Building forms
Spam protection
The checks that run on every form, challenges, Akismet, and what happens to entries that look like spam.
Every new form has three quiet checks that visitors do not notice. Settings are in the form's Spam protection group.
| Check | Default | Notes |
|---|---|---|
| Hidden trap field | On | A field people, keyboards and screen readers never reach, with a name unique to your site and form; bots that fill it in get a normal looking reply and nothing is stored |
| Refuse entries sent faster than | 3 seconds | People rarely fill a form in under three seconds |
| Maximum entries per minute from one visitor | 5 | Counted per form and IP address (stored only as a hash), over a sliding minute so a burst at the turn of a minute is still caught; 0 turns it off |
| Maximum web links in text answers | Off | For example 2 |
| Blocked words | None | One per line; capital letters do not matter |
| Check entries with Akismet | Off | Only when the Akismet plugin is active. Sends the entry text, IP address and browser description to Akismet |
When an entry looks like spam you can refuse it (the visitor is told why) or keep it in the Spam view for review. Kept spam sends no emails and runs no integrations; Not spam in the Spam view sends them then.
Email fields can also refuse addresses at domains you list (the field's Refuse these domains setting), for example throwaway mail services.
When you test a form from the builder, the spam checks are skipped and the entry is marked as a test.
Challenges
Add a challenge field from the Spam protection group when the quiet checks are not enough.
| Field | Notes |
|---|---|
| Image or sum challenge | Built in, no outside service. The simple sum mode works with screen readers. The image mode shows characters to type, with Answer a sum instead for anyone who cannot read them. Each question can be answered once and expires after ten minutes; digits typed in other scripts, such as Arabic, are accepted. Questions are fetched by the page, so cached pages work |
| reCAPTCHA, hCaptcha or Turnstile | Choose the provider and, for reCAPTCHA, the checkbox, invisible or score (v3) mode with a minimum score. Turnstile can be normal, compact or full width, and always visible, shown only while it checks, or only when it needs the visitor. Enter the site and secret keys in Settings, Spam protection; without keys the field is not shown to visitors |
Every answer from a challenge service is checked on your server: the token must be new (each one works once), made for your site, and for reCAPTCHA v3 made for this form with a score at or above the minimum. The provider's script loads only on pages with such a form, when the visitor starts using it or it scrolls into view.
Outside challenge services receive information about the visitor; mention them in your privacy policy. In Settings, Spam protection you choose what happens if the provider cannot be reached: refuse the entry, or accept it and mark it as spam for review (this applies even when the form refuses other spam).
Cached pages
Forms on cached pages keep working: each form fetches a fresh security token when the page is old, so page caches do not break submissions.