Block disposable emails in WordPress and WooCommerce with one plugin file

<?php
/**
 * Plugin Name: Block disposable emails
 * Description: Refuses throwaway email addresses at WordPress registration, WooCommerce signup and checkout, and in Contact Form 7. FFraud's free API decides; its MIT list of disposable domains answers when the API cannot.
 * Version: 1.0.0
 * Requires PHP: 7.4
 * License: MIT
 */

defined( 'ABSPATH' ) || exit;

// Relay services such as Apple's Hide My Email forward to an inbox a real person reads. Set to false to refuse them too.
const FFRAUD_ACCEPT_RELAYS = true;
const FFRAUD_MESSAGE       = 'Please use an email address you will keep. Throwaway inboxes are not accepted.';
const FFRAUD_API_URL       = 'https://api.ffraud.com/public/email/check';
const FFRAUD_LIST_URL      = 'https://raw.githubusercontent.com/FFraud-com/disposable-email-domains/main/disposable-email-domains.txt';

/** The list lives in the uploads folder, which WordPress can write. */
function ffraud_list_file() {
	return wp_upload_dir( null, false )['basedir'] . '/disposable-email-domains.txt';
}

/** Download the list, clean it and swap it in. A failed or short download keeps the current file. */
function ffraud_refresh_list() {
	$response = wp_remote_get( FFRAUD_LIST_URL, array( 'timeout' => 30 ) );
	if ( 200 !== wp_remote_retrieve_response_code( $response ) ) {
		return 0;
	}
	$domains = array();
	foreach ( explode( "\n", wp_remote_retrieve_body( $response ) ) as $line ) {
		$domain = strtolower( rtrim( trim( $line ), '.' ) );
		if ( '' !== $domain && '#' !== $domain[0] ) {
			$domains[ $domain ] = true;
		}
	}
	$file = ffraud_list_file();
	if ( count( $domains ) < 100000 || ! file_put_contents( $file . '.tmp', implode( "\n", array_keys( $domains ) ) ) ) {
		return 0;
	}
	rename( $file . '.tmp', $file );
	return count( $domains );
}

/** True when the list holds the domain or a parent of it: inbox.mailinator.com matches mailinator.com. */
function ffraud_listed( $domain ) {
	static $domains = null;
	if ( null === $domains ) {
		$file    = ffraud_list_file();
		$domains = is_file( $file ) ? array_flip( file( $file, FILE_IGNORE_NEW_LINES ) ) : array();
	}
	$labels = explode( '.', $domain );
	for ( $i = 0; $i < count( $labels ) - 1; $i++ ) {
		if ( isset( $domains[ implode( '.', array_slice( $labels, $i ) ) ] ) ) {
			return true;
		}
	}
	return false;
}

/** 'temp', 'alias' or 'normal'. The API answers once a day per domain; without an answer, the list decides. */
function ffraud_domain_type( $domain ) {
	static $seen = array();
	if ( isset( $seen[ $domain ] ) ) {
		return $seen[ $domain ];
	}
	$key  = 'ffraud_type_' . md5( $domain );
	$type = get_transient( $key );
	if ( false === $type && ! get_transient( 'ffraud_api_down' ) ) {
		// The type depends on the domain alone, so the API gets user@ and the domain, never a real address.
		$response = wp_remote_post(
			FFRAUD_API_URL,
			array(
				'timeout' => 2,
				'headers' => array( 'Content-Type' => 'application/json' ),
				'body'    => wp_json_encode( array( 'email' => 'user@' . $domain ) ),
			)
		);
		$result = json_decode( wp_remote_retrieve_body( $response ), true );
		if ( 200 === wp_remote_retrieve_response_code( $response ) && isset( $result['email_type'] ) ) {
			$type = $result['email_type'];
			set_transient( $key, $type, DAY_IN_SECONDS );
		} else {
			// Skip the API for a minute, so an outage costs one wait a minute instead of one per signup.
			set_transient( 'ffraud_api_down', 1, MINUTE_IN_SECONDS );
		}
	}
	if ( false === $type ) {
		// The list cannot tell a relay from a throwaway inbox, so it refuses both.
		$type = ffraud_listed( $domain ) ? 'temp' : 'normal';
	}
	$seen[ $domain ] = $type;
	return $type;
}

function ffraud_refuses( $email ) {
	if ( ! is_email( $email ) ) {
		return false; // WordPress and WooCommerce report a malformed address themselves.
	}
	$type = ffraud_domain_type( strtolower( substr( strrchr( $email, '@' ), 1 ) ) );
	return 'temp' === $type || ( 'alias' === $type && ! FFRAUD_ACCEPT_RELAYS );
}

// WP-Cron downloads the list once a day.
add_action( 'ffraud_refresh_list', 'ffraud_refresh_list' );
add_action(
	'init',
	function () {
		if ( ! wp_next_scheduled( 'ffraud_refresh_list' ) ) {
			wp_schedule_event( time(), 'daily', 'ffraud_refresh_list' );
		}
	}
);
register_deactivation_hook( __FILE__, fn () => wp_clear_scheduled_hook( 'ffraud_refresh_list' ) );

// WordPress registration: wp-login.php?action=register.
add_filter(
	'registration_errors',
	function ( $errors, $login, $email ) {
		if ( ffraud_refuses( $email ) ) {
			$errors->add( 'disposable_email', '<strong>Error:</strong> ' . FFRAUD_MESSAGE );
		}
		return $errors;
	},
	10,
	3
);

// WooCommerce accounts: the My Account form, and accounts created at either checkout.
add_filter(
	'woocommerce_registration_errors',
	function ( $errors, $username, $email ) {
		if ( ffraud_refuses( $email ) ) {
			$errors->add( 'disposable_email', FFRAUD_MESSAGE );
		}
		return $errors;
	},
	10,
	3
);

// WooCommerce classic checkout, guests included.
add_action(
	'woocommerce_after_checkout_validation',
	function ( $data, $errors ) {
		if ( ffraud_refuses( $data['billing_email'] ?? '' ) ) {
			$errors->add( 'billing_email_disposable', FFRAUD_MESSAGE, array( 'id' => 'billing_email' ) );
		}
	},
	10,
	2
);

// WooCommerce block checkout, guests included. It runs when the shopper presses Place order.
add_action(
	'woocommerce_store_api_checkout_update_customer_from_request',
	function ( $customer, $request ) {
		if ( ffraud_refuses( $request['billing_address']['email'] ?? '' ) ) {
			throw new \Automattic\WooCommerce\StoreApi\Exceptions\RouteException( 'disposable_email', FFRAUD_MESSAGE, 400 );
		}
	},
	10,
	2
);

// Contact Form 7: every email field, required or not.
foreach ( array( 'wpcf7_validate_email', 'wpcf7_validate_email*' ) as $ffraud_filter ) {
	add_filter(
		$ffraud_filter,
		function ( $result, $tag ) {
			$submission = WPCF7_Submission::get_instance();
			if ( $submission && ffraud_refuses( $submission->get_posted_string( $tag->name ) ) ) {
				$result->invalidate( $tag, FFRAUD_MESSAGE );
			}
			return $result;
		},
		20,
		2
	);
}

PHP 8.3.25, opcache not loaded, 2026-10-25T23:59:55Z
== install: first request, then the WP-Cron run
scheduled: {"ffraud_refresh_list":{"timestamp":1792972795,"schedule":"daily"}}
after a second init: 1 event
refresh: 224174 domains, 3544411 bytes, 0.56 s
  (peak memory 37.7 MB)
== list guard: the download comes back short
short download: refresh returned 0, list file unchanged: yes
  (peak memory 0.7 MB)
== request 1, empty cache
  test@mailinator.com              temp   refused     780 ms  API calls: 1
  user@inbox.mailinator.com        temp   refused     376 ms  API calls: 1
  test@privaterelay.appleid.com    alias  accepted    681 ms  API calls: 1
  team@ffraud.com                  normal accepted    417 ms  API calls: 1
  team@ffraud.com                  normal accepted  0.015 ms  API calls: 0
  what the API received: {"email":"user@mailinator.com"} {"email":"user@inbox.mailinator.com"} {"email":"user@privaterelay.appleid.com"} {"email":"user@ffraud.com"}
  (peak memory 0.5 MB)
== request 2, the answers cached for a day
  test@mailinator.com              temp   refused   0.920 ms  API calls: 0
  test@privaterelay.appleid.com    alias  accepted  0.122 ms  API calls: 0
  team@ffraud.com                  normal accepted  0.120 ms  API calls: 0
  (peak memory 0.5 MB)
== the hooks
registration_errors, test@mailinator.com: ["<strong>Error:<\/strong> Please use an email address you will keep. Throwaway inboxes are not accepted."]
registration_errors, team@ffraud.com: []
woocommerce_registration_errors, test@mailinator.com: ["Please use an email address you will keep. Throwaway inboxes are not accepted."]
woocommerce_after_checkout_validation, test@mailinator.com: [["billing_email_disposable"],{"id":"billing_email"}]
woocommerce_after_checkout_validation, test@privaterelay.appleid.com: []
woocommerce_store_api_checkout_update_customer_from_request, test@mailinator.com: RouteException disposable_email, HTTP 400, "Please use an email address you will keep. Throwaway inboxes are not accepted."
woocommerce_store_api_checkout_update_customer_from_request, team@ffraud.com: passes
wpcf7_validate_email*, test@mailinator.com: {"your-email":{"reason":"Please use an email address you will keep. Throwaway inboxes are not accepted."}}
wpcf7_validate_email, team@ffraud.com: []
  (peak memory 0.5 MB)
== relays refused
1
with FFRAUD_ACCEPT_RELAYS false, woocommerce_after_checkout_validation, test@privaterelay.appleid.com: ["billing_email_disposable"]
  (peak memory 0.5 MB)
== API outage, empty cache: the request never gets an answer
  test@mailinator.com              temp   refused    2038 ms  API calls: 1
  test@privaterelay.appleid.com    temp   refused   0.892 ms  API calls: 0
  team@ffraud.com                  normal accepted  0.217 ms  API calls: 0
  what the API received: {"email":"user@mailinator.com"}
  (peak memory 25.7 MB)
== API outage, next request within the minute
  team@ffraud.com                  normal accepted     22 ms  API calls: 0
  (peak memory 25.7 MB)