ThreatPoint Email Validator Plugin Documentation

1. Executive & Technical Overview

Purpose of ThreatPoint Email Validator

ThreatPoint Email Validator protects WordPress contact forms, user registrations, and comment sections from spam bots, burner accounts, and undeliverable leads by verifying email addresses in real time against the ThreatPoint Email Verification REST API (/api/v1/resources/email).

Unlike basic regular-expression syntax checks, ThreatPoint Email Validator inspects live domain DNS/MX records, mailbox deliverability, free webmail status, disposable (one-time use) inbox providers, role/group distribution addresses (such as sales@ or support@), and custom domain blacklists before a form submission is accepted.

Primary API Endpoint: https://verifyb.threatpoint.co.uk/api/v1/resources/email

Real-Time Deliverability & MX Verification

Verifies that every submitted email address has valid syntax, active domain DNS/MX records, and a deliverable mailbox (deliverability.valid_email).

Disposable / Burner Inbox Prevention

Blocks one-time-use and temporary email providers (such as Mailinator, GuerrillaMail, 10MinuteMail, and hundreds of burner domains) frequently used by spam bots and fraudsters.

Free Webmail & Role/Group Address Governance

Allows B2B sites to optionally reject free webmail domains (Gmail, Yahoo, Outlook) or shared role/group addresses (info@, admin@, sales@) to ensure high-quality business leads.

Custom Domain Blacklist & Custom Error Messaging

Enables administrators to immediately block specific domains via a comma-separated blacklist and customize the exact validation error message shown to visitors.

Seamless Contact Form 7, Registration & Comment Protection

Hooks directly into Contact Form 7 (wpcf7_validate_email and wpcf7_validate_email*), WordPress User Registration (registration_errors), and WordPress Comments (preprocess_comment).

2. Installation & Activation Guide

Installing via the WordPress Plugin Store

Follow the steps below to install ThreatPoint Email Validator directly from the WordPress Plugin Store (or via the threatpoint-email-validator.zip distribution archive) and connect your ThreatPoint API key.

1

Step 1: Open the WordPress Plugin Store

Log in to your WordPress Administrator Dashboard (wp-admin). In the left-hand navigation sidebar, go to Plugins -> Add New Plugin.

2

Step 2: Search for ThreatPoint Email Validator

In the Search Plugins box in the top-right corner, type "ThreatPoint Email Validator". Find the official plugin by ThreatPoint and click Install Now. (Alternatively, click Upload Plugin, select threatpoint-email-validator.zip, and click Install Now.)

3

Step 3: Activate the Plugin

Click the Activate button once installation finishes. A new top-level menu item titled ThreatPoint Email (with the ThreatPoint shield icon) will appear in your WordPress admin sidebar.

4

Step 4: Configure Your ThreatPoint API Key

Navigate to ThreatPoint Email -> 1. API Key, Paywall & Form Integration. Enter your ThreatPoint X-Api-Key (available from api@threatpoint.co.uk) and click Save API & Form Integration Settings.

5

Step 5: Test API Connection & Set Validation Policies

Click "Test API Key & Sync Quota" in the top-right header banner to confirm API connectivity. Then open Tab 2 (Email Validation Policies) to choose how free, disposable, and role email addresses should be handled.

API-Key Requirement & 200-Query Paywall Overview

API-Key Requirement: A valid ThreatPoint API Key (X-Api-Key) is required for real-time email verification. Request your key from the ThreatPoint API team at api@threatpoint.co.uk.

200 Included Queries (Pre-Paywall Tier): Every installation includes 200 live email verification lookups before the paywall activates, allowing immediate testing across your contact and registration forms.

Commercial Paid Tier Upgrade: Once 200 queries are reached, the plugin locks further live API queries behind the paywall and fails open so form submissions are not lost. Contact api@threatpoint.co.uk to upgrade your API key, then enable "Commercial Paid Tier Unlocked" in Tab 1.

3. Administration & Policy Reference

Configuring ThreatPoint Email Validator

Access the configuration dashboard in WordPress by clicking ThreatPoint Email in the left-hand admin navigation sidebar. All settings are organized into logical tabs below the live API Key & 200-Query Paywall status card.

Tab 1: API Key, Paywall & Form Integration

Configures your ThreatPoint API Key, commercial paywall status, Contact Form 7 field mapping, and WordPress form hooks.

Setting / Control	Type / Options	Purpose & Recommended Configuration
ThreatPoint API Key (X-Api-Key)	Password / String	Your secret ThreatPoint API key used for /api/v1/resources/email and /emailstats requests.
Commercial Paid Tier Unlocked	Checkbox	Removes the 200-query paywall cap after your API key is upgraded by the ThreatPoint API team.
Contact Form 7 Email Field Name	String (Default: your-email)	The CF7 form tag name to validate. Supports comma-separated field names (e.g., your-email, work-email) or * to validate all CF7 email fields.
Validate WordPress User Registrations	Checkbox (Default: Enabled)	Verifies email addresses submitted on the standard WordPress registration form before creating an account.
Validate WordPress Comment Submissions	Checkbox (Default: Enabled)	Verifies commenter email addresses before saving comments to stop automated comment spam.

Tab 2: Email Validation Policies

Defines which types of email addresses are permitted or rejected across your protected forms.

Setting / Control	Type / Options	Purpose & Recommended Configuration
Deliverability & MX Verification	Always Enforced	Automatically rejects malformed, non-existent, or undeliverable email addresses (deliverability.valid_email !== true).
Allow Free Email Providers?	Yes \| No (Default: Yes)	When set to No, rejects free consumer webmail providers (e.g., gmail.com, yahoo.com, hotmail.com)—ideal for B2B lead forms.
Allow Disposable (One-Time) Email Addresses?	Yes \| No (Default: No)	When set to No (Recommended), blocks temporary/throwaway email services (reputation.is_disposable === true).
Allow Role / Group Email Addresses?	Yes \| No (Default: Yes)	When set to No, blocks shared role accounts such as sales@, info@, admin@, or support@ (reputation.is_role === true).
Blacklisted Email Domains (CSV)	Comma-separated domains	Immediately rejects email addresses belonging to any listed domain (e.g., spamdomain.com, competitor.org) without consuming an API query.
Form Validation Error Message	Text String	Customizes the error message displayed to users when their email address is rejected.

Tab 3: Live Email Validation Stats & Tester

Displays live email verification metrics and the top 10 email validations recorded for your site.

Setting / Control	Type / Options	Purpose & Recommended Configuration
KPI Summary Counters	Dashboard Cards	Displays Total Email API Queries, Rejected Email Submissions on this WordPress site, and Queries Remaining.
Top 10 Email Validations Table	Live Feed (/emailstats)	Displays the Date, Validation Detail, Email Address, and Total Lookups returned by the ThreatPoint Email Verification service.