Formidable Forms

Formidable Forms

  • Features
  • Pricing
  • Resources
    • Docs & Support
    • Blog
    • Community
  • Solutions
    • Web Applications
    • Calculators
    • Surveys
    • Directories
    • Payments
    • Contact forms
  • Login
  • Get Formidable Forms

Add Spam Protection

Last Updated: September 17, 2021

Knowledge Base → Forms → Form Building → Add Spam Protection

Formidable includes several built-in options for spam protection including a captcha and captcha alternatives. Each of the options below will stop spam by preventing the entry from being submitted if it appears to be spam.

Formidable Forms is the best WordPress Form Builder plugin. Get it for free!

Honeypot

Honeypot is a type of invisible spam protection. Normal users won't be affected by this spam protection. Suspicious submissions will be marked as spam and Formidable will prevent the entry from being submitted.

This feature is enabled by default on all forms and can be configured by going into your form Settings. Under the section On Submit, you should see the Use Honeypot to check entries for spam dropdown.

Add Spam Protection Honeypot options

You can set Honeypot to check entries for spam: Off, Basic, and Strict.

  • Off - Remove the Honeypot field and validation check.
  • Basic - Use a text field for the hidden Honeypot field. Some bots will skip text fields.
  • Strict - Use a hidden email field for Honeypot. Bots won't skip the field, but some browsers (like iPhone 5 Safari) may autofill it and cause false positives.

Empty field above form

If the Formidable styling is missing from the page, you may see the empty form field at the top of each form. If you see this extra field with the label 'If you are human leave this field blank', follow these steps:

  • Clear any caching from your site (i.e. from a plugin, or from your host) and then refresh the page.
  • If the issue persists, go to the Form Styler page and click the Update button.

JavaScript Token

In addition to HoneyPot, the anti-spam JavaScript token is also built-in. Use this for a more effective spam protection using JavaScript, including protecting file uploads from spam. This spam option generates a token that is specific to your site, and is good for at least 24 hours.

To turn on the Javascript token, check the box to Check entries for spam using JavaScript.
Add Spam Protection Check Spam Entries Javascript

With this option enabled, the token may be cached longer than expected and end up with false positives. If you run into this, you may increase the expiration time on the token with custom code.

Token Hooks

  • Extend the valid token times before today.
  • Extend the valid token times after today.

Akismet

Akismet saves you time by automatically detecting and preventing spam. It runs hundreds of tests on each entry and determines whether or not to allow form submission. As a result, you don't have to waste your time sorting through and deleting spam entries. Follow the directions below to set it up.

  1. Go to your WordPress plugins. Install and activate Akismet.
  2. Sign up for an Akismet API key. Akismet may require a paid subscription depending on the type of site you have.
  3. Go to your Akismet Settings and save your API key.
    Add Spam API Key
  4. For each form you would like protected, go to edit the form and click on the 'Settings' tab. Under the section 'On Submit' you should see 'Use Akismet to check entries for spam for' at the bottom of the page.
    Add Spam Form Settings
    You can set Akismet to check entries for no one, everyone, or visitors who are not logged in.

Akismet Troubleshooting

If you are seeing an error message like Your entry appears to be spam, you might have an email address or URL that is getting flagged. Please contact Akismet support. Choose the I think Akismet is catching my comments by mistake option, and they'll investigate the issue.

Captcha

CAPTCHAs are used by many websites to prevent abuse from 'bots', or automated programs usually written to generate spam. Bots cannot easily submit forms protected by CAPTCHA.

reCAPTCHA

reCAPTCHA is a script that judges whether a user is a human or a robot. You have probably seen some variation of reCAPTCHA.
Add Spam reCaptcha
Learn more about setting up reCAPTCHA in your forms.

hCaptcha

hCaptcha is a program that is designed to distinguish human users from spam via a challenge-response test. It is a popular alternative to Google's reCAPTCHA.
Add Spam hCaptcha
Learn more about setting up hCaptcha in your forms.

Comment Blacklist

In addition to Honeypot spam protection, every form submission goes through the comment blacklist checks. It allows adding custom terms to the comment blacklist and integrating several spam protection plugins without extra effort.

To add words, IPs, or URLs to your blacklist, go to the WordPress Settings → Discussion page. Add values in the Disallowed Comment Keys box, following the WordPress instructions: One word or IP address per line. It will match inside words, so "press" will match "WordPress."
Add Spam Protection - Disallowed Comment Keys

When a form submission is determined to be spam, an error message appears:
Add Spam Protection - Entry Appears Blocked Spam
Your entry appears to be blocked spam!
or
Your entry appears to be blacklist spam!

To disable blacklist spam checks, use the frm_check_blacklist hook.

Block IP addresses

Use the Disallowed Comment Keys textarea in the Discussion Settings to block IP addresses. An IP address listed in this option will be blocked from submitting a form entry and uploading files.

To add IP addresses with a snippet, you can hook it into the disallowed_keys option instead of updating it.

add_filter( 'option_disallowed_keys', function( $keys ) {
    return $keys .= ' 1337.HAXORS';
} );

If you are getting multiple file uploads from a specific IP, you can block and prevent the IP from uploading any files by adding the IP address to your disallowed comment keys.

CleanTalk

Anti-Spam by CleanTalk is a cloud-based service with a firewall that helps prevent spam bots before they get access to your website. It analyzes comments on your site and determines if it's from a visitor or a spam bot. If the comment is found to be from a spam bot, they will be blocked.

Troubleshooting

Spam submissions continue

If you are still receiving spam submissions with reCaptcha installed, you may be seeing manual spam rather than automated. We have seen this happen occasionally on various sites. Manual spam attacks are much more difficult to prevent with automated spam protection. There are a few options available by combining multiple spam prevention options.

  • Add Akismet. Since Akismet is frequently updated, there may be certain IPs, URLs, or phrases that other option may not catch.
  • Check the entries for common phrases, URLs, or IPs. If you find something repeated, add it to the comment blacklist. This works well for targeted manual spam.

Your entry appears to be spam

If you see this error message and have Akismet installed, follow these troubleshooting steps. If you don't have Akismet installed, the Honeypot spam protection system is one possible source of this error message. We have seen this occasionally happen when autocomplete is enabled in the browser. It can sometimes add value to the hidden Honeypot field, marking the entry as spam. You can switch off Honeypot in your form settings to remove the validation check.

Related developer hooks

  • To turn off Honeypot on one or all forms, use the frm_run_honeypot hook.
  • To manually flag the submission of a form as honeypot spam, use the frm_process_honeypot hook.
  • To remove the spam bot error when there is no IP, use the frm_validate_entry hook.

Related Articles

  • How to Use hCaptcha for WordPress How to Use hCaptcha for WordPress Forms [Block Spam Easy!]
    Read More
    How to prevent Spam Registration on WordPress The Best WordPress Spam Registration Prevention Methods
    Read More
    How to block spam in WordPress contact forms 8 Ways to Block Contact Form Spam in WordPress
    Read More
  • How to Add a Captcha to WordPress Contact Forms How to Add a Captcha to WordPress Contact Forms
    Read More
    WordPress Anti Spam Captchas Have Gone Invisible
    Read More
    Defeat evil spambots with Honeypot spam protection!
    Read More
  • Honeypot
    • Empty field above form
  • JavaScript Token
    • Token Hooks
  • Akismet
    • Akismet Troubleshooting
  • Captcha
    • reCAPTCHA
    • hCaptcha
  • Comment Blacklist
    • Block IP addresses
  • CleanTalk
  • Troubleshooting
    • Spam submissions continue
    • Your entry appears to be spam
  • Related developer hooks
  • Related Articles
Categories
×

Categories

  • Installation & Getting Started
  • Account Management
  • Forms
  • Entries
  • Views
  • Styles
  • Importing & Exporting
  • Add-Ons
  • Extend Formidable Forms

Using WordPress and want to get Formidable Forms for free?

Get Formidable Forms Lite Now

You do not have permission to view this form. Maybe you need to log in?

This article may contain affiliate links. Once in a while, we earn commissions from those links. But we only recommend products we like, with or without commissions.

Take on bigger projects Right Now

Get the tools you need to revolutionize your workflow and architect a masterpiece. Build the most advanced WordPress forms and actually use the data you collect in meaningful ways.

Get the most advanced WordPress form plugin and the only form builder with integrated Views.

Get Formidable Forms Now

Resources

  • Community
  • Affiliates
  • Contact
  • Free Online Form Builder

Top Features

  • Application Builder
  • Calculator Forms
  • Surveys & Polls
  • Quiz Maker
  • Form Templates
  • Application Templates
  • Directories
  • Donation Plugin

Company

  • About Us
  • Giving Back
  • Careers
  • Newsletter
  • WP Tasty
  • Nutrifox

Copyright © 2023 Strategy11, LLC. Formidable Forms® is a registered trademark Strategy11, LLC.
Privacy Policy | Terms of Service | Sitemap

Join 300,000+ using Formidable Forms to create form-focused solutions fast. Get Started See User Reviews