Spam & Disposable Email Protection

The Anti-Bot & Disposable Email Protection system is a built-in, multi-layered security feature in your TanaFlows theme. It works directly in the reader’s browser to keep automated spam robots (bots) from flooding your forms and to filter out temporary/fake emails, ensuring your subscriber list remains clean and high-quality.

Core Components

The system runs smoothly behind the scenes using these core parts:

• Subscription & Contact Forms: Displays in the reader’s preferred language and displays errors from Ghost CMS settings.
• Smart Filter: Automates multiple security checks, sets up hidden bot traps, and verifies email domains the moment the form is submitted.
• Preloaded Email Blocklist: A built-in database of over 130 temporary email domains to protect your forms even when offline.
• Idle Activation: Delays security script loading until the browser is idle to keep page load speeds fast for real readers.

How It Works: The 3-Step Defense

When a page containing a newsletter or contact form is opened, the system secures the form using a closed loop of three steps:

Step 1: Real-Interaction Activation

• When the page first loads, the form is completely clean, with no hidden fields or traps. This prevents automated scrapers from detecting the security script.
• Only when a real user interacts with the form (hovering over it, touching the screen, or clicking into the email input field) does the code wake up to:
  1. Record the start time of the interaction.
  2. Start downloading the latest public blocklist of temporary email domains in the background.
  3. Dynamically create a hidden input field (called a Honeypot) named nickname and place it far off the screen where real visitors cannot see it.

Step 2: Multi-Layer Validation on Submit

When the submit button is clicked, the script temporarily halts the submission to run three quick checks:

1. The Honeypot Trap: Spam bots usually inspect the page structure and fill out every input field they can find, including hidden ones. If the hidden nickname field contains any text $\rightarrow$ Identified as a Bot.
2. Interaction Timing: A real human needs a brief moment to type an email and click send (at least 2 seconds). If the time between clicking the input box and submitting the form is less than 2 seconds $\rightarrow$ Identified as a Bot.
3. Disposable Email Verification: The system extracts the domain (the part after @) and checks it against both the freshly fetched online blocklist and the built-in offline list. If a match is found $\rightarrow$ Identified as a Disposable Email.

Step 3: Smart Response

• If identified as a Bot (triggered the honeypot or submitted too quickly): The system blocks the actual request but displays a fake “Success” message. The browser will show “Subscribed successfully” and clear the fields. This tricks the bot into thinking it succeeded, stopping it from trying other malicious submission methods.
• If identified as a Disposable Email: The system blocks the submission and displays a clear error message in the active language (e.g., “Email address is not allowed.”) to guide the user to input their real email.

Key Advantages

• Zero Loading Delay: Heavy tasks (like downloading the email blocklist) only start when the reader is typing, keeping the initial website load incredibly fast.
• Seamless Layout: The hidden trap fields are positioned outside the visible area using modern CSS styles, so they never shift buttons or warp your form’s design.
• Always Protected: Combines real-time community blocklists with a built-in offline database so the protection never sleeps.
• Multi-language Support: Automatically translates error messages based on the language settings of your Ghost theme.