# Verify emails on WordPress and WooCommerce forms with Spaw

The Spaw WordPress plugin checks comment, registration and WooCommerce checkout emails as visitors type them, and can reject addresses that cannot receive mail.

Updated: 2026-09-03

The Spaw Email Verification plugin connects a WordPress site to Spaw in two layers. In the browser it loads the Spaw form helper on the comment form, the registration form and the WooCommerce classic checkout, so a visitor who mistypes an address sees a "Did you mean …?" correction and a notice when the address cannot receive mail. On the server, with a secret key, it verifies the address again when the form is submitted and can refuse addresses Spaw reports as undeliverable. Nothing is sent to Spaw until you save a key.

The plugin has been submitted to the WordPress.org directory. Until the listing is live, install it from the plugin zip: ask support@spaw.co for the current build.

## Install and configure

1. Create a free account at https://spaw.co and open the API keys page.
2. Create a publishable key locked to your site's domain. A publishable key is safe in page source: it can only run single email lookups, only from the domains you list. Add a Cloudflare Turnstile site key and secret to the key if your forms are open to the public, so bots cannot spend your credits.
3. In WordPress, go to Plugins, choose Add New, then Upload Plugin, and upload the zip. Activate it.
4. Open Settings, then Spaw. Paste the publishable key and tick the forms to verify: comments, registration, and WooCommerce checkout if WooCommerce is active. The "Extra email inputs" field takes a CSS selector for any other inputs, for example a newsletter form or the WooCommerce block checkout's email field.
5. To also reject undeliverable addresses on the server, paste a secret key and tick "Block undeliverable addresses". Prefer the publishable key alone unless you need blocking; the secret key is stored in the WordPress options table like any other plugin setting.

## What happens on each form

The browser helper runs when a visitor leaves the email field. It never blocks a submission: it only renders a hint under the field, and every result is also emitted as a `spaw:result` event on the input in case your theme wants to do more.

The server check runs on `preprocess_comment` for comments, `registration_errors` for registrations, and `woocommerce_checkout_process` for the classic checkout. It posts the address to `POST /api/v1/email` with a five-second timeout, caches the verdict for seven days in a transient keyed by the hashed address, and rejects only verdicts on the blocked list. By default that list is `undeliverable` alone. If the API cannot be reached, answers an error, or is slow, the submission goes through as normal.

## Adjust the behaviour with filters

Three filters cover the usual customisations. This example also refuses risky addresses, which covers disposable domains, role inboxes and catch-all domains, and rewrites the rejection message:

```php
add_filter('spaw_blocked_verdicts', function (array $verdicts, string $email): array {
    return ['undeliverable', 'risky'];
}, 10, 2);

add_filter('spaw_blocked_message', function (string $message): string {
    return 'Please use a work email address that can receive mail.';
});

add_filter('spaw_email_selectors', function (array $selectors): array {
    $selectors[] = '.newsletter-form input[type="email"]';

    return $selectors;
});
```

Logged-in users are never checked on the comment form, because their address was verified when their account was created.

## What to do with the verdict

Blocking `undeliverable` is safe: the address has invalid syntax, a domain with no working mail servers, or a mailbox the receiving server rejected. Blocking `risky` is a policy choice. It stops burner signups and shared inboxes, but it also refuses catch-all domains, which many companies use for perfectly good addresses. Read the `reason` values before widening the list.

## Cost

Each answered lookup costs one credit from your Spaw balance. Undeliverable answers cost nothing, a repeat of the same address within seven days costs nothing, and the plugin's own seven-day cache means a returning visitor is not looked up twice. Every account gets 10 free lookups a month; packs start at $9 for 1,000 credits.

Reference: https://spaw.co/integrations/wordpress