SpamLens

Description

SpamLens sends each incoming comment, WooCommerce review, pingback and Contact Form 7 submission to Jev — a “System One” decision model by TypeSafe AI that returns calibrated probabilities instead of text — and acts on the answer:

• Spam (probability above the spam threshold) goes straight to the Spam folder.
• Borderline comments, comments that look like spam but clearly respond to the page, and abusive comments are held for moderation.
• Everything else is left to WordPress’ own rules. SpamLens never approves a comment on its own.

If the service cannot be reached, the comment goes through the normal WordPress flow (or is held, your choice), and it is re-checked automatically within 20 minutes.

Bring your own key. Pick the service that hosts the model for you and paste its API key:

• TypeSafe AI (direct) — keys at console.typesafe.ai, currently about 1,200 requests per minute.
• Vercel AI Gateway — every Vercel team currently includes a $5 monthly credit, enough for roughly 240,000 comment checks. A payment method must be on file; the free tier is rate-limited, so bulk runs pause and resume.
• OpenRouter — pay-as-you-go.
• Custom endpoint — any proxy that accepts the TypeSafe request format.

Prices, credits and rate limits are set by the providers and were last checked in September 2026; see their pricing pages.

Other features

• “SpamLens” column in the comments list with the decision and probability (“Spam 99%”, “Held 63%”, “6% spam”), a human-readable category (SEO link spam, scam or phishing, commercial promotion, gibberish or bot, abusive, legitimate) and, when a comment was held for a reason other than its probability, that reason.
• Re-check with SpamLens row action and a Check for Spam button that sweeps the Pending queue in batches.
• Calibration tool: runs Jev on comments you already moderated and reports accuracy, false positives and the thresholds that would fit your site — read-only.
• History and raw answers in a meta box on the comment edit screen; false-positive / missed-spam counters based on your moderation.
• Privacy toggles for email, IP and user agent; suggested privacy-policy text; optional notice under the comment form.
• Filters for everything: spamlens_state, spamlens_post_context, spamlens_questions, spamlens_decision, spamlens_skip_comment, spamlens_providers, spamlens_integrations and more.

Page context. Jev judges a comment against the page it was posted on. By default it sees the title, type, tags and categories, the excerpt (or the first ~300 characters) and the page’s headings. “Extended” sends the first ~1,200 characters — about four times as much page text — for sites where spam is on-topic and well written; “Title only” sends no text from the page at all, which is the right choice for paywalled or members-only content. Membership plugins keep paid posts published, so the plugin cannot tell them apart on its own: pick “Title only” or use the spamlens_post_context filter. The text of password-protected, private and unpublished pages is never sent at any level.

Requirements: a key from one of the services above. Comment checks run while the visitor waits (about 1–2 s, 5 s timeout by default).

SpamLens is an independent plugin by VeronaLabs and is not affiliated with, endorsed by or supported by TypeSafe AI, Vercel or OpenRouter. Jev and TypeSafe are marks of TypeSafe AI; they are used only to indicate compatibility.

Source code

The settings screen and the comments-screen script in public/ are built (React, Vite, Tailwind CSS) from TypeScript and SCSS sources that are not included in the plugin zip. The sources, the build configuration and the tests are on GitHub: https://github.com/veronalabs/spamlens (folders resources/react, resources/entries and resources/scss). To rebuild: npm ci && npm run build.

External services

This plugin sends data to a third-party service to classify submissions. Nothing is sent until you save an API key, and only the service you select receives data.

What is sent, and when: for every new comment, review, pingback or Contact Form 7 submission that is not skipped by your settings, the plugin sends the submission text (capped at 6,000 characters), the author name and website, details of the page it belongs to — title, type, tags and categories, and, depending on the Page context setting, the excerpt or the first 300 (1,200 on “Extended”) characters of its text and its H2/H3 headings; the text of password-protected, private and unpublished pages is never sent — for replies the first 200 characters of the parent comment, the number and hosts of links in the text, the site name, URL, language and the “About this site” notes you entered, and the author’s number of previously approved comments. Optionally (Settings → SpamLens → Privacy) the author email address, IP address, browser user agent and referer are included. The Test connection and Calibration tools send the same kind of data on demand.

Services (one of them, as selected in the settings):

• TypeSafe AI — https://typesafe.ai — endpoint https://api.typesafe.ai/v1/systemone — Terms: https://typesafe.ai/terms — Privacy: https://typesafe.ai/privacy
• Vercel AI Gateway — https://vercel.com/ai-gateway — endpoint https://ai-gateway.vercel.sh/typesafe/v1/systemone — Terms: https://vercel.com/legal/terms — Privacy: https://vercel.com/legal/privacy-policy
• OpenRouter — https://openrouter.ai — endpoint https://openrouter.ai/api/alpha/decisions — Terms: https://openrouter.ai/terms — Privacy: https://openrouter.ai/privacy
• A custom endpoint you configure yourself is governed by that provider’s terms.

The response contains probabilities only. The plugin stores those probabilities, the category and the model version as comment meta; it does not store any additional personal data from the check.

Languages

Jev is primarily trained on English, where it achieves its best accuracy. Other languages, including CJK scripts, are handled but not equally well. Default thresholds (spam 0.85, hold 0.50) were tuned on English comments. On a non-English site: describe the site and its languages in “About this site”, run the Calibration tool before relying on the Spam folder, watch the false-positive counter, and consider raising the spam threshold so doubtful comments are held rather than spammed.

Model versions

Providers alias the model id (jev-latest, typesafe-ai/jev, typesafe/jev-latest) to the current release. Every verdict stores the versioned model id that actually answered (for example jev-1.13.0). Once your thresholds are calibrated, pick that version in the Model list (it lists the versions that have answered on your site, per provider) so a model upgrade cannot shift your scores; re-run the Calibration tool when you decide to move to a newer version.

Technical details