Formidable includes several built-in options for spam protection including a captcha and captcha alternatives. Each of the options below will stop spam by preventing the entry from being submitted if it appears to be spam.
Honeypot
Honeypot is a type of invisible spam protection. Normal users won't be affected by this spam protection. Suspicious submissions will be marked as spam and Formidable will prevent the entry from being submitted.
This feature is enabled by default on all forms and can be configured by going into your form Settings. Under the section On Submit, you should see the Use Honeypot to check entries for spam dropdown.
You can set Honeypot to check entries for spam: Off, Basic, and Strict.
- Off - Remove the Honeypot field and validation check.
- Basic - Use a text field for the hidden Honeypot field. Some bots will skip text fields.
- Strict - Use a hidden email field for Honeypot. Bots won't skip the field, but some browsers (like iPhone 5 Safari) may autofill it and cause false positives.
Empty field above form
If the Formidable styling is missing from the page, you may see the empty form field at the top of each form. If you see this extra field with the label 'If you are human leave this field blank', follow these steps:
- Clear any caching from your site (i.e. from a plugin, or from your host) and then refresh the page.
- If the issue persists, go to the Form Styler page and click the Update button.
Related developer hooks
- To turn off Honeypot on one or all forms, use the frm_run_honeypot hook.
- To manually flag the submission of a form as honeypot spam, use the frm_process_honeypot hook.
JavaScript Token
In addition to HoneyPot, the anti-spam JavaScript token is also built-in. Use this for a more effective spam protection using JavaScript, including protecting file uploads from spam.
This spam option generates a token that is specific to your site, and is good for at least 24 hours.
To turn on the Javascript token, check the box to Check this form for spam using JavaScript.
Note: With this option enabled, the token may be cached longer than expected and end up with false positives. If you run into this, you may increase the expiration time on the token with custom code.
Token Hooks
Akismet
Akismet saves you time by automatically detecting and preventing spam. It runs hundreds of tests on each entry and determines whether or not to allow form submission. As a result, you don't have to waste your time sorting through and deleting spam entries. Follow the directions below to set it up.
- Go to your WordPress plugins. Install and activate Akismet.
- Sign up for an Akismet API key. Akismet may require a paid subscription depending on the type of site you have.
- Go to your Akismet Settings and save your API key.
- For each form you would like protected, go to edit the form and click on the 'Settings' tab. Under the section 'On Submit' you should see 'Use Akismet to check entries for spam for' at the bottom of the page.
You can set Akismet to check entries for no one, everyone, or visitors who are not logged in.
Akismet Troubleshooting
If you are seeing an error message like Your entry appears to be spam, you might have an email address or URL that is getting flagged. Please contact Akismet support. Choose the I think Akismet is catching my comments by mistake option, and they'll investigate the issue.
reCaptcha
reCAPTCHA is a script that judges whether a user is a human or a robot. You have probably seen some variation of reCAPTCHA.
CAPTCHAs are used by many websites to prevent abuse from 'bots', or automated programs usually written to generate spam. Bots cannot easily submit forms protected by reCAPTCHA. Learn more about setting up reCAPTCHA in your forms.
Comment Blacklist
In addition to Honeypot spam protection, every form submission goes through the comment blacklist checks. This not only allows you to add custom terms to the comment blacklist, but also allows several spam protection plugins to integrate without any extra effort.
To add words, IPs, or urls to your blacklist, go to the WordPress Settings → Discussion page. Add values in the Comment Moderation box, following the WordPress instructions: One word or IP address per line. It will match inside words, so "press" will match "WordPress".
When a form submission is determined to be spam, an error message appears:
Your entry appears to be blocked spam!
or
Your entry appears to be blacklist spam!
To disable blacklist spam checks, use the frm_check_blacklist hook.
CleanTalk
Anti-Spam by CleanTalk is a cloud-based service with a firewall that helps prevent spam bots before they get access to your website. It analyzes comments on your site and determines if it's from a visitor or a spam bot. If the comment is found to be from a spam bot, they will be blocked.
Troubleshooting
Spam submissions continue
If you are still receiving spam submissions with reCaptcha installed, you may be seeing manual spam rather than automated. We have seen this happen occasionally on various sites. Manual spam attacks are much more difficult to prevent with automated spam protection. There are a few options available by combining multiple spam prevention options.
- Add Akismet. Since Akismet is frequently updated, there may be certain IPs, URLs, or phrases that other option may not catch.
- Check the entries for common phrases, URLs, or IPs. If you find something repeated, add it to the comment blacklist. This works well for targeted manual spam.