Free spam protection for Shopware 6: bot protection for registration and newsletter without captchas

Spam accounts in the customer list, bot sign-ups in the newsletter, contact requests with Cyrillic names and links: almost every Shopware 6 shop knows the problem. We built our own plugin that protects registration, newsletter and contact form invisibly. No captcha, no third-party services, and free of charge.

Why bots target your registration and newsletter

Bots create customer accounts in Shopware shops in bulk or sign up other people’s e-mail addresses for the newsletter. Often this is not aimed at your shop at all. The forms are abused to send advertising or links to third-party inboxes via the confirmation e-mails.

You still pay the price:

• Your customer list fills up with accounts that never order.
• Your shop sends e-mails to addresses that never signed up. This damages your mail server’s reputation and can push genuine order confirmations into spam folders.
• Newsletter lists and reports become useless.

A captcha only helps to a degree. It annoys real customers, costs conversions and, with the well-known providers, loads scripts from external servers that you then have to cover in your privacy policy and cookie banner.

Invisible Spam Protection (Easy Mode): bot protection for Shopware 6

Our plugin is called “Invisible Spam Protection (Easy Mode)” and runs on Shopware 6.7.9 and later. It hooks directly into the Shopware routes for registration, newsletter sign-up and contact form, before anything is saved or sent. This applies to the Storefront and the Store API, to guest orders and to contact forms in shopping experiences.

Customers don’t see any of it. There is no puzzle, no “I’m not a robot” checkbox and no delay.

Checks included in the plugin

• Honeypot: a field that is invisible to people and only filled in by bots.
• Browser check: a small script in the form proves that a real browser is involved and that the form was not submitted in under 2 seconds. Express checkouts such as PayPal are not affected.
• Script filter: names, company or address in foreign writing systems, Cyrillic by default. You choose which scripts and fields are checked.
• Name check: links in the name, promotional text with exclamation marks, or identical first and last names of suspicious length.
• Address check: street and house number with the same content, a typical pattern of bot accounts.
• E-mail blocklists: blocked domains and endings, with allowlists that take precedence.
• IP limits: too many attempts or too many successful sign-ups from the same address in a short time.

You decide what happens to spam

For every rule you choose one of three reactions:

• Silent drop: the bot receives a perfectly normal success message. In the shop, however, no account is created, no newsletter sign-up is saved and no e-mail is sent. The bot doesn’t notice it has been caught and doesn’t keep trying variations.
• Block: the form shows an error message.
• Log only: nothing is prevented, but you can see what the plugin would have caught.

To get started there is a test mode in which all rules only log. This lets you check calmly whether real customers would be affected before you switch the rules on. And if a technical error ever occurs in the plugin, it lets the request through. A real customer is never locked out because of a fault in the spam protection.

Statistics right in the Shopware dashboard

So you can see what the protection achieves, the plugin adds its own card to the dashboard in the Shopware Administration: prevented submissions in total, today, in the last 7 and 30 days, broken down by rule and by form, plus the trend over the last 30 days.

The screenshot comes from a client shop where the plugin has been running since 30 October 2026, with the German admin interface. In the first week it caught 542 spam submissions there, 527 of them at registration. Before switching it on, we ran the rules against the shop’s existing customers: all 6,681 known spam accounts were detected and no real customer would have been affected. This is our experience from this shop, not a promise for every other one. That is exactly what the test mode is for.

The card is only visible to admin users with read access to the spam log. Texts are available in German and English.

Privacy: no third-party services, no plain IPs

The plugin loads no scripts from external servers and passes no data to third parties. Its log stores the form, rule, reaction and field name plus a truncated, salted identifier of the IP address. Plain IPs and form contents are never stored. Entries are deleted automatically after 7 days, configurable up to a maximum of 180 days. The dashboard figures are plain daily counters without personal data.

If you uninstall the plugin without keeping its data, all plugin tables are removed.

How to get the plugin

The plugin is free. It is currently in review at Shopware and is due to appear in the Shopware Store in 2026. The exact date depends on approval by Shopware. You don’t have to wait until then: send us a message via our contact form and tell us which Shopware version you use, and we will send it to you. Installation works like any other plugin via “Extensions > My extensions”.

Our recommendation for getting started:

1. Install the plugin and enable test mode.
2. Keep an eye on the dashboard card and the log for a few days.
3. Switch on the rules that only hit bots, ideally with silent drop.

Need a tailored solution or a completely different extension for your shop? You will find everything in our Shopware plugin development section.