting on your website? You’re not alone.

Updated 10 min read

[Announcement] oopspam Anti-Spam Plugin now supports Contact Form 7

✨ oopspam Anti-Spam WordPress plugin now supports Contact Form 7.

2 min read

Introducing Country Restrictions

Up until now, oopspam API could spam score messages based on language, Machine Learning models, IP, content & URL analyses, and many more custom rules. Today, we are excited to announce a new shiny feature, Country Restrictions.

2 min read

[Announcement] oopspam Anti-Spam Plugin now supports Gravity Forms

One of the most commonly used contact forms for WordPress is Gravity Forms. oopspam WordPress plugin already supports Ninja Forms. However, we got many requests to integrate Gravity Forms as well.

2 min read

3 top open-source comment systems and their anti-spam capabilities

We’re going to talk about different commenting systems and how they fight spam.

Updated 6 min read

[Announcement] oopspam Anti-Spam WordPress Plugin is here

Recently, we finally published oopspam Anti-Spam WordPress Plugin in the marketplace. In this initial version, the main goal was to keep it simple.

2 min read

How to add a powerful spam filter to your contact form

If you have a contact form then you already know the amount of spam one can get daily. Usually, bots scan websites looking for a contact form or a comment section on a website to fill and submit.

Updated 9 min read

How to Use Spam Detection API to Protect Online Forms

If you have ever owned a website with a contact form or a blog with a comment section then you’ve probably experienced a huge amount of spam almost daily. You are not alone.

Updated 6 min read