DocsForms
Spam protection
Honeypot, timing, rate limits, disallowed words, link limits, Akismet and CAPTCHA keep spam out — and spam is kept for review instead of deleted.
What runs on every form#
| Check | Default (Settings → Forms) |
|---|---|
| A hidden honeypot field bots fill in | Always on |
| Minimum time to fill in the form | 2 seconds |
| Submissions per visitor per 10 minutes | 8 (counted by a hash of the IP address, never stored) |
| WordPress’s disallowed words (Settings → Discussion) | On |
| Links allowed in a submission | 3 (0 allows any number) |
| Akismet, when it’s active | On |
A submission that fails the content checks is kept with the status Spam and no actions run. Look through Spam in Native AI → Forms now and then.
CAPTCHA#
For forms that need more, add a CAPTCHA: connect reCAPTCHA (v2 or v3) or Cloudflare Turnstile in Integrations, choose it in the form’s spam settings, and place the CAPTCHA element where the check should appear.
Order of checks#
Bot checks (honeypot, timing) → rate limit → the answers → validation on the server → CAPTCHA → content checks (disallowed words, links, Akismet) → files → the submission is saved → actions.
On the features pages
Still have a question? Email us at support.