How to block spam submissions in WordPress forms

Find out which plugin creates the form before changing anything. Open the form editor and look for settings named Spam protection, Honeypot, CAPTCHA, Turnstile, hCaptcha or Akismet. WordPress does not provide one universal form-spam control, so the available settings depend on the form plugin.

Also check where submissions are stored. Some plugins reject spam before saving it, while others save it with a spam status. That difference matters if your email notifications are still being sent.

Turn on the form plugin’s honeypot or token-based protection first. A honeypot adds a field that normal visitors should leave empty; simple bots often fill every field and are rejected. This method usually avoids adding work for legitimate visitors.

Do not treat it as a complete defence. Support reports regularly show bots bypassing a single honeypot, especially when they use real browsers or target the form directly. Use it as the quiet first layer, not the only layer.

If spam continues, add the challenge supported by your form plugin, such as Cloudflare Turnstile, hCaptcha or reCAPTCHA. Prefer a silent or low-friction option where possible, because visible CAPTCHA fields can reduce accessibility and conversion. Gravity Forms describes its older reCAPTCHA field as a legacy option with known accessibility problems.

Set up the site and secret keys in the plugin’s integration screen, then test the form while logged out. A CAPTCHA can score or verify a request without stopping every spammer, so it should sit alongside the honeypot and other checks rather than replace them.

Use entry limits, a submission-speed check or server-level rate limiting when one visitor is sending many requests. Limit the form by IP where your hosting or security service supports it, but avoid permanent IP blocks if customers may share an office, school or mobile network.

For forms that should only be used occasionally, add a short delay between submissions or require a logged-in account. If you write custom handling, validate the request on the server as well as in the browser; client-side fields can be bypassed.

When the same malicious IP addresses keep appearing, add IP reputation checks or a blocklist. Review the rejected requests before tightening rules, because shared addresses and VPNs can include genuine visitors. Filter suspicious content as well if your form plugin supports URL, keyword or email-domain checks.

After enabling several controls, send a normal test entry and confirm that the notification, confirmation page and stored entry still work. If legitimate submissions start failing, disable one protection at a time. Token checks and aggressive speed rules can sometimes reject autofilled or slow submissions, as support cases show.

For a Gravity Forms site, the quickest silent option is the Gravity Forms AbuseIPDB Add-On. It checks the submitting IP against AbuseIPDB’s reputation data and can block known malicious addresses without adding a CAPTCHA step for ordinary visitors.

Use it after enabling Gravity Forms’ own spam controls, not instead of them. It is a good fit when you want reputation-based filtering with little user interaction, but it will not identify every new, rotated or previously unreported spam source.