How to Stop WordPress Form Spam for Good (4 Methods That Actually Work)

Your contact form is getting spammed right now.

That is not an exaggeration and it is not a bug in your plugin. Automated bots crawl the internet continuously, find every publicly accessible form, and submit junk into it at scale. A new WordPress site with a simple contact form can start receiving spam submissions within days of going live, sometimes within hours.

The good news is that spam protection is not complicated. SureForms includes four separate anti-spam methods built directly into the plugin, and every single one is available for free. You do not need a separate security plugin, a paid CAPTCHA service, or a developer. You need to spend five minutes in your settings, pick the right combination for your situation, and you are done.

This guide covers all four methods, explains exactly when to use each one, walks through the setup steps, and tells you how to layer them for maximum protection without making life difficult for real visitors.

Why WordPress Forms Attract Spam 

A WordPress contact form is, at its core, a public HTTP endpoint. Anyone with a browser can access it. Any bot script can find it, send a POST request with whatever data it wants, and trigger a submission.

This is not a WordPress problem specifically. It is a fundamental characteristic of any publicly accessible web form. The difference is that a lot of WordPress site owners only use email notifications as their entry tracking system, which means they discover the spam problem through their inbox, not through any dashboard.

Here is why your email spam filter cannot solve it: spam protection on a form needs to happen before the submission is accepted, not after an email is sent. By the time your inbox receives a notification, the spam entry is already in your WordPress database. Email filters can sort the notification into junk, but the entry exists and is taking up space regardless.

Effective form spam protection intercepts the bot before the submission registers. That is what all four methods below do.

Watch the video below to learn how to prevent spam submissions on your WordPress forms. Then, explore the methods below for step-by-step setup instructions.

Method 1: Honeypot (Start Here) 

What it is

A honeypot is an invisible form field added to the HTML of your form. Humans cannot see it because it is hidden via CSS. Bots, which fill in every field they find in the HTML, do fill it in. When SureForms receives a submission with the honeypot field containing any data, it recognizes it as bot activity and discards the submission.

The name comes from the concept of a trap: the honeypot lures the bot, the bot takes the bait, and the submission is blocked.

Why it works

Basic and mid-level bots do not parse CSS visibility. They read the form HTML, identify all input fields, and fill them programmatically. The honeypot field is visible in the HTML but not on the screen. Any submission with that field populated is, with near certainty, automated.

For sophisticated bots that do evaluate CSS, SureForms v2.5.2 patched a specific bypass where bots that stripped the honeypot field entirely would previously slip through. If you are running a version older than 2.5.2, update now before configuring any spam protection.

What it costs your real visitors

Nothing. Zero. Real visitors never see the honeypot field and are never asked to do anything because of it. There is no checkbox, no image puzzle, no wait time. The experience is entirely invisible on the visitor side.

When to use it

On every form, as your first layer. Honeypot alone catches the majority of basic automated spam without adding any friction to the visitor experience. For lower-traffic sites with basic contact forms, honeypot may be all you need.

How to enable it in SureForms

Honeypot protection is configured globally and applies to all forms once enabled.

1. In your WordPress dashboard, go to SureForms > Settings
2. Click the Spam Protection tab
3. Find the Honeypot Security section
4. Toggle it on and save

That is it. Every SureForms form on your site now has a honeypot field added automatically. You do not need to configure it on individual forms.

Documentation: SureForms Honeypot Security

Method 2: Cloudflare Turnstile (Best Balance of Protection and UX) 

What it is

Cloudflare Turnstile is a modern CAPTCHA alternative built by Cloudflare and released publicly in late 2022. Unlike traditional CAPTCHAs, Turnstile does not ask visitors to identify traffic lights or read distorted text. It runs a set of challenges in the background and only presents a visible challenge to visitors who look suspicious to Cloudflare’s algorithm. For the vast majority of real visitors, Turnstile is completely invisible.

The result is strong spam protection with almost none of the friction that traditional CAPTCHAs introduce.

Why it works

Turnstile uses browser signals, interaction patterns, and Cloudflare’s global threat intelligence to determine whether a visitor is human or automated. It does this silently in the background. Bots that do not behave like real browsers fail the challenge and cannot submit.

What it costs your real visitors

Almost nothing in practice. Most legitimate visitors never see or interact with Turnstile at all. On rare occasions, someone with an unusual browser configuration or VPN may see a brief verification prompt, but this is uncommon. Turnstile is widely considered the best current balance of protection strength and visitor experience.

Prerequisites

You need a free Cloudflare account and two keys: a Site Key and a Secret Key. Creating them takes about two minutes.

How to set up Cloudflare Turnstile in SureForms

Step 1: Get your keys from Cloudflare

1. Go to cloudflare.com and log into your account (create a free account if you do not have one)
2. In the left sidebar, navigate to Turnstile
3. Click Add Site
4. Enter your site’s domain name
5. Choose the widget type:
   • Managed: Cloudflare decides when to show a challenge (recommended for most sites)
   • Non-Interactive: Runs silently with no visible widget ever
   • Invisible: The most passive mode, similar to Non-Interactive
6. Click Create – Cloudflare shows you your Site Key and Secret Key
7. Copy both keys

Step 2: Add the keys to SureForms

1. Go to SureForms > Settings > Spam Protection
2. Click the Turnstile tab
3. Paste your Site Key and Secret Key into the corresponding fields
4. Save

Step 3: Enable Turnstile on individual forms

Keys are configured globally but Turnstile is enabled per form:

1. Open any form in the SureForms editor
2. In the form settings, go to Advanced > Anti-Spam Settings
3. Under Security Type, select Cloudflare Turnstile
4. Save the form

Preview your form on the front end. You will see a small Cloudflare widget in the form footer, for most visitors this resolves automatically without any action required.

Documentation: SureForms Cloudflare Turnstile

Method 3: Google reCAPTCHA (Three Versions Explained)

What it is

Google reCAPTCHA is the most widely deployed CAPTCHA system in the world. SureForms supports all three versions, each with a different trade-off between protection strength and visitor experience.

The three versions

reCAPTCHA v2 Checkbox (“I’m not a robot”) The classic checkbox that has been on the internet since 2014. Visitors click a checkbox and, if Google’s risk assessment decides they need further verification, they complete an image recognition challenge. Highest friction. Highest certainty of catching bots. Best suited for high-risk forms like payment forms or registration forms where you can tolerate some visitor friction.

reCAPTCHA v2 Invisible No checkbox is visible. Google’s risk assessment runs in the background when the visitor submits the form. Only if the submission looks suspicious does a visual challenge appear. Much lower friction than v2 Checkbox but still provides strong protection.

reCAPTCHA v3 (Score-Based) Fully invisible. reCAPTCHA v3 runs continuously in the background and assigns every visitor a score from 0.0 (very likely a bot) to 1.0 (very likely a human). You configure a threshold score in SureForms, and submissions below that threshold are blocked. No challenge is ever shown to the visitor. Best experience, but requires tuning the threshold to balance security against false positives.

Privacy consideration

reCAPTCHA sends behavioral data about your site’s visitors to Google to power its risk assessment. This is a relevant consideration for sites operating under GDPR or other privacy regulations. If data privacy is a priority, use Cloudflare Turnstile or hCaptcha instead.

How to get your reCAPTCHA API keys

1. Go to google.com/recaptcha/admin
2. Click + Create (or + icon)
3. Enter a label for your site
4. Select the reCAPTCHA type (v2 or v3)
5. Add your domain name under Domains
6. Accept the terms and click Submit
7. Copy the Site Key and Secret Key from the confirmation screen

How to set up reCAPTCHA in SureForms

Global setup:

1. Go to SureForms > Settings > Spam Protection
2. Click the reCAPTCHA tab
3. Select your reCAPTCHA version
4. Paste your Site Key and Secret Key
5. If using v3, set the Score Threshold (0.5 is a reasonable starting point, raise it to be stricter, lower it to be more permissive)
6. Save

Enable on individual forms:

1. Open the form in the SureForms editor
2. Go to Advanced > Anti-Spam Settings
3. Under Security Type, select your chosen reCAPTCHA version
4. Save

Documentation: SureForms Google reCAPTCHA

Which version should you use?

Use v3 for most contact forms. It provides strong protection with zero friction. If you find that legitimate visitors are getting blocked (which you will see in your entries dashboard, valid-looking submissions that stopped appearing), lower the score threshold slightly.

Use v2 Invisible for forms where the submission is important enough to warrant occasionally showing a visual challenge (registration forms, payment forms, application forms).

Use v2 Checkbox sparingly, it is the most friction-inducing option and adds meaningful drop-off to most form completion rates.

Method 4: hCaptcha (The Privacy-First Alternative)

What it is

hCaptcha is a CAPTCHA alternative that works similarly to reCAPTCHA but is operated independently and does not send visitor behavioral data to Google. It presents image recognition challenges to visitors who trigger its security checks, similar to reCAPTCHA v2.

Why some site owners choose it over reCAPTCHA

The primary reason is privacy. Sites operating under strict GDPR compliance, sites serving audiences in jurisdictions with strong data protection regulations, or sites where sending user behavioral data to Google is genuinely unacceptable will find hCaptcha a cleaner option from a compliance standpoint.

hCaptcha also paid website owners a small amount for each CAPTCHA solved (it used this as a human verification labeling tool for AI datasets) though this program has largely wound down. The service remains free for standard use.

What it costs your real visitors

hCaptcha shows image recognition challenges to visitors it considers suspicious, similar friction level to reCAPTCHA v2. It is not invisible in the way that Turnstile or reCAPTCHA v3 are. For most site owners prioritizing visitor experience, Cloudflare Turnstile is the better choice. For site owners where data privacy takes precedence, hCaptcha is the right one.

How to set up hCaptcha in SureForms

Get your keys:

1. Go to hcaptcha.com and create a free account
2. From your hCaptcha dashboard, add your site and copy the Site Key and Secret Key

Add to SureForms:

1. Go to SureForms > Settings > Spam Protection
2. Click the hCaptcha tab
3. Paste your Site Key and Secret Key
4. Save

Enable on a form:

1. Open the form in the SureForms editor
2. Go to Advanced > Anti-Spam Settings
3. Under Security Type, select hCaptcha
4. Save

Documentation: SureForms hCaptcha

Pro Anti-Spam Tools 

The four methods above are available on SureForms free. SureForms Pro adds three additional restriction tools that address specific spam scenarios.

Validate as Unique

Validate as Unique prevents the same value from being submitted more than once across a specific field. You configure it on the email field to prevent the same email address from submitting a form twice. This is the right tool for:

• Contest entry forms (one entry per person)
• Event registration forms (prevent duplicate registrations)
• Any form where each person should only appear in your entries once

Without Validate as Unique, a single person could submit your contact form 200 times using the same email address and every one would register as a separate entry.

Documentation: Validate as Unique in SureForms

IP and Country Restrictions

Form Restrictions in SureForms Pro let you block form access by IP address, IP range, or country. These are targeted responses to specific spam campaigns rather than general protection:

• If your entries show a wave of spam from a specific IP range, block that range
• If your business is local or regional and you are receiving a high volume of spam from specific countries, block those countries
• Configure under Form Settings > Restrictions on the specific form

Documentation: Restrict Form Entries in SureForms

Keyword Restrictions

Block form submissions that contain specific words or phrases in text fields. If you notice that spam submissions consistently contain the same keywords (links, brand names, phrases), you can configure SureForms to automatically reject any submission containing those terms.

How to Layer Methods for Maximum Protection 

A single anti-spam method handles most spam. Layering two methods handles almost all of it.

The recommended combinations by site type:

Standard business contact form: Honeypot + Cloudflare Turnstile

This combination catches automated spam at the honeypot layer and verifies ambiguous submissions through Turnstile’s background challenge. Real visitors see nothing unusual. Spam submissions are blocked before they register. This is the right choice for 80% of sites.

GDPR-sensitive or European business: Honeypot + hCaptcha

Same principle as above but without sending visitor data to Google. Slightly more visible friction for visitors who trigger hCaptcha’s checks, but privacy-compliant.

High-traffic form or high-value conversion: Honeypot + reCAPTCHA v3 + Validate as Unique (Pro)

Adding reCAPTCHA v3 on top of Honeypot provides a second automated layer of protection. Validate as Unique prevents the same address from flooding your entries even if a submission gets through.

Contest or limited-entry form: Honeypot + Validate as Unique (Pro) + entry limit restriction (Pro)

This combination prevents bot submissions (Honeypot), prevents duplicate email submissions (Validate as Unique), and caps the total number of entries at your limit (Form Restrictions).

Maximum protection for a high-risk form: Honeypot + reCAPTCHA v2 Checkbox + Validate as Unique + IP restriction

The most friction-intensive combination. Reserved for forms where the cost of a false-positive (blocking a real visitor) is lower than the cost of a false-negative (a spam submission getting through) payment pages, admin access requests, government or legal intake forms.

What to Do When Spam Still Gets Through

If spam is still reaching your entries after configuring protection, here is how to diagnose and fix it.

Check your entries dashboard first

Go to SureForms > Entries and look at recent submissions. The entries dashboard stores everything regardless of whether your email notification was triggered. If spam entries are appearing in the dashboard, your spam protection is not blocking them. If they are not appearing in the dashboard, the notification email is being delivered but your protection caught nothing at submission level.

Confirm the method is actually enabled on the form

This is the most common cause. Anti-spam methods are enabled per form in Advanced > Anti-Spam Settings, not just globally. If you added Turnstile keys in global settings but did not select Turnstile in the individual form’s settings, nothing is active on that form. Open the form editor, check the Anti-Spam Settings, and confirm a method is selected.

Switch methods if basic spam is still coming through

If Honeypot alone is not enough, add Cloudflare Turnstile. If Turnstile is enabled and spam is still registering, switch to reCAPTCHA v3. Bot sophistication varies, what works for one form’s spam profile may not work for another.

Update SureForms if you are on a version older than 2.5.2

A bot bypass in Honeypot protection was patched in v2.5.2. If you are running an older version, the honeypot is not operating at full protection. Update to the current version.

Check the SureForms spam troubleshooting doc

SureForms has a dedicated troubleshooting guide: SureForm Submissions Marked as Spam: How to Fix

This covers scenarios where the reverse is happening, legitimate submissions being treated as spam, and how to adjust.

How SureForms Compares to Other Plugins on Spam Protection 

Plugin	Honeypot	reCAPTCHA (v2 + v3)	Cloudflare Turnstile	hCaptcha	Cost of All Four
SureForms	Free	Free	Free	Free	Free
Contact Form 7	No (addon required)	Addon required	No	Addon required	Addon cost
WPForms	Free	Free	Free (paid plans)	Paid addon	Mixed
Fluent Forms	Free	Free	Paid plans	Paid plans	Mixed
Gravity Forms	No native	All plans	All plans	All plans	All included (paid plugin)

SureForms is the only form plugin where all four anti-spam methods, Honeypot, Cloudflare Turnstile, Google reCAPTCHA, and hCaptcha are available on the free version with no tier restriction.

Contact Form 7, which entered feature freeze in 2026, has no native spam protection at all. It requires the separate Flamingo plugin for entry storage and additional addons for any CAPTCHA protection.

Conclusion

Form spam is a nuisance, not an unsolvable problem. Every method covered in this guide is available in SureForms free, takes under five minutes to configure, and stops the overwhelming majority of bot submissions before they ever reach your entries dashboard.

Start with Honeypot, enable it in SureForms > Settings > Spam Protection and it is active on every form immediately. If spam continues, add Cloudflare Turnstile to the specific forms that are being targeted. For most sites, those two layers together will end the problem entirely.

If you need advanced controls, duplicate submission prevention, IP blocking, country restrictions those tools are available in SureForms Pro starting at $59 per year for a single site with every feature included.

See everything SureForms Pro includes

FAQs