Spam protection

These checks run on every form without visitors noticing. Set them in Contact Form → Settings → Spam.

Check	Default	How it works
Honeypot	On	A field people never see. Bots fill it in and get caught.
Least time to fill a form (seconds)	3	Forms sent faster than this count as spam, since people need a few seconds. 0 turns it off.
Messages per visitor, in 10 minutes	10	More messages from the same IP address within 10 minutes count as spam. 0 turns it off.
Use the Disallowed Comment Keys	On	Messages with a word, email, IP address or browser from the list in Settings → Discussion count as spam, as comments do.
Check with Akismet	Off	Sends the sender’s name, email, message, IP address and browser to Akismet. Needs the Akismet plugin, active and set up.

Captchas

For stubborn spam, add a captcha. Once its keys are saved it runs on every form:

First get the keys. Each service gives a site key and a secret key for your site’s domain:

• Cloudflare Turnstile: in the Cloudflare dashboard, open Turnstile and add a widget for your domain.
• hCaptcha: in the hCaptcha dashboard, add a site to get its site key. The secret key is in your account settings.
• Yandex SmartCaptcha: in the Yandex Cloud console, open SmartCaptcha and create a captcha for your domain. Its page shows the client key (the site key) and the server key (the secret key).
• Google reCAPTCHA v3: in the reCAPTCHA admin console, create a site and pick score based (v3). Keys made for v2 don’t work.

1. In Settings → Spam, enter the site key and secret key of Cloudflare Turnstile, hCaptcha, Yandex SmartCaptcha or Google reCAPTCHA v3, and save. You can set up more than one; a message must pass each.
2. The status next to each captcha says whether it works: Connected, Waiting for the first message, or Secret key not accepted. A captcha whose secret key is turned down sits out, so it never blocks every message.
3. Use on ticked runs it on every form. Unticked, it runs only on the forms that pick it, and its keys stay.

Each form picks under Captcha in its Advanced tab: As on every form (the captchas set to every form), No captcha on this form, or Only one of those set up, such as reCAPTCHA on the order form and Turnstile on the rest. A click on a captcha’s card picks it too.

Turnstile, hCaptcha and SmartCaptcha show a small widget. reCAPTCHA v3 is invisible: it scores each visitor from 0 (a bot) to 1 (a person), and Lowest score let through sets the cut-off (0.5 by default). Its Badge can sit in the page corner or be hidden. Google allows hiding it only if the page says the site is protected by reCAPTCHA and links to Google’s Privacy Policy and Terms of Service, so add that line to your form or theme.

The captchas go before the send button, or where you put the Captcha chip ([[captcha]]). If a captcha’s service can’t be reached, the message goes through, so an outage never blocks real visitors.