Add-on for Gravity Forms to create a Blacklisting of specific emails or domains for the Email input field to throw a validation error or mark as spam.
As of April 2026, Gravity Forms Email Blacklist is a WordPress blacklist plugin with 10K+ active installations and a 4.3/5 rating from 15 reviews. It has been downloaded 101K+ times in total. Requires WordPress 3.8+ and PHP false+. Available on WordPress.org since 2014. Last updated 1 year ago — may have compatibility concerns. Downloads are up 17% this week. Top alternative: Maspik – Ultimate Spam Protection.
The Email Blacklist Add-on for Gravity Forms was built to help block submissions from users with generic or competitors email addresses. Prevent the user from processing the form and stop non-qualified leads from being collected.
This plugin allows site admins to create a list of domains that if used in an email field on a Gravity Form it will cause a validation error and block the submission. A default email blacklist and validation message can be created to use across all email fields. These default settings can be overridden on a per email field basis.
Global settings can be added on ‘Forms’ > ‘Settings’ > ‘Email Blacklist’. To add settings to an individual email field, select the field and navigate to the ‘Advanced Settings’ tab.
T…
GF 2.8.18 , WP 6.5.5, PHP 8.2.23. WPE hosting.
It even works wih 3.5 thousand rules in a single string for blacklist of disposable email domains.
Uncaught TypeError: explode(): Argument #2 ($string) must be of type string, array given in (original path removed for privacy reason)/plugins/gravity-forms-email-blacklist/includes/class-gfemailblacklist.php:259
I guess it’s because of PHP 8. This shouldn’t happen at all, please fix it.
This Addon for Gravity forms does exactly as advertised.
On top of that, when I had an issue recently the support response via these forums was outstanding. Probably the best I’ve ever received via this site. Well done guys!
Still evaluating, but one key deficit is that wildcard support doesn’t seem to extend to domains, only to TLDs. Why that matters: We routinely get hammered by exploit probes using example.* domains, which blow past reCAPTCHA without slowing down. (Presumably they use example.* on the assumption it will be allowed to pass through filters.) It’s a massive inconvenience for the people receiving our forms. (Yes, I realize this would also block submissions from vuln scanning suites.)
The ability to use wildcards is a super feature. No more spam from the .ru domain! Thanks so much for this.
| WordPress | 3.8+ requiredTested up to 6.7.5 |
| PHP | false+ required |
Plugin data sourced from WordPress.org. Analysis and metrics by PluginSift.