Formidable includes several built-in options for spam protection including a captcha and captcha alternatives. Each of the options below will stop spam by preventing the entry from being submitted if it appears to be spam.
Honeypot
Honeypot is a type of invisible spam protection. Normal users won't be affected by this spam protection. Suspicious submissions will be marked as spam and Formidable will prevent the entry from being submitted.
This feature is enabled by default on all forms and can be configured by going into your form Settings. Under the section On Submit, you should see the Use Honeypot to check entries for spam dropdown.
You can set Honeypot to check entries for spam: Off, Basic, and Strict.
- Off - Remove the Honeypot field and validation check.
- Basic - Use a text field for the hidden Honeypot field. Some bots will skip text fields.
- Strict - Use a hidden email field for Honeypot. Bots won't skip the field, but some browsers (like iPhone 5 Safari) may autofill it and cause false positives.
Empty field above form
If the Formidable styling is missing from the page, you may see the empty form field at the top of each form. If you see this extra field with the label 'If you are human leave this field blank', follow these steps:
- Clear any caching from your site (i.e. from a plugin, or from your host) and then refresh the page.
- If the issue persists, go to the Form Styler page and click the Update button.
JavaScript Token
In addition to HoneyPot, the anti-spam JavaScript token is also built-in. Use this for a more effective spam protection using JavaScript, including protecting file uploads from spam. This spam option generates a token that is specific to your site, and is good for at least 24 hours.
To turn on the Javascript token, check the box to Check entries for spam using JavaScript.
With this option enabled, the token may be cached longer than expected and end up with false positives. If you run into this, you may increase the expiration time on the token with custom code.
Token Hooks
Akismet
Akismet saves you time by automatically detecting and preventing spam. It runs hundreds of tests on each entry and determines whether or not to allow form submission. As a result, you don't have to waste your time sorting through and deleting spam entries. Follow the directions below to set it up.
- Go to your WordPress plugins. Install and activate Akismet.
- Sign up for an Akismet API key. Akismet may require a paid subscription depending on the type of site you have.
- Go to your Akismet Settings and save your API key.
- For each form you would like protected, go to edit the form and click on the 'Settings' tab. Under the section 'On Submit' you should see 'Use Akismet to check entries for spam for' at the bottom of the page.
You can set Akismet to check entries for no one, everyone, or visitors who are not logged in.
Akismet Troubleshooting
If you are seeing an error message like Your entry appears to be spam, you might have an email address or URL that is getting flagged. Please contact Akismet support. Choose the I think Akismet is catching my comments by mistake option, and they'll investigate the issue.
Captcha
CAPTCHAs are used by many websites to prevent abuse from 'bots', or automated programs usually written to generate spam. Bots cannot easily submit forms protected by CAPTCHA.
reCAPTCHA
reCAPTCHA is a script that judges whether a user is a human or a robot. You have probably seen some variation of reCAPTCHA.
Learn more about setting up reCAPTCHA in your forms.
hCaptcha
hCaptcha is a program that is designed to distinguish human users from spam via a challenge-response test. It is a popular alternative to Google's reCAPTCHA.
Learn more about setting up hCaptcha in your forms.
Comment Blacklist
In addition to Honeypot spam protection, every form submission goes through the comment blacklist checks. It allows adding custom terms to the comment blacklist and integrating several spam protection plugins without extra effort.
To add words, IPs, or URLs to your blacklist, go to the WordPress Settings → Discussion page. Add values in the Disallowed Comment Keys box, following the WordPress instructions: One word or IP address per line. It will match inside words, so "press" will match "WordPress."
When a form submission is determined to be spam, an error message appears:
Your entry appears to be blocked spam!
or
Your entry appears to be blacklist spam!
To disable blacklist spam checks, use the frm_check_blacklist hook.
Block IP addresses
Use the Disallowed Comment Keys textarea in the Discussion Settings to block IP addresses. An IP address listed in this option will be blocked from submitting a form entry and uploading files.
To add IP addresses with a snippet, you can hook it into the disallowed_keys option instead of updating it.
add_filter( 'option_disallowed_keys', function( $keys ) {
return $keys .= ' 1337.HAXORS';
} );
If you are getting multiple file uploads from a specific IP, you can block and prevent the IP from uploading any files by adding the IP address to your disallowed comment keys.
CleanTalk
Anti-Spam by CleanTalk is a cloud-based service with a firewall that helps prevent spam bots before they get access to your website. It analyzes comments on your site and determines if it's from a visitor or a spam bot. If the comment is found to be from a spam bot, they will be blocked.
Troubleshooting
Spam submissions continue
If you are still receiving spam submissions with reCaptcha installed, you may be seeing manual spam rather than automated. We have seen this happen occasionally on various sites. Manual spam attacks are much more difficult to prevent with automated spam protection. There are a few options available by combining multiple spam prevention options.
- Add Akismet. Since Akismet is frequently updated, there may be certain IPs, URLs, or phrases that other option may not catch.
- Check the entries for common phrases, URLs, or IPs. If you find something repeated, add it to the comment blacklist. This works well for targeted manual spam.
Your entry appears to be spam
If you see this error message and have Akismet installed, follow these troubleshooting steps. If you don't have Akismet installed, the Honeypot spam protection system is one possible source of this error message. We have seen this occasionally happen when autocomplete is enabled in the browser. It can sometimes add value to the hidden Honeypot field, marking the entry as spam. You can switch off Honeypot in your form settings to remove the validation check.
Related developer hooks
- To turn off Honeypot on one or all forms, use the frm_run_honeypot hook.
- To manually flag the submission of a form as honeypot spam, use the frm_process_honeypot hook.
- To remove the spam bot error when there is no IP, use the frm_validate_entry hook.
How to Use hCaptcha for WordPress Forms [Block Spam Easy!]
The Best WordPress Spam Registration Prevention Methods
8 Ways to Block Contact Form Spam in WordPress
How to Add a Captcha to WordPress Contact Forms
WordPress Anti Spam Captchas Have Gone Invisible
Defeat evil spambots with Honeypot spam protection!