WordPress & SEO Blog

Simple steps to block bot spam from your WordPress website’s contact forms – without annoying your customers.

Getting spam through your WordPress forms? You’re not alone. Bots continuously scour the internet, looking for contact forms to fill out with fake offers, scams, or links. They clutter your inbox, waste your time, and sometimes even create security risks. Since WordPress powers roughly 43% of all websites on the internet, it’s not surprising that the lion’s share of form spam comes from WordPress websites.

Thankfully, there’s an easy fix called a honeypot. It works quietly in the background to catch bot spam without asking your visitors to check boxes, solve puzzles, or click traffic lights.

Why Honeypots Work (and Why You Should Use Them)

A honeypot is a hidden form field that your users can’t see – but spam bots can. When a bot fills in that field and submits the form, the website knows it’s junk and blocks it automatically. It’s not a complete replacement for other spam protection tools, but it’s a smart, low-maintenance first line of defense – particularly against bot spam.

How to Add a Honeypot in Popular WordPress Form Builders

Here is how you can enable honeypot fields in some of the most popular and widely-used WordPress form builders without requiring any extra plugins:

• Gravity Forms
• Contact Form 7
• WPForms
• Elementor Forms
• Ninja Forms
• Formidable Forms
• Fluent Forms

Gravity Forms

Gravity Forms makes it easy for you to protect your forms from bot spam by adding a honeypot:

1. From your left-hand Admin menu go to Gravity Forms > Forms
2. Click on the form you want to edit and then click on Settings > Form Settings
3. Look for the Form Options box near the bottom of the page
4. Toggle the “Anti-spam honeypot” switch ON
5. For If the honeypot flags a submission as spam click Do not create an entry
6. Click Save Settings

Contact Form 7

OK so I fudged just a little. Contact Form 7 is the outlier in this list since it doesn’t actually have the honeypot functionality built in. Not to worry! There is a plugin built specifically for that purpose called WP Armour – HoneyPot Anti Spam and implementing it is super easy:

1. Install WP Armour – HoneyPot Anti Spam from the WordPress repository
2. Activate the plugin
3. Click on WP Armor in the left-hand menu of your WordPress back end
4. On the Settings tab, you can customize the honeypot error message and enable / disable honeypot test widget (visible to logged in admins only)

That’s it – it will automatically work in the background of all of your Contact Form 7 forms!

WPForms

Both the free and paid versions of WPForms allow you to quickly and easily add a honeypot to your forms. Here’s how to enable it:

1. From your left-hand Admin menu go to WPForms > All Forms
2. Click on the form you want to edit and then click on Settings > Spam Protection and Security
3. Toggle the Enable modern anti-spam protection switch ON
4. Click Save

Note: You can also set a minimum amount of time (in seconds) that a user must spend filling out the form before submitting, but this is completely optional.

Elementor Form Builder

Compared to some of the other form builders in this list, the addition of a honeypot field to the Elementor form builder is fairly recent. Here’s how to implement it:

1. Open up the page that has the form you want to edit in the Elementor editor
2. Click on your form in the editor
3. In the Edit Form panel, click on the Add Item button – this will add a new field to your form
4. In the Type dropdown, select Honeypot (it’s one of the last options in the dropdown)
5. Give the field a Label (note: you want to name it something OTHER than “honeypot”)
6. Click Publish to save your edits

Ninja Forms

As easy as adding a honeypot field to the other form builders on this list, Ninja Forms is by far the easiest. You don’t actually need to do anything to add a honeypot because Ninja Forms automatically adds one to every form you create. There’s nothing to turn on and nothing to configure. Just create your form and you’re good to go!

Formidable Forms

Unlike some of the form builder plugins on this list, you don’t need to enable the honeypot field on each form individually. Here’s how to turn on the honeypot functionality:

1. From the left-hand Admin menu go to Formidable > Global Settings
2. Click on Captcha/Spam in the Settings menu
3. In the Spam section, make sure the checkbox for Use Honeypot to check entries for spam is checked
4. Click Update

That’s all there is to it! Now, any time you create a new form, the honeypot will automatically be added. It will also add the honeypot retroactively to any forms you have previously created.

Fluent Forms

Similar to Formidable Forms, Fluent Forms will automatically add a honeypot to all of your previous and future forms once the feature is enabled. Here’s how to turn on the honeypot functionality:

1. From the left-hand Admin menu go to Fluent Forms > Global Settings
2. Under the General tab click on Miscellaneous
3. Make sure Enable Honeypot Security is switched ON
4. Click Save Settings

Final Thoughts

Your website is one of your most important tools for doing business. Don’t let spam bots waste your time or clog your inbox. If you’re already using one of the popular WordPress form plugins above, adding a honeypot takes just a few minutes and it makes a big difference.

Need help? Reach out and I’ll be happy to review your forms and help protect your site from spam – quietly and effectively.