Stop Fake Emails & Bots: WordPress Email Validation with AWS SES

Algorithms are uncontrollable; Email lists are the real assets

Core updates from search engines and algorithm adjustments on social media platforms can instantly zero out a website's organic traffic or a fan page's reach. In the current landscape where tech giants control traffic distribution, the only channel that a brand can fully control and use to precisely reach its audience remains Email marketing.

However, opening up website forms to collect leads inevitably leads to encounters with malicious hackers, bot submissions, or disposable emails filled in randomly by users.

How Invalid Email Lists Can Destroy Your Mailing Reputation

Collecting "invalid" email addresses is more destructive than "collecting none." When a marketing system sends emails to a large number of invalid addresses, it generates a high Bounce Rate. Filtering mechanisms of Internet Service Providers (ISPs) like Gmail and Yahoo record this data, which in turn lowers your Domain Reputation. Once reputation is damaged, even important notifications or marketing emails sent to real customers in the future will be categorized directly as spam, resulting in a direct waste of your marketing budget.

Ensuring that every Email entering the database is "real and deliverable" is the foundational engineering task that every website relying on email marketing must solve.

Why did we develop the Email Guard plugin?

Recently, Amazon Web Services (AWS) launched a powerful Email Validation service for its Simple Email Service (SES). This service provides enterprise-grade email address verification capabilities, and its pricing is significantly lower than third-party verification API tools on the market.

To introduce this infrastructure into the WordPress ecosystem, we developed the Email Guard project. This is a WordPress Email verification hub featuring a "Core (Free) + Add-on (Pro)" dual-plugin architecture.

• Email Guard Core (Free Version): Currently applying for listing in the official WordPress.org repository. It provides complete local checks, caching mechanisms, and AWS SES integration to meet the basic protection needs of typical webmasters.
• Email Guard Pro (Paid Version): Currently in Beta testing. Designed specifically for high-traffic websites, it offers smart routing and local reputation technology to significantly save on high-frequency API verification costs.

Email Guard Core Features and Architecture (Free Version)

The free version of Email Guard offers high-level protection. Its system design is not just about calling an external API; it filters threats and saves costs through a multi-stage "validation funnel."

Multi-level Validation Funnel

The system performs validation in a strict sequence:

• L1 Format Check: Priority is given to using PHP’s built-in is_email() and Regular Expressions (Regex) for basic syntax checks. This is followed by a DNS MX record query via checkdnsrr to confirm if the domain is capable of receiving mail. This stage is completely free and extremely fast.
• AWS SES Validation: If the email passes the L1 check, the system calls the AWS SDK for deep validation. This requires users to provide their own AWS keys (BYOK - Bring Your Own Key). AWS SES returns detailed status codes to help the system determine if the email is high-risk.

Smart Caching and Local Blocklists

To prevent bots from repeatedly submitting forms and consuming AWS validation quotas, Email Guard has two built-in key mechanisms:

• Local Cache: Each validation result is stored in the WordPress cache. As long as there is a cache hit, the system directly returns the result without calling the external API, costing $0.
• Local Block: The system creates a dedicated database table, allowing administrators to manually add specific emails for precise blocking, rejecting requests directly at the highest priority stage.

Zero Configuration! Seamless Integration with Major WordPress Forms and E-commerce

A good validation system must integrate easily into existing workflows. Email Guard is developed using the Adapter Pattern and Registry Pattern, completely decoupling the "validation engine" from the "form source."

This means users don't need to modify form code; simply toggle a switch in the backend, and the plugin can intercept and validate submissions from the following sources:

• WordPress System: Default account registration and post comments.
• E-commerce: WooCommerce checkout and registration processes, SureCart checkout process.
• Form Builders: Supports WPForms, Contact Form 7, Forminator, FluentForms, SureForms, Jetpack Forms, and Kadence Form.

The plugin also supports custom frontend "Blocked Messages," allowing you to adjust error prompt text according to your brand style. Additionally, if the AWS API connection times out or an error occurs, the system has a built-in Fail-open mode, allowing the submission by default to ensure the website never loses a real order or potential customer.

SaaS-Grade Data Dashboard

Even in the free version, we have configured a professional-grade data management interface:

• Validation Logs: Uses a dedicated data table to record validation status, source, latency, and estimated cost.
• KPI Cards: The backend provides a 5-column statistical card layout, including total validations, Cache Hit Rate, number of blocked threats, and the most dangerous sources. This helps administrators identify form attack trends at a glance.

Advanced Protection: Email Guard Pro Preview (Beta)

For high-traffic e-commerce platforms and SaaS websites, every external API call is a cost. The core design of Email Guard Pro focuses on "maximizing validation cost savings" and "improving judgment accuracy."

Local Reputation Engine

The Pro version introduces a dedicated permanent whitelist mechanism. The system automatically queries local history. If it is an existing customer who has successfully checked out before, or an email that has recently passed validation, the system will allow it directly. This completely skips external API validation, achieving a $0 validation cost. This is especially important for membership sites with multiple interaction points.

For private communities or closed websites, the Pro version also offers Reputation Only Mode. In this mode, the system disables all external validation and only allows emails existing in the reputation whitelist to log in or perform operations.

Smart Routing and Custom Status Mapping

• Smart Routing: Supports connection to more advanced validation providers. The system can perform validation in the order of Local Reputation > ZeroBounce > AWS SES, combining the strengths of each provider.
• Status Classification Mapping: Provides a visual Drag-and-drop interface. Administrators can precisely set how various granular indicators from AWS SES or ZeroBounce (such as Disposable or Role-based emails) should be classified as Deliverable, Risky, or Undeliverable. All settings will affect the system's judgment logic in real-time.

Security and Compliance Settings

The architectural design of Email Guard prioritizes "defense against malicious consumption" and "privacy data protection" as core metrics. Beyond basic functional implementation, the system ensures external API quotas and database security through multi-layered interception mechanisms and upcoming compliance updates.

Zero-Cost Protection and API Credit Protection

External validation APIs (like AWS SES) rely on pay-per-use billing. To prevent malicious attackers or bots from running scripts to consume validation quotas en masse, Email Guard implements a strict firewall on the local side:

• Request Cache: When malicious programs frequently submit the "same" email for brute-force attacks, the system will only call the AWS API for the initial validation. Subsequent identical email requests will hit the local cache and return the result, effectively preventing an API war of attrition on a single email address.
• Block Manager: If an attacker uses specific disposable email domains for registration, administrators can add that domain or specific email to the blocklist. The system will trigger the interception at the local level first and reject the form submission directly without sending any external requests, achieving a $0 validation cost.
• Key Security (BYOK): The system supports defining EMAIL_GUARD_AWS_KEY and EMAIL_GUARD_AWS_SECRET constants directly in wp-config.php. This avoids writing sensitive data in plain text into the WordPress database, enhancing server-level security.

Privacy Compliance and Advanced Defense Roadmap (Planned)

Addressing EU GDPR regulations and more complex attack patterns, the next phase of Email Guard will introduce the following advanced control features:

• Rate Limiting by IP: For bots that rotate through "different emails" to attack, the system will implement an IP rate-limiting mechanism (Anti-Abuse). Administrators can customize the time interval and maximum request limit in the backend to accurately block sources with abnormally frequent validation attempts.
• GDPR Personal Data Erasure Integration: Fully integrate with WordPress’s built-in privacy data erasure functionality. When an administrator executes a request to delete or export user data, the system will simultaneously clear all validation records for that user in the data table, ensuring the website complies with strict privacy laws.