CleanTalk's blog

Sign Up

Stop spam without frustrating your visitors

Create your CleanTalk account and start blocking spam — no CAPTCHA challenges and no impact on visitors.

Security Block Lists

CleanTalk Account

No credit card required • Setup takes less than a minute • Your temporary password will be sent by email.

Author: Maria Krasnova

  • How to Stop Spam in Contact Form 7: Best Protection Methods in 2026

    How to Stop Spam in Contact Form 7: Best Protection Methods in 2026

    Contact Form 7 remains one of the most widely used contact form plugins in the WordPress ecosystem, with more than 10 million active installations listed in the official WordPress plugin directory. It has stayed popular for years because it gives site owners a practical, lightweight, and flexible way to add contact forms without switching to a heavier all-in-one form builder. WordPress.org also notes that the plugin uses its own Schema-Woven Validation technology, which shows that Contact Form 7 is built not just as a basic form tool, but as a structured system for handling user input reliably.

    In 2026, however, popularity also means exposure. Public-facing contact forms are easy for bots and abusive senders to find, test, and submit at scale, which is why Contact Form 7 gets spammed so often. Contact Form 7’s own documentation treats spam as a normal operational issue, not a rare exception: the plugin officially supports multiple anti-spam layers, including Akismet, Cloudflare Turnstile, the disallowed list, and reCAPTCHA v3. The project also explicitly warns that weak protection or unsafe mail configuration can allow spammers to abuse a form and send messages through the site itself.

    That is why Contact Form 7 spam should not be framed as a plugin defect or an unusual technical failure. It is a predictable consequence of running a highly visible form on a public website. In practice, especially in 2026, the real question is not whether a Contact Form 7 form can attract spam, but which protection stack is strong enough to block automated submissions without creating unnecessary friction for real users. Contact Form 7 itself recommends combining different types of spam protection rather than relying on a single mechanism alone.

    Contact form 7 at https://wordpress.org/plugins/contact-form-7/
    Contact form 7 at https://wordpress.org/plugins/contact-form-7/

    Common types of spam in Contact Form 7 (CF7)

    Spam in Contact Form 7 is not limited to one obvious pattern. The most common and best-documented category is automated bot spam – scripts that submit forms at scale faster than a human team can review them manually. Google has explicitly warned that bots are commonly used to fill out web forms automatically, which is one of the main reasons public-facing forms become a frequent target for abuse. Contact Form 7 reflects the same reality in its own documentation by offering multiple official anti-spam options and integrations rather than treating spam as an exceptional case.

    Another important category is human spam or human-assisted spam. Contact Form 7’s own reCAPTCHA FAQ explains that CAPTCHA tools can block spambots effectively but are “helpless against other types of spam,” and specifically notes that human spammers can easily get around them. That makes this a critical distinction for site owners: blocking bots alone does not mean the form is fully protected. This is also why Contact Form 7 advises using two or more spam protection modules together instead of relying on one layer only.

    A third risk is form abuse caused by unsafe configuration. Contact Form 7 explicitly warns that if mail settings are configured unsafely and sufficient spam protection is not in place, spammers may abuse the form to send messages through the site itself. In other words, some Contact Form 7 abuse is not just about junk submissions cluttering an inbox – it can also turn the form into a delivery mechanism for unwanted email.

    If you want to broaden this section beyond strictly official Contact Form 7 documentation, you can also mention fake contact data, direct POST abuse, and human-like spam that slips through basic CAPTCHA checks as practical patterns observed by CleanTalk in real-world Contact Form 7 cases. Those points are useful, but they should be framed as product or field observations rather than as claims directly documented by Contact Form 7 itself.

    Official anti-spam options and integrations in Contact Form 7

    Contact Form 7 includes several official anti-spam options and integrations, which shows that spam protection is not treated as an afterthought. In its own FAQ, Contact Form 7 says users can protect forms with anti-spam features such as Akismet, Cloudflare Turnstile, and the disallowed list. The plugin also maintains an official integration for reCAPTCHA v3, which remains part of its supported anti-spam stack.

    One of the most important options is Akismet. Contact Form 7 explains that Akismet works through specific form-tag options such as akismet:author, akismet:author_email, and akismet:author_url, allowing the plugin to evaluate the submission itself rather than simply challenge the user. The documentation goes even further and says that Akismet forms the “centerpiece” of Contact Form 7’s spam prevention strategy.

    Another major option is Cloudflare Turnstile. Contact Form 7 now provides an official Turnstile integration module and describes it as an effective way to protect forms from spam bots. More importantly, the project explicitly states, “We recommend Turnstile unless you have reasons to use reCAPTCHA.” That makes Turnstile the strongest current CAPTCHA-style recommendation inside the official Contact Form 7 ecosystem.

    Contact Form 7 also supports reCAPTCHA v3, but it should be described carefully. The official documentation says the integration is designed to block abusive submissions by spam bots, and the reCAPTCHA FAQ clarifies that Contact Form 7 5.1 and higher support only reCAPTCHA v3 natively. In other words, reCAPTCHA is still a valid option, but it is no longer the only CAPTCHA path inside Contact Form 7.

    The simplest built-in filtering layer is the disallowed list. According to Contact Form 7’s FAQ, it can block messages containing specified keywords or submissions coming from specified IP addresses. It is not a complete anti-spam solution on its own, but it works well as an extra rule-based layer when a site repeatedly sees the same phrases, links, or IP-based abuse patterns.

    Taken together, these options show that Contact Form 7 approaches spam protection as a layered system, not as a one-click fix. Akismet helps filter suspicious submissions, Turnstile and reCAPTCHA v3 are aimed at stopping spambots, and the disallowed list adds a simple keyword- and IP-based filter. Contact Form 7’s own guidance also recommends combining different anti-spam modules rather than relying on a single method alone. 

    CAPTCHA options in Contact Form 7

    If you specifically want to add CAPTCHA protection to Contact Form 7, there are two main options to focus on in the current Contact Form 7 ecosystem: reCAPTCHA v3 and Cloudflare Turnstile. Both are supported in Contact Form 7, but they should not be treated as identical solutions. They solve a narrower problem – mainly reducing automated bot submissions – and are usually most effective when combined with other filtering layers rather than used alone.

    reCAPTCHA v3 is Contact Form 7’s native Google-based CAPTCHA option. It works in the background and uses a score-based system instead of the classic checkbox challenge most users associate with older CAPTCHA tools. That makes it more convenient from a UX perspective, but it also means it is better at dealing with bots than with every kind of spam. In practice, reCAPTCHA v3 is still a valid option for Contact Form 7, especially for sites already using Google services, but it should not be positioned as a complete anti-spam solution by itself.

    Cloudflare Turnstile is now the stronger default recommendation for many Contact Form 7 sites. It is designed as a more lightweight CAPTCHA alternative and usually creates less friction for visitors than traditional challenge-based verification. More importantly, current Contact Form 7 documentation treats Turnstile as the preferred CAPTCHA-style option unless there is a specific reason to stay with reCAPTCHA. For that reason, if the goal is to choose the most up-to-date CAPTCHA layer inside the official Contact Form 7 stack, Turnstile is the better place to start.

    Some websites also use third-party CAPTCHA plugins, such as hCaptcha-based integrations, but these should be described as external add-ons rather than as Contact Form 7’s main official path. They can still be useful in certain setups, especially where privacy, policy, or infrastructure preferences matter, but for most readers the core CAPTCHA decision in Contact Form 7 today is really reCAPTCHA v3 vs Cloudflare Turnstile.

    The key point is that CAPTCHA is only one part of the protection strategy. It can help reduce automated spam, but it does not replace submission filtering, keyword blocking, or broader server-side anti-spam protection. That is why the best Contact Form 7 setups usually combine a CAPTCHA-style layer with other anti-spam methods instead of relying on CAPTCHA alone.

    Best ways to stop spam in Contact Form 7

    The most reliable way to reduce spam in Contact Form 7 is to use more than one protection layer. Contact Form 7’s own documentation says that the plugin provides several spam protection modules and advises users to use two or more modules together. In practice, that means the best setup is usually not a single tool, but a combination of bot protection, submission filtering, and rule-based blocking.

    For websites that want to stay within Contact Form 7’s official ecosystem, Cloudflare Turnstile is now the clearest starting point. Contact Form 7 provides an official Turnstile integration, says it effectively protects forms from spam bots, and explicitly states, “We recommend Turnstile unless you have reasons to use reCAPTCHA.” That makes Turnstile the strongest default CAPTCHA-style recommendation in the current Contact Form 7 stack.

    A second important layer is Akismet. Contact Form 7 says that Akismet forms the centerpiece of its spam prevention strategy and recommends combining different protection types instead of relying on only one module. Unlike a visible CAPTCHA challenge, Akismet is configured through specific form-tag options and evaluates the submission data itself, which makes it a strong complementary layer alongside Turnstile.

    The disallowed list is also worth using as a supporting layer. Contact Form 7’s FAQ says it can block messages containing specific keywords or submissions coming from specified IP addresses. It is not presented as a full standalone solution, but it is useful when a site repeatedly receives the same phrases, links, or IP-based abuse patterns.

    reCAPTCHA v3 remains a supported option, but it should be described carefully. Contact Form 7’s documentation says that version 5.1 and later uses the reCAPTCHA v3 API, while the FAQ notes that CAPTCHA tools are effective against spambots but can be ineffective against other spam types, including spam generated by humans. For that reason, reCAPTCHA is better presented as one possible layer, not as a complete answer by itself.

    Comparison table: reCAPTCHA vs Akismet vs Turnstile vs CleanTalk

    If you want to compare Contact Form 7’s native stack with an external service, CleanTalk is a reasonable option to include in the comparison section. WordPress.org describes it as a CAPTCHA-free anti-spam plugin that blocks contact form spam, fake users, and spam comments, and lists it at 200,000+ active installations. That makes it a valid external alternative to compare against Turnstile, Akismet, and reCAPTCHA – but in the article it should be presented as an external anti-spam service, not as one of Contact Form 7’s built-in protections.

    How to read this table: inside the official Contact Form 7 ecosystem, the strongest setup is usually Turnstile + Akismet, because CF7 explicitly recommends using multiple spam-protection modules together, calls Akismet the “centerpiece” of its spam-prevention strategy, and says, “We recommend Turnstile unless you have reasons to use reCAPTCHA.”

    reCAPTCHA v3 is still an official CF7 option, but it should be positioned carefully. Contact Form 7 says reCAPTCHA v3 is its officially supported CAPTCHA solution and that it works in the background, but the same FAQ also warns that CAPTCHA tools can be helpless against other spam types, including human spammers.

    Akismet deserves a higher position in the comparison than many WordPress articles give it. CF7 says Akismet is the centerpiece of its spam-prevention strategy and explains that it works by evaluating submission data, not just by placing a challenge in front of the visitor.

    Turnstile is the clearest current default inside Contact Form 7. CF7’s integration page says all contact forms are protected after setup, while Cloudflare positions Turnstile as a CAPTCHA replacement that works without showing visitors a traditional CAPTCHA and aims for a less intrusive experience.

    CleanTalk should be presented honestly as an external alternative, not a native Contact Form 7 feature. The WordPress.org listing describes it as a no-CAPTCHA anti-spam plugin and says it stops spam contact emails; the same listing also has a dedicated Contact Form 7 section saying the plugin extends spam protection for CF7 and can be used with other third-party spam filters.

    Bottom line: if the article is comparing the best practical options, the cleanest conclusion is this – Turnstile is the best default native entry point, Akismet is the strongest native filtering layer, reCAPTCHA v3 is still valid but weaker as a primary recommendation, and CleanTalk is the most natural external no-CAPTCHA alternative to compare against the CF7 stack.

    Anti-Spam solutions for Contact form 7 comparison chart.
    Anti-Spam solutions for Contact form 7 comparison chart.

    Anti-Spam plugin by CleanTalk for WordPress

    The next tool we’re going to use is the Anti-Spam plugin by CleanTalk.

    Here’s a short overview:

    • CleanTalk is a cloud-based spam protection service for websites, founded in 2012.
    • It automatically blocks spam without CAPTCHAs and doesn’t interrupt the user experience.
    • Protects many types of forms: contact forms, payment forms, registrations, comments, surveys and more.
    • Stops both automated bots and human spam submissions.
    • Uses advanced filtering algorithms and a global spam detection network.
    • Detects spam based on IP address, email address and user behavior.
    • Lets you create custom filtering rules for specific cases.
    • Allows blocking or filtering by IP, email and country.
    • Works quietly in the background and is very easy to install and configure.

    According to WordPress.org, Anti-Spam by CleanTalk for WordPress has over 200,000 active installations, with thousands of reviews and an average rating around 4.7 out of 5.

    Plugin Homepage at cleantalk.org | Latest release at GitHub.com | Website cleantalk.org

    According to WordPress.org, Anti-Spam by CleanTalk for WordPress has over 200,000 active installations, with 3,168 reviews and an average rating of 4.7.

    Plugin Homepage at cleantalk.org | Latest release at GitHub.com

    Install the CleanTalk Anti-Spam plugin

    To install the Anti-Spam plugin, go to your WordPress admin panel→ Plugins→ Add New.

    image

    Then enter «СleanTalk» in the search box and click the Install button for «Spam protection, Anti-Spam, FireWall by CleanTalk».

    image

    After installing the plugin, click the «Activate»‎ button.

    image

    After it is done go to the plugin settings and click the «Get Access Key Automatically» button. Then just click the «Save Settings»‎ button.

    image

    That’s all –  Contact Form 7 are now protected From this moment,CleanTalk automatically protects the  Contact Form 7 registration form (REST route /wp-json/Contact Form 7press/v1/users/), and the Add Listing form used to submit new listings.
    You don’t need to paste any shortcodes – just use  Contact Form 7 as usual, and CleanTalk will filter spam in the background.

    Check if spam protection works with Contact Form 7 (CF7)

    The best way to text the spam protection by using a test email,

    stop_email@example.com

    1. Open a page with a Contact Form 7 (for example, the registration popup or the Add Listing form) in an Incognito / private browser tab.
    2. Fill out the Contact form using stop_email@example.com as sender’s email.
    3. Send the form.
    4. You should see a message from the Anti-Spam plugin confirming that a spam submission was blocked.

    *** Forbidden. Sender blacklisted. Anti-Spam by CleanTalk. ***

    image

    If you see this message, it means CleanTalk successfully protects your Contact Form 7 (registration and Add Listing) from spam.

    Cloud Dashboard

    In addition, in the Cloud Dashboard you can find extra details regarding all submissions processed by CleanTalk, including Contact Form 7 registration and Add Listing forms:

    • IP and email of the sender, as well as the sender’s activity history across other websites connected to the CleanTalk cloud.
    • Geolocation of the sender.
    • Date and time of the submission.
      Page (URL) where the form was submitted (for example, a specific listing submission page).
    • Cloud decision – Approved or Denied.
    • Cloud explanation for the decision (e.g. blacklisted email, bad IP reputation, spam text, etc.).
    • Tools to move the sender to Block or Allow lists so you can fine-tune  Contact Form 7 spam protection.

    FAQ

    I still get spam in Contact Form 7 after setting everything up. What should I do?

    If spam still gets through, the first step is to stop treating any one plugin as a complete solution. Contact Form 7 itself recommends using two or more spam-protection modules together, because different tools catch different abuse patterns. In practice, that usually means combining a bot-reduction layer such as Turnstile or reCAPTCHA with a filtering layer such as Akismet or an external service such as CleanTalk, plus simple rule-based blocking through the disallowed list when you see repeated phrases or IP-based abuse.

    Should I choose Turnstile or reCAPTCHA for Contact Form 7?

    If you want to stay within Contact Form 7’s official CAPTCHA-style options, Cloudflare Turnstile is now the clearer default choice. Contact Form 7 explicitly says, “We recommend Turnstile unless you have reasons to use reCAPTCHA.” reCAPTCHA v3 remains supported, but Contact Form 7 also warns that CAPTCHA solutions are mainly effective against spambots and can be weak against other types of spam, including human spam.

    Is Akismet enough on its own?

    Akismet is one of the strongest native filtering layers in the Contact Form 7 stack, and CF7 even calls it the “centerpiece” of its spam-prevention strategy. But Contact Form 7 does not frame Akismet as a one-plugin answer to every spam problem. The project recommends combining different protection types, which is why Akismet works best alongside another layer such as Turnstile, reCAPTCHA, or an external server-side anti-spam service.

    Contact Form 7 says the message was sent, but I never received the email. Is that a spam issue?

    Not necessarily. Contact Form 7’s FAQ explains that if you see the green success message, the PHP mail function completed successfully, but the message may still have been filtered or lost afterward. The same FAQ notes that spam filters often cause this kind of problem. That means this is usually a mail deliverability issue rather than a form-spam issue.

    How do I improve email deliverability for Contact Form 7 notifications?

    Start with Contact Form 7’s own mail best practices. The plugin recommends using a From address that belongs to the same domain as the website, setting a proper Reply-To header for the sender’s real email, and enabling email authentication methods such as SPF and DKIM. WordPress also explains that wp_mail() depends on the site’s mailing environment, so if local mail is not configured properly, routing mail through a correctly configured SMTP or mail provider setup is often more reliable.

    Final recommendation

    If your goal is to stop Contact Form 7 spam reliably without making the form harder for real users, the best approach is a layered protection stack. In 2026, inside the official Contact Form 7 ecosystem, the strongest starting point is usually Cloudflare Turnstile + Akismet, supported by the disallowed list where repeated patterns appear. That recommendation matches Contact Form 7’s own guidance: use multiple anti-spam modules together, treat Akismet as a core filtering layer, and prefer Turnstile over reCAPTCHA unless there is a specific reason to stay with Google’s solution.

    If you want broader site-wide protection without relying only on CAPTCHA-style challenges, an external server-side solution such as CleanTalk is a reasonable alternative to include in the comparison, especially for sites that want a CAPTCHA-free layer across Contact Form 7, comments, and registrations. The right choice depends on how much spam you get, how much friction you can tolerate, and whether you need protection only for Contact Form 7 or across WordPress more broadly.

    The most important takeaway is simple: in 2026, no single anti-spam method is enough for every Contact Form 7 site. CAPTCHA can reduce automated abuse, Akismet can evaluate suspicious submissions, rule-based filters can block recurring patterns, and external services can add broader server-side protection. The sites that perform best usually combine these layers instead of expecting one plugin or one checkbox to solve the entire problem.

    Stop Contact Form 7 spam without CAPTCHAs

    Create your CleanTalk account and protect Contact Form 7 from bot and human spam with server-side filtering. Keep forms easy for real visitors while extending protection across comments, registrations, and other WordPress forms.

    CleanTalk Account

    No credit card required • Setup takes less than a minute • Your temporary password will be sent by email.

  • Events Manager Spam Protection in 2026

    Events Manager Spam Protection in 2026

    If you use Events Manager to run event listings, bookings, registrations, and attendee management on WordPress, you will eventually face spam: fake bookings, bot registrations, junk attendee submissions, and abusive messages sent through public event-related forms.

    This guide explains how to set up Events Manager spam protection using:

    • the Anti-Spam plugin by CleanTalk,
    • Google reCAPTCHA where applicable,
    • and additional tools like hCaptcha, Cloudflare Turnstile, honeypots, and moderation.

    For Events Manager websites, spam is not just an inbox problem. It can pollute attendee data, trigger fake booking notifications, waste admin time, and reduce trust in your event workflows.

    Events Manger logo

    Events Manager – Calendar, Bookings, Tickets, and more!

    First, let’s take a quick look at Events Manager itself and the types of sites that usually need anti-spam protection.

    Events Manager is a WordPress plugin for publishing events, calendars, locations, bookings, tickets, scheduling, and registrations. It is used for everything from simple local meetups and workshops to conferences, classes, recurring events, and larger event-driven websites. The plugin’s official site highlights bookings management, guest bookings, approvals, cancellations, multiple tickets, and booking-related email workflows, which is exactly why spam becomes a practical issue on public-facing event pages.

    Because Events Manager relies on public booking and registration flows, it can attract several types of spam:

    • fake bookings created by bots,
    • disposable or non-existent attendee emails,
    • junk text submitted through custom booking fields,
    • low-quality manual submissions,
    • repeated fake booking attempts that trigger admin emails and clutter records.

    Events Manager documentation also shows that bookings can be enabled directly for events, and that the booking flow may involve custom booking forms where email is required. That makes fake or throwaway email addresses one of the most realistic spam problems for this plugin.

    As WordPress.org shows, Events Manager is currently used on over 70,000 websites.
    Plugin Homepage at wordpress.org | Documentation at wp-events-plugin.com

    Install Events Manager to build event listings, booking pages, registration flows, and attendee management on WordPress.

    You can set it up in a few easy steps:

    Open your WordPress admin panel.

    Go to Plugins → Add New.

    Search for Events Manager.

    Screenshot 2026 03 25 at 20.42.48 1

    Click Install and then Activate.

    Screenshot 2026 03 25 at 20.45.02

    Go to Events → Settings and configure your basic event and booking options.

    Open an event and enable bookings by checking Enable registration for this event.

    Publish the event and verify that the booking form appears on the event page if your format/settings are configured to display it.

    Events Manager’s documentation confirms that bookings are enabled at the event level and can be displayed on event pages through the booking form placeholder/setup.

    Anti-Spam plugin by CleanTalk for WordPress

    The next tool we’re going to use is the Anti-Spam plugin by CleanTalk.

    Here’s a short overview:

    • CleanTalk is a cloud-based spam protection service for websites.
    • It blocks spam without forcing every visitor to solve CAPTCHA challenges.
    • It protects registrations, contact forms, comments, booking-related submissions, and many other types of WordPress forms.
    • It helps stop both automated bots and manual spam submissions.
    • It uses signals such as IP address, email reputation, and behavior patterns.
    • It works quietly in the background and is easy to install.

    For Events Manager websites, this is useful because the main problem is usually not just “spam comments.” It is fake bookings, junk attendee details, and noisy event-related submissions that should never have reached the admin panel in the first place.

    According to WordPress.org, Anti-Spam by CleanTalk for WordPress has over 200,000 active installations, with 3,168 reviews and an average rating of 4.7.

    Plugin Homepage at cleantalk.org | Latest release at GitHub.com | Website cleantalk.org

    Install the CleanTalk Anti-Spam plugin

    Show Instructions

    To install the Anti-Spam plugin, go to your WordPress admin panel → Plugins → Add New.

    forminator-spam-protection

    Then enter «СleanTalk» in the search box and click the Install button for «Spam protection, Anti-Spam, FireWall by CleanTalk».

    testing-forminator-spam-protection

    After installing the plugin, click the «Activate»‎ button.

    testing-forminator-spam-protection

    After it is done go to the plugin settings and click the «Get Access Key Automatically» button. Then just click the «Save Settings»‎ button.

    forminator-spam-protection

    That’s it! From now you know how to completely protect your HivePress from spam.

    Check if spam protection works with HivePress

    The best way to test the spam protection by using a test email,

    stop_email@example.com

    1. Open page with your form (don’t forget to add the shortcode in the page content) in Incognito browser tab.
    2. Fill out the Contact form using stop_email@example.com as sender’s email.
    3. Send the form.
    4. You should see a message from the Anti-Spam plugin confirming that a spam submission was blocked.

    *** Forbidden. Sender blacklisted. Anti-Spam by CleanTalk. ***

    events manager test 02 1
    If you see this message, it means CleanTalk successfully protects your Events Manger forms (registration and booking) from spam.

    Cloud Dashboard

    In addition, in the Cloud Dashboard you can find extra details regarding submissions processed by CleanTalk, including event-related form submissions on your website.

    This is especially useful for Events Manager because it helps you investigate fake attendees, repeated junk bookings, and suspicious submission patterns.

    In the dashboard you can review:

    • sender IP and email,
    • geolocation,
    • date and time of the submission,
    • the page URL where the form was submitted,
    • cloud decision: Approved or Denied,
    • the likely reason for the decision,
    • tools to move senders into Allow or Block lists.

    For event websites, this helps identify patterns such as repeated fake bookings from the same IP range, disposable email domains used by bots, or spam attempts targeting one specific event page.

    Google reCAPTCHA, hCaptcha, and Cloudflare Turnstile

    Besides CleanTalk, you can also use CAPTCHA and anti-bot services together with Events Manager to reduce spam and protect booking-related flows.

    Google reCAPTCHA

    Events Manager documentation for custom booking forms explicitly mentions a captcha field based on Google’s reCAPTCHA service. The docs describe it as a field that helps prevent spammers from successfully filling the form and note that it requires Google API keys.

    To use reCAPTCHA with Events Manager:

    1. Register your domain in the Google reCAPTCHA admin.
    2. Generate the required keys.
    3. Configure the keys where your Events Manager booking form setup supports them.
    4. Test that the CAPTCHA is displayed and working correctly on the booking page.

    This adds an extra visible challenge to the form, while CleanTalk can continue filtering submissions in the background.

    hCaptcha

    Events Manager does not present hCaptcha in the same native way as its custom-form reCAPTCHA field, so hCaptcha is usually added through a separate WordPress plugin.

    Key benefits of hCaptcha:

    • better privacy positioning for some projects,
    • less dependence on Google services,
    • useful for sites that want a visible anti-bot layer.

    To use hCaptcha:

    1. Create an hCaptcha account.
    2. Get a Site Key and Secret Key.
    3. Install a WordPress plugin that adds hCaptcha to supported forms.
    4. Test that hCaptcha appears correctly on your booking or registration pages.

    Cloudflare Turnstile

    Cloudflare Turnstile is a modern CAPTCHA alternative that often works more quietly in the background than classic image-based challenges.

    Main benefits of Turnstile:

    • less friction for visitors,
    • better form completion rates,
    • more privacy-friendly approach than traditional CAPTCHA systems.

    To use Turnstile:

    1. Generate Turnstile keys in Cloudflare.
    2. Install a WordPress plugin that supports Turnstile.
    3. Connect the keys in the plugin settings.
    4. Verify that Turnstile is actually applied on the pages where Events Manager renders booking forms.

    For many event sites, Turnstile is attractive because public event booking pages usually convert better when users do not have to solve image puzzles.

    Honeypot, Akismet and third-party Anti-Spam plugins

    Additionally, let’s consider standalone plugins and anti-spam mechanics that also work with Events Manager-based websites.

    Honeypot

    Honeypot is one of the simplest anti-spam mechanics against primitive bots. It works by adding hidden fields that humans never interact with, but bots often fill automatically.

    Because no challenge is shown to the user, honeypots:

    • keep the booking process smooth,
    • reduce friction on mobile,
    • add a lightweight extra layer of bot filtering.

    A honeypot is a useful addition for Events Manager booking pages, but it is usually not enough by itself against manual spam or more advanced bot traffic.

    Akismet

    Akismet can be useful on the broader WordPress site level.

    For Events Manager websites, Akismet may help with:

    • blog comments,
    • basic contact forms,
    • general low-quality submissions outside the main booking workflow.

    However, it is better to position Akismet as a secondary layer rather than the main answer to booking spam.

    Other universal Anti-Spam plugins

    Other plugins such as WP Armour, OOPSpam, Maspik, and similar universal anti-spam tools can also be used at the site level.

    They may help protect:

    • contact forms,
    • comment areas,
    • miscellaneous site forms not directly tied to the core event booking flow.

    These tools can be combined with CleanTalk on high-risk or high-traffic projects, especially if you want a layered anti-spam setup.

    Frequently Asked Questions (FAQ)

    Bookings look normal at first, but later you notice obvious fake attendees. Why?

    This usually happens when spam is not aggressive enough to be blocked by a basic visible challenge alone. Instead of sending nonsense, bots or low-quality submitters use realistic names and email formats to blend into normal bookings.

    What to check:

    1. Review whether too many bookings are coming from the same IP range or location.
    2. Look for patterns in attendee emails, such as random strings or disposable domains.
    3. Check whether the same event receives repeated signups within very short time intervals.
    4. Add moderation for events that attract open public traffic.
    5. Use CleanTalk as the background filter instead of relying only on a visible CAPTCHA.
    A booking form is protected, but spam moves to another event page. Why does this happen?

    This is common on event websites with multiple public pages. Once one booking form becomes harder to abuse, spam often shifts to the next publicly accessible event or registration page.

    To reduce that risk:

    1. Make sure protection is active across the whole site, not just on one event.
    2. Check old event pages, recurring events, and cloned event templates.
    3. Review whether guest bookings are enabled everywhere by default.
    4. Test more than one event page, not just your newest listing.
    5. Use one anti-spam layer that covers the full WordPress form flow sitewide.
    Real visitors complain that CAPTCHA is annoying, but you still need spam protection. What is the best balance?

    This is one of the most common problems for Events Manager websites. Public event pages need to convert well, especially on mobile, but they also attract bots.

    A practical balance is:

    1. Use CleanTalk as the main low-friction filtering layer.
    2. Add Turnstile or reCAPTCHA only on the highest-risk booking forms.
    3. Keep shorter booking forms where possible.
    4. Avoid stacking multiple visible challenges on the same page.
    5. Monitor whether spam drops without hurting real registrations.
    Spam is not breaking the form, but it is ruining reporting and attendee lists. How do you handle that?

    This is an important point. On event websites, spam does not always look dramatic. Sometimes the form works perfectly, but your attendee list becomes unreliable.

    That creates operational problems:

    1. inflated registration numbers,
    2. misleading conversion reporting,
    3. wasted follow-up emails,
    4. poor visibility into real event demand,
    5. extra manual cleanup before the event.

    The best response is to treat spam as a data quality problem, not just a form problem. Use layered protection, review suspicious bookings in the dashboard, and add moderation for events where list accuracy matters.

    You are getting spam mostly on free events, not paid ones. Is that normal?

    Yes. Free event pages are often easier targets because there is less friction in the booking flow. Paid or more controlled events naturally filter out a portion of spam just by adding checkout or payment-related steps.

    If your free events are being targeted:

    1. apply stronger filtering to free registration pages,
    2. consider moderation for first-time or suspicious bookings,
    3. review whether unnecessary form fields are exposed,
    4. watch for repeated email-domain patterns,
    5. add an extra challenge only where abuse is concentrated.
    Events Manager emails are working, but too many junk confirmations are being sent. What should you fix first?

    When spam reaches the booking stage, email noise is often the first visible symptom. Admins start getting useless notifications, and fake attendees may also receive confirmation emails.

    Fix the source first:

    1. stop the fake booking before it is created,
    2. reduce exposure on public booking forms,
    3. check for repeated sender patterns in the Cloud Dashboard,
    4. use moderation for vulnerable events,
    5. only then fine-tune email delivery settings if needed.

    In other words, do not treat this only as a mail problem if the real cause is spam entering the workflow upstream.

    hCaptcha or Turnstile is enabled, but suspicious registrations still get through. Why?

    Because challenge-based tools are not the same as full spam filtering. They help reduce some automated abuse, but they do not automatically catch every low-quality or semi-manual submission.

    That is why suspicious registrations may still appear when:

    1. the spam is submitted manually,
    2. the attacker uses more realistic input,
    3. the challenge is only active on part of the workflow,
    4. another page or form variant remains unprotected,
    5. there is no secondary filtering layer behind the form.

    For Events Manager, challenge tools work best as part of a layered setup, not as the only defense.

    Recommended Anti-Spam Stack for Events Manager (2026)

    No single anti-spam plugin solves every Events Manager problem, because the risks are different: one site struggles with fake attendees, another with disposable emails, another with noisy free-event bookings, and another with recurring spam across cloned event pages.

    That is why the best setup is not “one perfect plugin,” but a stack built around how your event site actually gets abused.

    1. For simple event websites with moderate traffic

    Best for local events, workshops, community meetups, and small business event pages.

    Recommended stack:

    • CleanTalk Anti-Spam as the primary filtering layer
    • optional honeypot for lightweight bot filtering
    • manual review only for suspicious cases

    Why this works:
    It keeps the booking flow simple for real users while still filtering the most common bot and junk submissions in the background.

    2. For public booking-heavy event sites

    Best for websites where bookings are open to everyone and event pages get regular public traffic.

    Recommended stack:

    • CleanTalk Anti-Spam
    • Cloudflare Turnstile or Google reCAPTCHA on the main booking form
    • dashboard review for repeated spam patterns
    • moderation for events that attract abuse spikes

    Why this works:
    This setup balances conversion and protection. CleanTalk handles silent filtering, while Turnstile or reCAPTCHA adds pressure on higher-risk forms.

    3. For free events that attract fake registrations

    Best for webinars, free classes, community sessions, lead-generation events, and open sign-up pages.

    Recommended stack:

    • CleanTalk Anti-Spam
    • stronger checks on registration-heavy event pages
    • review of suspicious email domains and repeat booking patterns
    • moderation for first-wave suspicious signups

    Why this works:
    Free events are often targeted because they are easy to abuse. In this case, protecting list quality matters as much as blocking classic spam.

    4. For complex Events Manager setups with guest bookings and custom fields

    Best for sites using custom booking forms, guest booking flows, and more flexible attendee data collection.

    Recommended stack:

    • CleanTalk Anti-Spam
    • reCAPTCHA where the custom booking form supports it
    • careful review of open text fields
    • moderation on high-risk events
    • block lists for repeat abuse patterns

    Why this works:
    The more flexible the booking flow is, the more ways spam can imitate normal behavior. These sites benefit from stronger filtering plus closer review of custom inputs.

    5. For high-value events where attendee accuracy matters most

    Best for paid events, limited-capacity events, invite-based events, and registrations tied to operations or sales follow-up.

    Recommended stack:

    • CleanTalk Anti-Spam
    • visible challenge on the booking form
    • manual moderation for suspicious submissions
    • dashboard-based review of suspicious IP, email, and geo patterns
    • stricter approval logic where needed

    Why this works:
    Here the goal is not only blocking spam, but protecting the quality of attendee data, reporting, and operational planning.

    Final recommendation

    For most Events Manager websites, the strongest practical setup is this:

    • CleanTalk as the core anti-spam layer
    • Turnstile or reCAPTCHA on the most exposed booking pages
    • moderation where data quality matters more than booking speed
    • dashboard review for recurring spam patterns

    That combination is usually much more effective than relying on one visible CAPTCHA or one lightweight plugin alone.

    Stop fake bookings and registration spam in Events Manager

    Create your CleanTalk account and protect your Events Manager booking and registration forms from fake attendees, disposable emails, and bot submissions — without CAPTCHA friction for real visitors.

    CleanTalk Account

    No credit card required • Setup takes less than a minute • Your temporary password will be sent by email.

  • Formidable Forms Spam Protection in 2026

    Formidable Forms Spam Protection in 2026

    If you use Formidable Forms on a WordPress website, spam will eventually become a real issue. It usually starts with a few junk submissions in a contact form, quote request form, survey, quiz, or registration form. Then it turns into fake leads, bot traffic, meaningless messages, and wasted admin time.

    That is not a Formidable-specific flaw. It is a normal consequence of running public-facing forms on a visible website. The more accessible the form is, the more often bots and abusive senders will try to submit it. That is why Formidable Forms spam protection should be configured from the start, not only after your inbox is already full of garbage entries.

    This guide explains how to build a practical layered setup for Formidable spam protection. The main solution here is the Anti-Spam plugin by CleanTalk, and then we will also cover additional tools such as built-in anti-spam options, honeypot protection, reCAPTCHA, hCaptcha, Cloudflare Turnstile, and other WordPress anti-spam plugins.

    By the end of this article, you will know how to stop most fake submissions in Formidable Forms without making your forms harder for real visitors to use.

    formidable logo

    Formidable Forms – WordPress Form Builder Plugin

    First, let’s take a quick look at Formidable Forms itself.

    Formidable Forms is a WordPress form builder used for much more than a basic contact form. Website owners use it to create contact forms, lead forms, quote request forms, surveys, quizzes, registration flows, calculators, payment forms, and other custom workflows. That flexibility is exactly why the plugin is attractive for businesses, agencies, and content-driven sites.

    But that same flexibility also increases spam exposure. The more public forms a website has, the more entry points it gives to spambots and abusive users.

    Typical Formidable spam problems include:

    • fake contact messages,
    • junk quote requests,
    • automated survey submissions,
    • low-quality leads,
    • bot-driven registration attempts,
    • repeated testing of form fields and validation logic.

    So when users search for formidable spam, they are usually not describing one single issue. They often mean a broader set of problems: fake submissions, spammy messages, junk leads, bot traffic, and abusive attempts to use public forms.

    A strong anti-spam strategy should address all of those while keeping the experience simple for legitimate users.

    As WordPress.org shows, Formidable Forms is currently used on over 300,000 websites and has 1,357 user reviews with an average rating of 4.8.

    Plugin Homepage at wordpress.org | Website formidableforms.com

    Install Formidable Forms to create contact forms, quote request forms, surveys, quizzes, registration forms, and other custom forms in WordPress.

    You can set it up in just a few easy steps:

    1. Search for the plugin in WordPress console -> Plugins -> Add Plugin -> Search -> Type ‘Formidable Form

    Search for the plugin in WordPress console

    2. Install and Activate the plugin

    Install and Activate the plugin

    3. Create your first form in WordPress console -> Formidable -> Forms -> Add New.

    WordPress console -> Formidable -> Forms -> Add New -> choose a template or start with a blank form -> add fields and settings -> Save.

    4. That’s all! Your first form is ready and Formidable Forms is now set up on your site.

    Anti-Spam plugin by CleanTalk for WordPress

    The main solution in this guide is the Anti-Spam plugin by CleanTalk.

    CleanTalk is a cloud-based anti-spam service for WordPress and other CMS platforms. Instead of making every visitor solve a challenge, it checks submissions in the background and filters spam automatically. This matters because one of the biggest weaknesses of CAPTCHA-only protection is friction: every extra test can reduce conversion rate and annoy real users.

    Here is why CleanTalk works well for Formidable Forms websites:

    • it checks submissions automatically in the background,
    • it helps protect contact, registration, survey, quote, and feedback forms,
    • it reduces fake entries before they clutter your inbox or database,
    • it does not rely on classic CAPTCHA for every visitor,
    • it gives you a cloud dashboard for reviewing decisions and fine-tuning protection if needed.

    In practical terms, this means you can keep the form experience clean for real users while filtering suspicious behavior in the background.

    For most websites, CleanTalk should be the primary spam filter, while CAPTCHA and other tools are used only as additional layers on higher-risk forms.

    According to WordPress.org, Anti-Spam by CleanTalk for WordPress has over 200,000 active installations, with 3,168 reviews and an average rating of 4.7.

    Plugin Homepage at cleantalk.org | Latest release at GitHub.com | Website cleantalk.org

    Install the CleanTalk Anti-Spam plugin

    Show Instructions

    To install the Anti-Spam plugin, go to your WordPress admin panel → Plugins → Add New.

    forminator-spam-protection

    Then enter «СleanTalk» in the search box and click the Install button for «Spam protection, Anti-Spam, FireWall by CleanTalk».

    testing-forminator-spam-protection

    After installing the plugin, click the «Activate»‎ button.

    testing-forminator-spam-protection

    After it is done go to the plugin settings and click the «Get Access Key Automatically» button. Then just click the «Save Settings»‎ button.

    forminator-spam-protection

    That’s it! From now you know how to completely protect your HivePress from spam.

    Check if spam protection works with Formidable Forms

    The easiest way to test the setup is to use the CleanTalk test email:

    stop_email@example.com

    Use this method:Open a page with your Formidable form in an Incognito or Private browser window.

    1. Fill out the form.
    2. Use stop_email@example.com as the sender email.
    Screenshot 2026 03 21 at 19.48.18

    4. Submit the form.

    5. You should see a blocking message from the Anti-Spam plugin instead of a successful submission.

    Screenshot 2026 03 21 at 22.21.13

    If that happens, the protection is working correctly and your Formidable form is already filtering known spam submissions.

    Cloud Dashboard

    In addition, the CleanTalk Cloud Dashboard gives you more visibility into what is happening with submissions processed through the anti-spam service.

    For Formidable Forms websites, this is useful because it helps you review not only whether a submission was blocked, but also why it was blocked.

    In the dashboard, you can usually find details such as:

    • sender IP and email,
    • geolocation of the sender,
    • date and time of the submission,
    • page URL where the form was submitted,
    • cloud decision – Approved or Denied,
    • explanation for the decision,
    • tools to move the sender to Allow or Block lists.

    This is especially helpful if the site receives repeated attacks, recurring junk leads, or suspicious activity from the same sources.

    Built-in Spam Protection in Formidable Forms

    Besides CleanTalk, Formidable Forms itself can be used with built-in anti-spam measures and additional anti-abuse checks.

    These are useful, but in most real-world cases they work best as secondary protection, not as the only defense.

    Honeypot protection

    A honeypot is one of the simplest anti-spam methods. It adds hidden fields that real visitors do not interact with, but simple bots often fill automatically. When that happens, the submission can be rejected.

    Why honeypot is useful:

    • it is invisible to legitimate users,
    • it creates no extra friction,
    • it catches primitive bots efficiently.

    Why it is not enough on its own:

    • more advanced bots can bypass it,
    • it does not handle every case of fake leads or manual spam,
    • it is better as a supporting layer than as a full anti-spam strategy.

    That is why honeypot is a good addition, but not a complete replacement for a broader spam filter.

    Native anti-spam and validation options

    Form builders often include basic anti-abuse logic, validation rules, and submission checks. These can help reduce low-quality automated submissions and obvious junk entries.

    However, built-in checks are usually narrower than a dedicated anti-spam service. They may stop some bot patterns, but they do not always provide broader reputation analysis, behavior-based filtering, or cloud-level spam intelligence.

    For that reason, a layered setup works better: use Formidable’s own checks where appropriate, but keep CleanTalk as the main filter working in the background.

    reCAPTCHA, hCaptcha, and Cloudflare Turnstile for Formidable Forms

    Another common question is whether CAPTCHA should be used together with Formidable Forms.

    The answer is: yes, sometimes – but not as the only protection layer.

    CAPTCHA-style tools are most useful for higher-risk forms, such as:

    • registration forms,
    • quote request forms,
    • lead generation landing pages,
    • public surveys,
    • pages that receive repeated bot attacks.

    Google reCAPTCHA

    Google reCAPTCHA is one of the best-known anti-bot tools. It can reduce obvious automated abuse, but it also has downsides:

    • it may interrupt the user experience,
    • it can lower form completion rates,
    • some spam still passes through,
    • it does not replace a complete anti-spam strategy.

    So reCAPTCHA can help, but it should not replace your main spam filter.

    hCaptcha

    hCaptcha is often chosen by site owners who want an alternative to Google-based services. It can be useful as an additional challenge layer for forms that receive repeated automated abuse.

    Its role in a Formidable setup is simple: increase resistance on risky forms while CleanTalk continues filtering quietly in the background.

    Cloudflare Turnstile

    Cloudflare Turnstile is a more modern alternative that often works with less visible friction than classic CAPTCHA challenges. For websites that want extra bot protection with a lighter user experience, it can be a strong second layer.

    But the same principle still applies:

    Do not rely on Turnstile alone.
    Use it together with CleanTalk, not instead of CleanTalk.

    Akismet and other third-party anti-spam plugins

    There are also other WordPress anti-spam solutions that site owners may consider.

    Akismet

    Akismet is well known in the WordPress ecosystem and is often used for comments and basic spam filtering. On a Formidable-based website, it may help with broader site-level anti-spam needs outside the form workflow itself.

    But for a forms-heavy website, Akismet is usually better treated as a supporting layer rather than the core Formidable spam protection strategy.

    Other universal anti-spam plugins

    Some website owners also try solutions such as:

    • WP Armour,
    • OOPSpam,
    • Maspik,
    • honeypot plugins,
    • CAPTCHA-focused plugins.

    These can be useful in specific projects, especially if a website has unusual traffic patterns or several different plugins handling different submission points.

    At the same time, using too many overlapping anti-spam plugins can also create conflicts, duplicate filtering, false positives, or an unnecessarily complicated admin workflow.

    That is why the cleaner approach is usually better:

    one primary spam filter, one optional CAPTCHA layer, and extra tools only where they solve a clear problem.

    Frequently Asked Questions

    Why am I still getting fake submissions in Formidable Forms after enabling spam protection?

    Spam protection blocks most automated junk, but not every unwanted lead is a classic bot submission. Some low-quality entries may be submitted manually or by more advanced automated methods. In that situation, the best fix is layered protection: keep CleanTalk as the main background filter and add CAPTCHA or Turnstile only to the forms that receive repeated abuse.

    Can CleanTalk protect all Formidable Forms or do I need to configure each form separately?

    In most cases, CleanTalk starts checking form submissions after installation and activation, so you do not need to rebuild every Formidable form manually. That makes it convenient for websites with multiple contact forms, quote request forms, survey forms, and registration pages.

    Should I use CAPTCHA together with CleanTalk for Formidable Forms?

    For many standard contact forms, CleanTalk alone is enough. But if a site runs registration forms, quote pages, paid-traffic landing pages, or other high-risk forms, adding reCAPTCHA, hCaptcha, or Cloudflare Turnstile as a second layer is a good idea.

    What types of Formidable forms attract the most spam?

    The most common targets are contact forms, lead generation forms, quote request forms, registration forms, and surveys on public pages. These forms are easy for bots to discover and usually contain clear fields that can be abused at scale.

    How can I check whether CleanTalk is actually blocking Formidable spam?

    The simplest test is to open your Formidable form in an Incognito window and submit it using stop_email@example.com. If CleanTalk is working correctly, the form submission should be blocked and a spam warning should appear.

    Why would a legitimate Formidable form submission be blocked as spam?

    Occasional false positives can happen with any anti-spam system. This may be caused by unusual sender behavior, shared networks, VPN use, aggressive browser settings, or plugin conflicts. If needed, review the event in the CleanTalk dashboard and move trusted senders to the allow list.

    What is the best anti-spam setup for contact, quote, and registration forms built with Formidable?

    For most websites, the best setup is CleanTalk as the main spam filter, Formidable’s built-in checks or honeypot as a lightweight extra layer, and CAPTCHA only on the forms with the highest spam risk. This keeps the user experience smoother than forcing challenge-based verification everywhere.

    Why are my Formidable form notifications landing in spam folders even when submissions are blocked correctly?

    This usually points to an email delivery issue rather than a form filtering problem. If form notifications go to spam, configure SMTP for the WordPress site, avoid relying on the default PHP mail function, and make sure the sending domain has valid SPF, DKIM, and DMARC records.

    Recommended Anti-Spam Stack for Formidable Forms 

    No single anti-spam method stops every type of spam. The most reliable approach is a layered anti-spam stack, where each layer deals with a different category of abuse.

    Small business website with a contact form

    Recommended setup:

    • CleanTalk Anti-Spam as the main protection,
    • optional honeypot or built-in checks,
    • occasional dashboard review if spam appears.

    That is usually enough for a simple business website with normal traffic.

    Lead generation, quote request, survey, or registration forms

    Recommended setup:

    • CleanTalk Anti-Spam as the main protection,
    • honeypot or built-in validation as an extra layer,
    • reCAPTCHA, hCaptcha, or Turnstile on the most attacked forms.

    This setup gives better resistance against recurring bot attacks and fake leads.

    High-traffic or high-risk forms

    Recommended setup:

    • CleanTalk Anti-Spam as the main protection,
    • CAPTCHA or Turnstile on targeted forms,
    • allow/block list tuning in the dashboard,
    • checks for plugin conflicts,
    • SMTP configuration for reliable email notifications.

    This is the best option for websites that actively attract spam traffic.

    Final thoughts

    If you are trying to stop Formidable Forms spam in WordPress, the most effective approach is not to rely on one tool alone.

    A reliable setup usually looks like this:

    • CleanTalk as the main background spam filter,
    • honeypot or built-in checks as lightweight support,
    • reCAPTCHA, hCaptcha, or Turnstile only where additional verification is needed,
    • dashboard monitoring and personal lists for fine-tuning.

    That combination helps reduce fake submissions, keeps the form experience cleaner for real users, and gives you more control when spam patterns change over time.

    Stop Formidable Forms spam without frustrating your visitors

    Create your CleanTalk account and start blocking spam form submissions, fake registrations, survey spam, quiz abuse, and junk leads — no CAPTCHA challenges and no impact on real visitors.

    CleanTalk Account

    No credit card required • Setup takes less than a minute • Your temporary password will be sent by email.

  • CleanTalk Releases version 1.6. Update for the MyBB Anti-Spam Plugin

    CleanTalk Releases version 1.6. Update for the MyBB Anti-Spam Plugin

    Blue And White Modern Website Development Service Facebook Ad

    We’ve published a new update for AntiSpam by CleanTalk for MyBB. This release includes one targeted Fix: Anti-Spam. Rotating moderate disabled.

    The update was published in response to a request from the MyBB community. For this integration, new releases are published when there is a clear maintenance need or a specific issue to resolve. In this case, the new version addresses a reported anti-spam-related issue and improves the reliability of the plugin for MyBB forum administrators.

    This version is a focused maintenance release that solves a real problem and helps keep spam protection stable for forums using CleanTalk to protect registrations and user activity. Thank you to the MyBB community for the feedback and continued trust in CleanTalk.

  • HivePress Spam Protection in 2026

    HivePress Spam Protection in 2026

    If you use HivePress to power a directory, classifieds, or marketplace website, you will eventually face spam – fake listings, bot registrations, and junk messages.

    This guide explains how to set up HivePress spam protection using:

    • the Anti-Spam plugin by CleanTalk with direct integration for HivePress, and
    • additional tools like Google reCAPTCHA and basic moderation.

    The integration now protects both:

    • the registration form of HivePress (requests to /wp-json/hivepress/v1/users/), and
    • the Add Listing form used to submit new listings.
    hivepress logo

    HivePress – Business Directory & Classified Ads Plugin

    First, let’s take a quick look at HivePress itself and the types of sites you can build with it.

    HivePress is a free and highly flexible WordPress plugin for building any type of directory or listing website: business directory, job board, classifieds, real estate catalog, rental marketplace, and more.

    Out of the box HivePress provides:

    • listing types, categories and custom fields;
    • powerful search filters and location-based search;
    • user accounts, ratings, reviews, private messages and favorites.

    Because HivePress relies heavily on user-generated content and public forms, it quickly becomes a target for spambots. That’s why it is important to have a reliable HivePress spam protection setup from the beginning.

    As WordPress.org shows, HivePress is currently used on over 10,000 websites and has 213 user reviews with an average rating of 4.9.

    Plugin Homepage at wordpress.org | Website hivepress.io


    Install HivePress to build business directories, classifieds, marketplaces and other listing websites.

    You can set it up in just a few easy steps:

    1. Search for the plugin in WordPress console -> Plugins -> Add plugin -> Search -> Type ‘hivepress‘

    Untitled design

    2. Install and Activate the plugin.

    3. Add the very first listing in WordPress console -> Listings -> Add New.

    Untitled design (2)

    WordPress console -> Listings -> Add New -> add title, description, images and other fields -> Publish.

    4. That’s all! Your first listing is live and HivePress is ready to use on your site.

    Anti-Spam plugin by CleanTalk for WordPress

    The next tool we’re going to use is the Anti-Spam plugin by CleanTalk.
    Here’s a short overview:

    • CleanTalk is a cloud-based spam protection service for websites, founded in 2012.
    • It automatically blocks spam without CAPTCHAs and doesn’t interrupt the user experience.
    • Protects many types of forms: contact forms, payment forms, registrations, comments, surveys and more.
    • Stops both automated bots and human spam submissions.
    • Uses advanced filtering algorithms and a global spam detection network.
    • Detects spam based on IP address, email address and user behavior.
    • Lets you create custom filtering rules for specific cases.
    • Allows blocking or filtering by IP, email and country.
    • Works quietly in the background and is very easy to install and configure.

    According to WordPress.org, Anti-Spam by CleanTalk for WordPress has over 200,000 active installations, with 3,168 reviews and an average rating of 4.7.

    Plugin Homepage at cleantalk.org | Latest release at GitHub.com | Website cleantalk.org

    Install the CleanTalk Anti-Spam plugin

    Show Instructions

    To install the Anti-Spam plugin, go to your WordPress admin panel → Plugins → Add New.

    forminator-spam-protection

    Then enter «СleanTalk» in the search box and click the Install button for «Spam protection, Anti-Spam, FireWall by CleanTalk».

    testing-forminator-spam-protection

    After installing the plugin, click the «Activate»‎ button.

    testing-forminator-spam-protection

    After it is done go to the plugin settings and click the «Get Access Key Automatically» button. Then just click the «Save Settings»‎ button.

    forminator-spam-protection

    That’s it! From now you know how to completely protect your HivePress from spam.

    Check if spam protection works with HivePress

    The best way to test the spam protection by using a test email,

    stop_email@example.com

    1. Open page with your form (don’t forget to add the shortcode in the page content) in Incognito browser tab.
    2. Fill out the Contact form using stop_email@example.com as sender’s email.
    3. Send the form.
    4. You should see a message from the Anti-Spam plugin confirming that a spam submission was blocked.

    *** Forbidden. Sender blacklisted. Anti-Spam by CleanTalk. ***

    Untitled design (9)
    If you see this message, it means CleanTalk successfully protects your HivePress forms (registration and Add Listing) from spam.

    Cloud Dashboard

    In addition, in the Cloud Dashboard you can find extra details regarding all submissions processed by CleanTalk, including HivePress registration and Add Listing forms:

    • IP and email of the sender, as well as the sender’s activity history across other websites connected to the CleanTalk cloud.
    • Geolocation of the sender.
    • Date and time of the submission.
      Page (URL) where the form was submitted (for example, a specific listing submission page).
    • Cloud decision – Approved or Denied.
    • Cloud explanation for the decision (e.g. blacklisted email, bad IP reputation, spam text, etc.).
    • Tools to move the sender to Block or Allow lists so you can fine-tune HivePress spam protection.

    Google reCAPTCHA, hCaptcha, and Cloudflare Turnstile

    Besides CleanTalk and the built-in HivePress tools, you can also use cloud CAPTCHA / anti-bot services together with HivePress to reduce spam and protect registration and Add Listing forms.

    Google reCAPTCHA (native HivePress integration)

    HivePress has a core integration with Google reCAPTCHA v2:

    • First, register your site in the Google reCAPTCHA admin and generate a Site Key and Secret Key.
    • Then go to WordPress console → HivePress → Settings → Integrations → reCAPTCHA and paste these keys.
    • In the same section you can select which HivePress forms to protect (for example, registration, login, listing submission).

    This helps reduce spam submissions and adds an extra security layer to HivePress forms, while CleanTalk continues to filter all submissions in the background.

    hCaptcha

    HivePress does not currently include native hCaptcha support. However, you can use hCaptcha on your site via separate WordPress plugins (for example, “hCaptcha for Forms and More”) that add hCaptcha to standard WordPress forms and some popular plugins.

    Key benefits of hCaptcha compared to reCAPTCHA:

    • Better privacy for visitors. hCaptcha collects less tracking data and is more focused on privacy and GDPR-friendly use.
    • Reduced dependence on Google services. Useful for projects that prefer not to rely on Google infrastructure for branding or compliance reasons.
    • Optional monetization. hCaptcha offers a program where site owners can earn small rewards for solved challenges, something reCAPTCHA does not provide.

    To use hCaptcha you need to:

    • obtain a Site Key and Secret Key in the hCaptcha dashboard,
    • install and configure the corresponding WordPress plugin,
    • and test that hCaptcha is correctly displayed and working on your HivePress registration and Add Listing forms (since there is no direct HivePress integration yet).

    Cloudflare Turnstile

    Cloudflare Turnstile is a modern CAPTCHA alternative that verifies users mostly in the background, without classic image puzzles.

    Turnstile can be connected to WordPress via dedicated plugins that integrate Turnstile with standard WordPress forms and some third-party plugins.

    Main benefits of Cloudflare Turnstile compared to classic reCAPTCHA:

    • Invisible verification. Turnstile usually works silently in the background, so users can submit forms without extra clicks and image challenges.
    • Higher form completion rates. With fewer interruptions, registration and listing submission forms tend to have fewer abandoned attempts.
    • Strong privacy approach. Turnstile is designed to minimize user tracking and does not rely on heavy behavioral profiling, which makes it more privacy-friendly than traditional CAPTCHA solutions.

    As with hCaptcha, you need to:

    • obtain a Site Key and Secret Key in the Cloudflare Turnstile dashboard,
    • configure the chosen WordPress plugin,
    • and verify that Turnstile is actually applied to the pages where HivePress renders registration or Add Listing forms.

    Honeypot, Akismet and third-party Anti-Spam plugins

    Additionally, let’s consider standalone plugins and anti-spam mechanics that also work for HivePress-based websites.

    Honeypot

    Honeypot is one of the simplest anti-spam mechanics against primitive spam bots. It works by adding hidden fields that are only detected and filled by bots. When a bot fills these fields, the submission is blocked automatically, while legitimate users never see any additional challenges.

    Because no CAPTCHA or interaction is required, honeypots:

    • help maintain a smooth user experience,
    • reduce friction on registration and Add Listing forms,
    • and add a lightweight extra layer of protection.

    You can enable honeypot protection via a dedicated WordPress plugin, for example WP Armour – Honeypot Anti Spam.

    Settings are available in the plugin configuration, for example:

    • WordPress console -> Plugins -> Add New -> Search -> type ‘WP Armour’
    • Install and Activate the plugin.
    • WordPress console -> Settings -> WP Armour (or the plugin’s own menu item) -> enable honeypot protection for the forms used with HivePress (registration / Add Listing pages).

    Effective on March 19th, 2026 users report that WP Armour does not protect or support HivePress. They observe spam subscriptions and accounts. Read more.

    Third-party Anti-Spam plugins

    Akismet

    Akismet Anti-Spam helps WordPress users automatically filter spam submissions by analyzing form data against its global spam detection network. It works in the background to identify suspicious content and prevent unwanted messages from reaching your inbox or database. This reduces manual moderation and helps keep comments and basic contact forms clean.

    For HivePress websites, Akismet can be used together with CleanTalk to:

    • filter blog comments and simple contact forms,
    • reduce low-quality submissions outside of HivePress-specific forms.

    In order to activate protection the user must:

    1. Install and activate the third-party plugin Akismet Anti-Spam.
    2. Get an API key from Akismet and enter it in the plugin settings.
    3. Enable spam checking for the content types you need (comments, contact forms, etc.).

    Typical path:

    • WordPress console -> Plugins -> Add New -> Search -> type ‘Akismet’
    • Install and Activate the plugin.
    • WordPress console -> Settings -> Akismet Anti-Spam -> enter API key and save.

    Other universal Anti-Spam plugins

    OOPSpam, Maspik, and Simple CAPTCHA Alternative are universal anti-spam plugins for WordPress that provide additional spam protection at the site level. They can help filter spam on contact forms, comments and other areas of your site that are not covered directly by HivePress integration.

    All of these solutions can be found in the search results at wordpress.org:

    WordPress console -> Plugins -> Add New -> Search -> type ‘WP Armour’ | ‘OOPSpam’ | ‘Maspik’ | ‘Simple CAPTCHA Alternative’
    Install and Activate the chosen plugin, then configure it according to its documentation.

    These third-party plugins can be used alongside CleanTalk and HivePress as optional extra layers of protection for high-risk or high-traffic projects.

    This guide explains how to protect HivePress forms using the Anti-Spam plugin by CleanTalk together with additional tools such as Google reCAPTCHA, hCaptcha, Cloudflare Turnstile, honeypot mechanisms and third-party anti-spam plugins like Akismet, OOPSpam and Maspik.

    Frequently Asked Questions (FAQ)

    Still getting spam through your HivePress forms?

    If nothing works in this guide, try a few more things:

    1. Block spammers by particular IPs, countries and email masks via Personal lists in your CleanTalk account.
    2. Enable listing moderation in HivePress, so new listings must be approved by an admin before they go live.
    3. Check for plugin conflicts – temporarily disable other anti-spam / security plugins and test HivePress registration and Add Listing forms only with CleanTalk enabled.
    4. Submit a support request to CleanTalk, attaching examples of spam submissions (IPs, emails, message text, page URLs). The support team will do their best to tune spam protection for your specific case.
    reCAPTCHA not saving in HivePs settingress or showing errors

    If reCAPTCHA keys are not saved or you see an error in HivePress → Settings → Integrations → reCAPTCHA:

    1. Make sure you are using the correct key type (usually reCAPTCHA v2 for HivePress).
    2. Double-check that the domain in the Google reCAPTCHA admin exactly matches your site.
    3. Remove any extra spaces when pasting the Site Key and Secret Key.
    4. Try temporarily disabling other CAPTCHA / security plugins and saving the settings again.
    5. If the issue persists, you can switch to an alternative solution such as hCaptcha or Cloudflare Turnstile via a separate WordPress plugin, while keeping CleanTalk as your main spam filter.
    HivePress + hCaptcha / Turnstile does not prevent spam

    If you enabled hCaptcha or Cloudflare Turnstile but spam still comes through:

    1. Do not rely on hCaptcha / Turnstile alone – always keep CleanTalk Anti-Spam enabled as the primary filter.
    2. Enable honeypot protection if it is available in your chosen security / form plugins to catch simple bots.
      Check that there are no plugin conflicts disabling CleanTalk checks or bypassing them.
    3. Use layered protection: CleanTalk + CAPTCHA (reCAPTCHA / hCaptcha / Turnstile) + HivePress moderation usually works much better than any single method.
    Emails from HivePress forms are going to spam.
    1. Check SMTP configuration and avoid sending mail via the default PHP mail() function.
    2. Install and configure an SMTP plugin, so your site sends messages through an authenticated email account (hosting mail, Gmail, or a transactional service).
    3. Verify that your domain has proper SPF / DKIM / DMARC records to improve sender reputation.
    4. After configuring SMTP, send a few test submissions from HivePress forms and confirm that notifications now arrive in the inbox, not in spam.

    Recommended Anti-Spam Stack for HivePress (2026)

    Finally, no single anti-spam tool can stop every type of spam submission. The most reliable approach for HivePress websites is a layered protection stack, where each tool blocks a different category of bots and spam behavior.

    Starting from the latest plugin update, the Anti-Spam plugin by CleanTalk includes a direct integration with HivePress. It automatically protects the HivePress registration form and the Add Listing form before a new user account or listing is created, without any extra settings inside HivePress. This integration is the core of the recommended anti-spam stack below.

    Recommended setup by site type

    Small business directory / local listings

    • CleanTalk Anti-Spam (with direct HivePress integration)
    • Optional honeypot protection in a security/form plugin
    • Basic HivePress listing moderation

    High-traffic classifieds or service marketplace

    • CleanTalk Anti-Spam (with direct HivePress integration)
    • Google reCAPTCHA or Cloudflare Turnstile on registration and Add Listing forms
    • Listing moderation for new or untrusted users

    Membership / registration-heavy HivePress sites

    • CleanTalk Anti-Spam (with direct HivePress integration)
    • Cloudflare Turnstile or hCaptcha on registration and login
    • Optional honeypot protection for additional bot filtering

    By now, most spam issues in your HivePress registration, login and Add Listing forms should be resolved. If not, sign up for a CleanTalk account or log in to your existing one and contact our support team – we will be happy to help you fine-tune spam protection for your specific case.

    Stop spam without frustrating your visitors

    Create your CleanTalk account and start blocking spam forms, surveys, polls and quiz answers — no CAPTCHA challenges and no impact on visitors.

    CleanTalk Account

    No credit card required • Setup takes less than a minute • Your temporary password will be sent by email.

  • Standard WordPress Registration Forms Spam Protection Guide in 2026

    Standard WordPress Registration Forms Spam Protection Guide in 2026

    If your website uses the default WordPress signup flow, spam registrations can become a real problem surprisingly quickly. Bots scan the web for open signup pages, submit fake user data, and fill WordPress sites with junk accounts that never behave like real users.

    For standard WordPress websites, this usually happens through the default registration endpoint. In WordPress core, the registration URL is typically generated through wp_registration_url(), which returns wp-login.php?action=register. The Register link is shown when public registration is enabled.

    That is why site owners often search for terms like standard wordpress registration forms spam, default wordpress registration form spam, or stop spam user registration wordpress. They are not looking for a page builder or a form plugin issue. They are trying to stop fake signups on the native WordPress registration flow.

    In this guide, you will learn what the standard WordPress registration form is, why it gets spammed, how to protect it with CleanTalk Anti-Spam, and how to test the protection correctly.

    What is a standard WordPress registration form?

    A standard WordPress registration form is the default signup form managed by WordPress core rather than by a third-party membership or form-builder plugin.

    Standart WP registration form

    On most sites, this registration flow is associated with:

    wp-login.php?action=register

    WordPress developer documentation confirms that wp_registration_url() returns that path. The developer reference for wp_register() also shows that the Register link is only displayed when the site has public user registration enabled.

    image how to allow registration in WP

    So when we talk about standard WordPress registration forms, we mean the built-in WordPress registration flow – not a custom Elementor, WPForms, or membership-plugin form.

    Why standard WordPress registration forms attract spam

    The default WordPress registration page is predictable. It uses a known path, a familiar structure, and is often left open without a dedicated anti-spam layer.

    That combination makes it easy for bots to detect and target. Once they find the registration page, they can create fake subscribers, junk user accounts, throwaway profiles, and low-quality signups at scale.

    This is more than a cosmetic issue. Spam registrations can:

    • clutter your user database,
    • waste moderation time,
    • pollute analytics,
    • trigger unwanted email flows,
    • create future abuse risks from fake accounts.

    If your website depends on public registration, protecting this form should be treated as a baseline measure, not as an optional improvement.

    How to protect standard WordPress registration forms from spam

    One of the simplest ways to protect the default WordPress registration form is to use CleanTalk Anti-Spam for WordPress.

    The official WordPress.org plugin page says the plugin stops spam registrations, and the current plugin listing shows 200,000+ active installations.

    CleanTalk is built to filter spam in the background instead of forcing every visitor through visible CAPTCHA friction. That matters because public registration is often part of your growth flow, and every extra barrier can reduce the number of legitimate signups.

    How to install CleanTalk Anti-Spam for WordPress

    To install the Anti-Spam plugin, go to your WordPress admin panel→ Plugins→ Add New.

    image

    Then enter «СleanTalk» in the search box and click the Install button for «Spam protection, Anti-Spam, FireWall by CleanTalk».

    image

    After installing the plugin, click the «Activate»‎ button.

    image

    After it is done go to the plugin settings and click the «Get Access Key Automatically» button. Then just click the «Save Settings»‎ button.

    image

    CleanTalk’s current and older guides follow this same setup logic: install the plugin, activate it, connect it, and then let it start protecting supported forms on the site.

    How to test that spam protection works

    When testing form protection, do not test it while logged in as a WordPress administrator. CleanTalk documentation explicitly notes that administrator actions are not checked, so testing should be done as a regular visitor in Incognito or Private mode.

    Use this process:

    Open the registration page in an Incognito or Private browser tab.

    Fill in the required form fields.

    spam protection check first step

    Use the test email address stop_email@example.com.

    Submit the form.

    spam protection check result

    The current CleanTalk help page and the WordPress.org plugin FAQ both use stop_email@example.com as the test email for comments, contacts, registrations, and signups. If the protection is active, the test submission should be blocked.

    Why this approach is good for conversion

    Many site owners try to stop spam registrations by adding visible obstacles to the signup flow. Sometimes that helps, but it can also make legitimate visitors drop off before completing registration.

    A background anti-spam solution is often a better fit when registration is part of the site’s business funnel. It helps reduce fake signups without making real users solve extra challenges every time they want to create an account.

    For websites that depend on community growth, lead capture, onboarding, or member access, keeping the registration form simple is almost as important as keeping it protected.

    How to know whether the default WordPress form is still being abused

    Some websites use a custom registration plugin but still leave the default WordPress registration path available.

    That creates a hidden problem: the visible custom signup flow may look protected, while bots continue to register through the original WordPress endpoint.

    If you suspect that, review your registration sources and check whether the default WordPress registration screen is still enabled. If your custom plugin fully replaces the standard flow, it is often wise to protect the custom form and disable the unused default registration route.

    Using a custom registration plugin instead?

    If your website uses User Registration & Membership by WPEverest instead of the default WordPress registration form, use the dedicated CleanTalk guide for that plugin:

    User Registration & Membership spam protection guide
    /user-registration-forms-spam-protection-for-wordpress/

    This internal link is useful both for readers and for SEO, because it clearly separates two close but different intents:

    • default WordPress registration spam,
    • spam on a specific registration plugin.

    Final thoughts

    If public registration is enabled on your site, the standard WordPress registration form should not be left unprotected.

    WordPress core makes the registration path predictable, and bots actively exploit predictable signup flows. CleanTalk’s WordPress plugin is built to stop spam registrations and is already widely used across WordPress sites.

    If your goal is to reduce fake signups without making registration harder for real users, start by protecting the default WordPress registration form, testing it properly in Incognito mode, and closing any unused registration paths that may still be exposed.

    Start protecting your registration forms with CleanTalk Anti-Spam today.

    FAQ

    What is the default WordPress registration URL?

    By default, WordPress returns the registration URL through wp_registration_url(), which points to wp-login.php?action=register.

    When does WordPress show the Register link?

    The Register link is shown when public registration is enabled through the Anyone can register setting.

    Does CleanTalk protect registration forms?

    Yes. The official WordPress.org page for the CleanTalk plugin says it stops spam registrations.

    How do I test the anti-spam protection?

    Test as a logged-out visitor in an Incognito or Private tab and use stop_email@example.com. That test address is documented in current CleanTalk help and in the WordPress.org plugin FAQ.

    What if I use a custom registration plugin instead of the default WordPress form?

    Then it is better to use a plugin-specific guide and make sure the default WordPress registration endpoint is not still open if you no longer need it. The CleanTalk blog already has a dedicated guide for User Registration & Membership.

    Stop spam on standard WordPress registration forms

    Create your CleanTalk account and protect the default WordPress registration form from fake signups and bot registrations. Keep registration simple for real users while extending protection across comments, contact forms, and other WordPress forms.

    CleanTalk Account

    No credit card required • Setup takes less than a minute • Your temporary password will be sent by email.

  • How Much Server Resources Spam Bots Waste

    How Much Server Resources Spam Bots Waste

    When you look at your hosting invoice, you see CPU, RAM, disk and traffic.
    What you don’t see is the hidden line:

    How much of this is spent on spam bots instead of real users.

    Today a big part of web traffic is no longer human. Bad bots:

    • try to register fake accounts,
    • submit spam through forms and comments,
    • hit login, XML-RPC and admin URLs thousands of times a day.

    For your server, each of these bots looks like a normal visitor:

    • PHP runs,
    • WordPress and plugins load,
    • the database is queried,
    • logs and backups grow.

    From a business point of view, this is pure waste:
    you pay for server resources that serve traffic which will never become a customer, lead or subscriber.

    We can see the scale of this problem very clearly in CleanTalk’s own network.

    2025-2026 Spam statistics across CleanTalk's products.
    Source https://cleantalk.org/spam-stats
    • the Anti-Spam layer processed about 91-220 million spam events per month at the application level,
    • while SpamFireWall filtered 560-740 million suspicious requests per month before they reached websites – and in May 2025 it blocked more than 11 billion requests in a single month.

    In total for that period, SpamFireWall handled many times more bad requests than the Anti-Spam checks inside forms and registrations. This is exactly what “reduce server load bots create” means in practice: most of the dirty work is done in the cloud, so your own servers stay free for real visitors.

    In this article, we’ll look at:

    • how spam bots translate into real server and hosting costs,
    • why blocking spam only inside WordPress is not enough if you care about performance and budget,
    • and how CleanTalk SpamFireWall uses cloud filtering to cut bot load before it ever reaches your infrastructure.

    The goal is simple:
    to show spam not only as “junk content”, but as a financial line item, and to explain how CleanTalk helps you shrink that line without changing your whole tech stack.

    2. Problem: Why Spam Bots Are Expensive, Not Just Annoying

    Most teams think of spam bots as a nuisance: fake sign-ups, junk messages, useless comments.

    From a business perspective, they’re something else entirely:

    Spam bots quietly burn real server resources that you pay for – and they never become customers.

    Every spam bot request looks “normal” to your infrastructure:

    • it opens a connection to your server,
    • starts PHP or your application runtime,
    • loads WordPress and all active plugins,
    • may trigger database and cache queries,
    • writes another line into your logs and backups.

    Technically, that bot request costs almost the same as a real visitor.
    The only difference is outcome: there is zero chance it turns into revenue.

    That’s the core of the spam bots server cost problem.

    2.1. Direct server and hosting cost

    If a noticeable share of your traffic is bots – and for many sites it is 20-30% or more – then the same share of your infrastructure is effectively reserved for non-humans:

    • CPU cycles are spent executing code for scripts, not people.
    • RAM is used to keep processes alive for fake sessions.
    • Disk I/O and storage are consumed by logs and backups of bot traffic.

    The result:

    • you hit resource limits earlier,
    • you upgrade hosting plans sooner,
    • you pay for bigger servers than your real audience actually needs.

    This is the hidden spam bots server cost: part of your hosting budget that works only to serve automated garbage traffic.

    2.2. Performance and user experience

    Bots don’t stand in a separate queue. They compete with your real users for the same pool of workers and database connections.

    When a wave of bots hits:

    • pages start loading slower,
    • login, registration and checkout become less responsive,
    • time-outs and 5xx errors appear at the worst possible moment – usually when you run campaigns or receive organic peaks.

    From a business angle, this shows up as:

    • lower conversion rates,
    • worse campaign performance,
    • and the wrong diagnosis: “we need UX changes” or “ads are not working”,
      when the real problem is that servers are busy talking to bots.

    2.3. Security and operational noise

    Bad bots are also responsible for a lot of “background noise” in security and operations:

    • endless login attempts and password guessing,
    • automated vulnerability scans,
    • repeated hits to admin and system URLs.

    Even if these attempts fail, they still generate:

    • alerts and tickets,
    • time spent investigating suspicious spikes,
    • extra rules and manual blocks.

    Your security and DevOps teams pay the cost in attention and hours, rather than focusing on real incidents and product reliability.

    2.4. Dirty analytics and poor decisions

    Finally, spam bots compromise the quality of your data:

    • they inflate visits and page views,
    • distort geography and device statistics,
    • pollute funnels and conversion metrics.

    Marketing and product teams then make decisions based on a dataset where a significant part is not human:

    • overestimating interest from certain regions,
    • underestimating the true conversion rate of real users,
    • misjudging which channels are actually working.

    In short, spam bots are not just about “ugly comments” or “annoying sign-ups”. They are:

    • extra percentage points on your hosting bill,
    • slower pages for real customers,
    • more noise for your security and ops teams,
    • and less reliable analytics for management.

    The rest of this article will show how a cloud filter like CleanTalk SpamFireWall helps reduce server load bots create, so your infrastructure, teams and budget are focused on real visitors instead of scripts.

    3. Data: What CleanTalk Sees in Real Traffic

    Before we talk about solutions, it’s worth asking a simple question:

    “Is this really a big enough problem to care about, or just a few spam submissions a day?”

    CleanTalk’s own network data gives a very clear answer.

    Across thousands of protected websites, CleanTalk records every spam event and firewall block. Between April 2025 and February 2026, the platform processed:

    • Anti-Spam (forms, registrations, comments): from ~86-220 million spam events per month
    • SpamFireWall (cloud filtering): from ~566-825 million suspicious requests per month
    • With a spike in May 2025, when SpamFireWall blocked more than 11 billion requests in a single month.

    In other words: for every batch of spam you see at the application level, there is a much larger wave of bot traffic that can be stopped earlier – in the cloud.

    3.1. Cloud firewall vs in-app spam checks

    Looking at the monthly report:

    • February 2026:
      • Anti-Spam: 91,136,173 events
      • SpamFireWall: 738,199,535 events
    • November 2025:
      • Anti-Spam: 92,113,219
      • SpamFireWall: 721,915,379

    A typical pattern emerges:

    SpamFireWall consistently handles 6-8× more bad requests than the Anti-Spam layer inside forms.

    That means the bulk of hostile or useless traffic never needs to reach PHP, WordPress, or your database at all – as long as you filter it in the cloud first.

    From a “reduce server load bots” perspective, this is the key point:

    • Anti-Spam removes spam content and fake accounts.
    • SpamFireWall removes a huge amount of bot load before your server ever has to care.

    3.2. Billions of requests that never hit customers’ servers

    The May 2025 numbers are a good illustration of scale:

    • Anti-Spam processed 108,609,819 spam events.
    • SpamFireWall blocked 11,001,687,601 requests in the cloud.

    That’s not a rounding error or a minor optimisation. It’s roughly:

    • 100+ million visible spam attempts vs
    • 11 billion blocked at the edge.

    Put differently:

    For every spam submission cleaned up inside a form, there were hundreds of bot requests that could have reached customer servers – but didn’t.

    Those 11 billion requests represent CPU, RAM, I/O and bandwidth that CleanTalk’s cloud absorbed instead of the websites themselves. That’s exactly the “spam bots server cost” that can be shifted away from your own infrastructure.

    3.3. A global problem, not a local glitch

    The same report also shows where spam is coming from. Between April 2025 and February 2026, the top sources of spam traffic in the CleanTalk network were:

    1. United States – 269,351,056 events (24.19%)
    2. Netherlands – 150,566,461 (13.52%)
    3. Germany – 66,958,677 (6.01%)
    4. Russian Federation – 46,137,396 (4.14%)
    5. Brazil – 40,897,099 (3.67%)
    6. China – 40,769,672 (3.66%)
      … and so on.

    This reinforces an important message for decision-makers:

    • spam and bad bots are not an edge case or a local phenomenon,
    • they are a predictable, measurable part of global traffic patterns,
    • and they will appear on almost any public-facing site as soon as it has real traffic.

    Seen through this lens, spam bots server cost stops being an abstract risk and becomes a very concrete, quantifiable component of your infrastructure spend – one that a cloud filter like CleanTalk SpamFireWall can directly reduce.

    4. How Spam Bots Turn into Hosting and Performance Costs

    By this point, it’s clear that bots generate a lot of traffic.
    The next question is simple: where exactly does this show up in your P&L and SLAs?

    Spam bots don’t come with a separate invoice.
    Instead, their cost is spread across four areas: infrastructure, performance, security, and data.

    4.1. Infrastructure: paying to serve non-customers

    Every extra request from a bot pushes your infrastructure a little closer to its limits:

    • CPU – executing PHP, WordPress and plugin code for non-human traffic,
    • RAM – keeping processes and connections alive for fake sessions,
    • Disk & I/O – writing access logs, error logs and larger backups,
    • Bandwidth – sending responses that no human ever sees.

    If 20-30% of your HTTP requests are bots, then 20-30% of your:

    • provisioned CPU capacity,
    • memory headroom,
    • and outbound traffic

    is effectively reserved for traffic that cannot convert.

    In practical terms, this means:

    • upgrading to a higher hosting plan “because we’re hitting limits”,
    • moving to larger VPS/instances earlier than necessary,
    • keeping a bigger performance buffer “just in case” – and feeding a lot of it to bots.

    That is your spam bots server cost in its purest form:
    the part of your hosting bill that exists only because scripts keep knocking on your door.

    4.2. Performance: bots competing with real users

    Infrastructure cost is only half the story. The other half is user experience.

    Bots don’t politely wait until your real customers are finished. They hit:

    • login and registration endpoints,
    • search and listing pages,
    • checkout and contact forms,

    using the same worker pool and the same database connections as humans.

    The result:

    • CPU spikes during bot waves lead to slower page loads,
    • application queues fill up, leading to higher TTFB,
    • at peak moments (campaigns, product launches, seasonal traffic),
      real users experience timeouts, 5xx errors or just “feels slow”.

    From a business perspective, this translates into:

    • lower conversion rates on key funnels,
    • underperforming ad campaigns,
    • higher cost per acquisition – not because your marketing is bad,
      but because servers are busy serving bots instead of buyers.

    If your goal is to reduce server load bots generate, this is exactly the performance win you’re aiming for:
    freeing capacity so that real users always get a fast, stable experience.

    4.3. Security and operations: constant background noise

    Many of the bots hitting your site are not just spammers, they’re also:

    • brute-forcing passwords,
    • probing for outdated plugins and known CVEs,
    • crawling admin and system URLs looking for weak points.

    Even when they fail, they still create work:

    • alerts in monitoring tools,
    • tickets for the security or DevOps team,
    • time spent investigating suspicious IPs and traffic spikes,
    • manual IP blocks and ad-hoc firewall rules.

    None of this creates value for customers.
    It’s necessary defensive work caused by traffic that should ideally never reach your application in the first place.

    By blocking a large share of this traffic in the cloud, you don’t just protect the server – you also reduce the operational noise your teams have to deal with.

    4.4. Analytics: dirty data, weaker decisions

    Finally, spam bots quietly damage something very important for business: data quality.

    If bot traffic is not filtered properly, it will:

    • inflate visits and page views,
    • distort geography and device breakdowns,
    • pollute funnels with sessions that never had a chance to convert,
    • drag down apparent conversion rates (“lots of traffic, few sign-ups”).

    This leads to bad second-order effects:

    • marketing invests more into audiences and regions with heavy bot presence,
    • channels are misjudged (“this campaign sends junk”, when the junk is bots),
    • product and growth decisions are made on metrics that don’t represent real users.

    Reducing bot load at the edge gives you cleaner numbers:

    • fewer fake sessions,
    • more realistic conversion rates,
    • better signal on which channels, markets and campaigns actually work.

    Put together, this is why spam bots are more than “just annoying”:

    • they drive up your infrastructure spend,
    • reduce performance and conversion for real customers,
    • increase security and operations overhead,
    • and weaken the analytics you use to run the business.

    The next step is to treat this as an architectural issue, not a form-field issue – and that’s where a cloud layer like CleanTalk SpamFireWall comes in as a tool specifically designed to cut this spam bots server cost before it reaches your servers.

    5. Why CAPTCHAs and In-App Filters Don’t Reduce Server Load

    At this point many teams say:

    “We already use CAPTCHA and an anti-spam plugin. Aren’t we covered?”

    You are covered against visible spam – fake comments, junk sign-ups, trash in your inbox.
    You are not covered against the server cost of bots.

    The reason is simple: most traditional anti-spam and security tools work inside your application, not before it.

    5.1. What actually happens with in-app spam protection

    Let’s take a typical WordPress setup:

    • A bot submits a registration or contact form.
    • The request reaches your web server.
    • PHP starts.
    • WordPress loads core, theme and all active plugins.
    • Your anti-spam plugin (or CAPTCHA) finally checks the request and says:
      “This is spam, block it.”

    Yes, you successfully blocked the spam submission.
    But from a server perspective, the heavy work has already happened:

    • CPU cycles were spent loading WordPress and running plugin code.
    • RAM was allocated for the request.
    • Logs were written, backups grew.

    In other words:

    In-app filters protect your content and users,
    but they do not reduce the server load bots generate.

    You have solved the “we don’t want spam in our interface” problem,
    but not the “we don’t want to pay for serving bots” problem.

    5.2. Why this matters more as bot traffic grows

    When bots were rare, this distinction didn’t matter much.
    With bots now representing a third of global traffic, it matters a lot.

    If 20-30% of your requests are bots, and every one of them:

    • boots your app stack,
    • touches your database,
    • sits in the same queues as real users,

    then you are paying a real, recurring spam bots server cost, even if your forms are “clean”.

    Symptoms you may already see:

    • “We keep hitting CPU or I/O limits, even though human traffic hasn’t grown that much.”
    • “The site slows down under spikes that don’t match our campaigns.”
    • “We had to upgrade hosting but didn’t see a proportional improvement in business KPIs.”

    That’s what “blocking too late” looks like.

    5.3. The architectural shift: from “inside the app” to “before the app”

    Big infrastructure players talk a lot about moving protection to the edge:

    • decisions are made as close as possible to the source of traffic,
    • bad requests are dropped before they consume origin resources.

    The same idea applies here, but with a focus on spam and bad bots.

    To actually reduce server load bots create, you need a layer that:

    • sees the request before WordPress, PHP or your framework do,
    • can make a fast decision based on IP, reputation and technical signals,
    • and, if it’s a known bad actor, stops the request right there.

    No PHP.
    No WordPress.
    No database query.
    No extra log entry on your side.

    Only after this cloud filter says “yes”, does the request reach your application, where in-app anti-spam can handle the remaining edge cases (new bots, human spammers, borderline content).

    That’s the architectural gap that CleanTalk SpamFireWall is designed to fill for CMS-driven sites.

    5.4. How CleanTalk is different from “just another CAPTCHA”

    So where does CleanTalk sit compared to CAPTCHAs and typical form plugins?

    Minimal Black White Comparison Chart Table Graph

    You can think of it this way:

    • CAPTCHA protects forms.
    • Anti-Spam protects data and user base.
    • SpamFireWall protects your resources – CPU, RAM, bandwidth, and the time of your teams.

    All three have their place. But if your goal is not only “have less spam”, but also “pay less and perform better under load”, you need something that works before your application – not only inside it.

    In the next section, we’ll look more closely at how SpamFireWall’s cloud filtering actually works and how it translates into fewer bot requests hitting your servers in day-to-day operation.

    6. Solution: CleanTalk SpamFireWall (Cloud Filtering)

    If the problem is that bots consume server resources before your application can stop them,
    the solution has to start before your application too.

    That’s exactly what CleanTalk’s SpamFireWall is designed to do.

    Instead of fighting spam bots only inside WordPress or your CMS, CleanTalk adds a cloud filtering layer in front of your site. The goal is simple:

    Block as many spam/bad bots as possible in the cloud,  so your servers spend their time on real users, not scripts.

    In business language: it’s a way to reduce server load bots create and shrink your spam bots server cost without rebuilding your infrastructure.

    6.1. Two layers working together: cloud + application

    CleanTalk doesn’t replace in-app filters – it adds a second layer in front of them.

    1. SpamFireWall – cloud layer
      • Checks incoming IPs and technical signals against CleanTalk’s global spam and attack database.
      • Blocks known spam bots, brute-force tools and abusive scanners before they reach your server.
      • Offloads a large volume of hostile and useless traffic to the cloud.
    2. Anti-Spam – application layer
      • Runs inside WordPress / your CMS.
      • Analyzes actual form submissions (comments, registrations, contact forms, directory listings, etc.).
      • Blocks spam content, fake accounts and “fresh” spam that can’t be recognized by IP alone.

    Together they form a pipeline:

    Internet → SpamFireWall (CleanTalk cloud) → your server → WordPress / CMS → Anti-Spam → forms & users

    For a significant share of bot traffic, the journey ends at SpamFireWall – and that’s where your savings start.

    6.2. What happens when a visitor (or bot) hits your site

    At a high level, each request goes through three decisions:

    1. Cloud check (SpamFireWall)
      • The visitor’s IP and other technical signals are checked in the CleanTalk cloud.
      • If it matches known spam, attack or abuse patterns, the request is blocked at once.
      • Your web server, PHP and database don’t have to do any work for it.
    2. Application check (Anti-Spam)
      • If the cloud layer allows the request, it reaches your site as usual.
      • When the visitor submits a form (sign-up, login, comment, listing, contact, etc.), that submission is checked by CleanTalk’s Anti-Spam logic.
      • Suspicious content is blocked; clean submissions go through.
    3. Logging and visibility
      • Both layers record what they did in your CleanTalk dashboard:
        • how many requests SpamFireWall blocked,
        • how many spam submissions Anti-Spam stopped,
        • where spam and bots are coming from.

    The key architectural shift:

    • Instead of letting every bot request hit WordPress and then deciding “this is spam”,
    • CleanTalk moves a big part of that decision upstream, into the cloud.

    6.3. What this means in practice for server load

    From a business viewpoint, you don’t buy SpamFireWall just to say “we have another security tool”.
    You buy it to change the shape of your traffic:

    • Fewer bot requests reach your origin.
    • Fewer PHP workers are tied up by bots.
    • Fewer database queries are caused by fake sign-ups and scans.
    • More CPU and memory are available for actual customers.

    In CleanTalk’s own stats between April 2025 and February 2026, SpamFireWall consistently processed several times more bad requests than in-app Anti-Spam checks did – including a month with 11+ billion blocked requests. That is a direct, measurable reduction in spam bots server cost for the sites behind it.

    For you, the expected effects are:

    • More stable performance during traffic peaks and campaigns.
    • Less pressure to upgrade hosting “just to survive bot waves”.
    • Cleaner analytics (fewer fake sessions and non-human hits).
    • Less spam and fewer fake accounts for your team to clean up.

    In short: SpamFireWall turns “bots are just part of the internet now” into “bots are largely CleanTalk’s problem, not our servers’ problem”.

    7. Implementation: How to Deploy CleanTalk SpamFireWall (WordPress Example)

    The good news: you don’t need a new infrastructure project or DNS migration to start reducing bot load.

    For a typical WordPress site, enabling CleanTalk + SpamFireWall is a plugin-level change, not a platform rewrite.

    Below is a simple rollout plan you can hand to your tech person or agency.

    7.1. What you need before you start

    • A working WordPress site (any theme, any hosting).
    • Admin access to the WordPress dashboard.
    • A CleanTalk account (trial or paid) – this is created automatically if you use the “Get Access Key” button.

    That’s it. No DNS changes, no reverse proxies, no extra servers to maintain.

    Step 1 – Install the CleanTalk Anti-Spam plugin

    In the WordPress admin:
    1. Go to Plugins → Add New.

    forminator-spam-protection

    2. To install the Anti-Spam plugin, go to your WordPress admin panel → Plugins → Add New.

    testing-forminator-spam-protection

    3. In the search box, type: cleantalk.

    4. Find “Spam protection, Honeypot, Anti-Spam by CleanTalk”.

    testing-forminator-spam-protection

    Click Install, then Activate.

    Step 2 – Connect plugin to the cloud
    1. Navigate to Settings → Anti-Spam by CleanTalk in the WordPress dashboard.
    forminator-spam-protection

    2. Click “Get Access Key Automatically”.

    WordPress will contact CleanTalk, create/link your account, and insert an Access Key.

    1. Click Save Changes.

    Now:

    • your site can communicate with the CleanTalk cloud,
    • basic Anti-Spam checks for forms and comments are active.
    Step 3 – Make sure SpamFireWall is enabled

    The best way to text the spam protection by using a test email,

    stop_email@example.com

    1. Open page with your form (don’t forget to add the shortcode in the page content) in Incognito browser tab.
    2. Fill out the Contact form using stop_email@example.com as sender’s email.
    3. Send the form.
    4. You should see a message from the Anti-Spam plugin confirming that a spam submission was blocked.

    *** Forbidden. Sender blacklisted. Anti-Spam by CleanTalk. ***

    Spam submission was blocked in contact form by Forminator.
    If you see this message, it means CleanTalk successfully working.

    Cloud Dashboard

    In addition, in the Cloud Dashboard you can find extra details regarding all submissions processed by CleanTalk, including HivePress registration and Add Listing forms:

    • IP and email of the sender, as well as the sender’s activity history across other websites connected to the CleanTalk cloud.
    • Geolocation of the sender.
    • Date and time of the submission.
      Page (URL) where the form was submitted (for example, a specific listing submission page).
    • Cloud decision – Approved or Denied.
    • Cloud explanation for the decision (e.g. blacklisted email, bad IP reputation, spam text, etc.).
    • Tools to move the sender to Block or Allow lists so you can fine-tune HivePress spam protection.

    7.2. What about other CMS and custom sites?

    While this section uses WordPress as the example (because it’s the most common), CleanTalk is not limited to WordPress:

    • There are ready-made integrations for other popular CMS and e-commerce / forum engines.
    • For custom platforms, CleanTalk provides an HTTP API, so your developers can send form data to the cloud and get allow/deny decisions back.

    In practice, this means you can apply the same SpamFireWall + Anti-Spam model across most of your public-facing properties, not just WordPress.

    From an implementation standpoint, that’s all you need:

    • plugin install,
    • access key,
      enable SpamFireWall,
    • watch the numbers.

    The heavy lifting – maintaining IP reputation, filtering billions of bot requests, and absorbing the associated server load – is handled by CleanTalk’s infrastructure, not yours.

    8. Business Takeaways: How to Talk About This Inside Your Company

    By now, spam bots should look less like “IT noise” and more like what they really are:

    A recurring, measurable cost on your infrastructure, performance and data – that you don’t have to fully pay.

    Here’s how to frame this for founders, CTOs and CFOs in clear business language.

    8.1. This is not a plugin decision – it’s a cost decision

    Instead of “Should we install one more plugin?”, the better question is:

    • How much of our server budget goes to bots, not humans?
    • How much of that load can we move from our servers to CleanTalk’s cloud?

    You already pay for:

    • hosting and infrastructure capacity,
    • lost conversions when the site is slow,
    • internal time spent cleaning spam and handling security noise.

    CleanTalk + SpamFireWall simply changes who carries part of that load:

    • fewer spam/bot requests reach your servers,
    • less capacity is wasted on non-customers,
    • more headroom is available for real users.

    8.2. Four sentences you can use with leadership

    You can summarise the whole story in four short statements:

    1. Cost
       “A noticeable share of our server capacity is currently used to serve bots.
      CleanTalk’s SpamFireWall blocks a large part of that traffic in the cloud, so we can either delay upgrades or get more out of our existing hosting.”
    2. Performance & revenue
       “Bots compete with real users for CPU and database connections. Reducing bot load gives us more stable page speed and conversion during campaigns and peak traffic.”
    3. Risk & operations
       “Many brute-force and scanner requests never reach our app if we stop them in the cloud. That means fewer alerts, fewer incidents to check, and more time for real engineering work.”
    4. Data & decision quality
       “Filtering bots earlier gives us cleaner analytics – more accurate funnel numbers, conversion rates and geo data, so we can invest in the right channels and markets.”

    All of that is powered by one practical change: turning on SpamFireWall alongside CleanTalk Anti-Spam.

    8.3. What success looks like

    When this is working, you should see:

    • A clear, growing number of SpamFireWall blocks in the CleanTalk dashboard – these are requests your servers no longer process.
    • More stable CPU and response times during both normal days and marketing peaks.
    • Less manual spam moderation and fewer fake accounts for your team to chase.
    • Analytics that look more like human behaviour and less like random noise.

    You don’t have to guess: before/after numbers from SpamFireWall and your hosting panel will tell you whether your spam bots server cost is going down.

    8.4. The real decision

    The internet will only have more bots, not fewer.
    You can’t change that – but you can choose who pays for their requests.

    • Option A: your own servers, hosting budget and teams.
    • Option B: offload a large part of that work to a cloud service that is built to absorb it.

    CleanTalk’s Anti-Spam plugin plus SpamFireWall is a straightforward way to choose option B:

    • no DNS migration,
    • no new infrastructure to maintain,
    • just a cloud filter that sits in front of your site and lets your servers focus on humans.

    That’s ultimately what this article is about:

    Stop treating spam bots as “just annoying”.
    Start treating them as a cost centre –
    and then deliberately make that cost smaller.

    Stop wasting server resources on spam bots

    Create your CleanTalk account and let SpamFireWall block bad bots in the cloud before they reach your server — no CAPTCHA challenges and no friction for real visitors.

    CleanTalk Account

    No credit card required • Setup takes less than a minute • Your temporary password will be sent by email.

  • WPForms Spam Protection in 2026

    WPForms Spam Protection in 2026

    If you use WPForms for contact forms, lead generation, surveys, or payment forms, you will eventually face spam – fake submissions, junk leads, and bot activity.

    This guide explains how to set up WPForms spam protection using:

    • the Anti-Spam plugin by CleanTalk with a direct integration for WPForms, and
    • additional tools like Google reCAPTCHA, hCaptcha, Cloudflare Turnstile, honeypots and third-party anti-spam plugins.

    The integration protects WPForms forms such as:

    • simple contact forms,
    • marketing and lead forms,
    • “Request a quote” and booking forms,
    • registration / login / newsletter forms (where used with WPForms).

    WPForms continues to handle the form UI and workflow, while CleanTalk filters spam in the background without adding CAPTCHAs to every form.

    image

    WPForms – Easy Form Builder for WordPress

    First, let’s quickly look at WPForms itself and the types of sites that rely on it.

    WPForms is a popular drag-and-drop form builder plugin for WordPress that lets you create:

    • contact and feedback forms,
    • quote and booking forms,
    • newsletter and marketing forms,
    • payment / donation forms (Stripe, PayPal, etc.),
    • surveys, polls, and custom calculators,
    • login, registration, and other application-style forms.

    Out of the box WPForms provides:

    • a visual drag-and-drop builder and 2000+ pre-built form templates,
    • responsive, mobile-friendly layouts,
    • built-in spam protection (anti-spam token and optional honeypot),
    • integrations with major email marketing services and CRMs,
    • payment integrations with Stripe, PayPal, Square, and others.

    Because WPForms forms are often publicly accessible (contact pages, landing pages, sign-up forms), they become an easy target for spam bots and human spammers. That’s why it’s important to have a reliable WPForms spam protection setup from the beginning.

    As WordPress.org shows, WPForms Lite is currently active on over 6 million websites and has 14,274 user reviews with an average rating of 4.8 out of 5.

    Plugin Homepage at wordpress.org | Website wpforms.com

    Install WPForms and create your first form

    You can set up WPForms in just a few steps:
    1. In your WordPress admin go to
      Plugins → Add New and search for “WPForms”.
    image
    1. Click Install and then Activate the plugin.
    2. Customize the fields as needed and click Save.
    3. Embed the form on a page using the WPForms block in the editor or the form shortcode.
    Untitled design (8)

    After that, your first WPForms form is live and ready to accept submissions.

    Anti-Spam plugin by CleanTalk for WordPress

    The next tool we’re going to use is the Anti-Spam plugin by CleanTalk.
    Here’s a brief overview:

    • CleanTalk is a cloud-based spam protection platform for websites, operating since 2012.
    • It filters spam without CAPTCHAs, challenge questions or image puzzles, so visitors don’t have to solve anything extra.
    • It protects many kinds of forms: comments, user registrations, contact forms, orders, subscriptions, surveys, and more.
    • It blocks both automated bots and human spammers using advanced filtering algorithms and data from a global spam database.
    • It detects spam based on IP reputation, email reputation and behavioral patterns.
    • It allows you to set custom rules and block by IP, email address, country or language when needed.
    • It runs quietly in the background, and the plugin is straightforward to install and configure.

    According to WordPress.org, Anti-Spam by CleanTalk for WordPress has over 200,000 active installations, with 3,168 reviews and an average rating of 4.7.

    Plugin Homepage at cleantalk.org | Latest release at GitHub.com

    Install the CleanTalk Anti-Spam plugin

    To install the Anti-Spam plugin, go to your WordPress admin panel → Plugins → Add New.

    forminator-spam-protection

    Then enter «СleanTalk» in the search box and click the Install button for «Spam protection, Anti-Spam, FireWall by CleanTalk».

    testing-forminator-spam-protection

    After installing the plugin, click the «Activate»‎ button.

    testing-forminator-spam-protection

    After it is done go to the plugin settings and click the «Get Access Key Automatically» button. Then just click the «Save Settings»‎ button.

    forminator-spam-protection

    That’s all –  WPForms are now protected From this moment,CleanTalk automatically protects the  WPForms registration form (REST route /wp-json/wpformspress/v1/users/), and the Add Listing form used to submit new listings.

    You don’t need to paste any shortcodes – just use  WPForms as usual, and CleanTalk will filter spam in the background.

    Check if spam protection works with WPforms.

    The best way to text the spam protection by using a test email,

    stop_email@example.com

    1. Open a page with a WPForms (for example, the registration popup or the Add Listing form) in an Incognito / private browser tab.
    2. Fill out the Contact form using stop_email@example.com as sender’s email.
    3. Send the form.
    4. You should see a message from the Anti-Spam plugin confirming that a spam submission was blocked.

    *** Forbidden. Sender blacklisted. Anti-Spam by CleanTalk. ***

    image

    If you see this message, it means CleanTalk successfully protects your WPForms (registration and Add Listing) from spam.

    Cloud Dashboard

    In addition, in the Cloud Dashboard you can find extra details regarding all submissions processed by CleanTalk, including WPForms registration and Add Listing forms:

    • IP and email of the sender, as well as the sender’s activity history across other websites connected to the CleanTalk cloud.
    • Geolocation of the sender.
    • Date and time of the submission.
      Page (URL) where the form was submitted (for example, a specific listing submission page).
    • Cloud decision – Approved or Denied.
    • Cloud explanation for the decision (e.g. blacklisted email, bad IP reputation, spam text, etc.).
    • Tools to move the sender to Block or Allow lists so you can fine-tune  WPForms spam protection.

    Google reCAPTCHA, hCaptcha, and Cloudflare Turnstile in WPForms

    In addition to CleanTalk, WPForms itself supports several CAPTCHA and anti-bot services:

    • Google reCAPTCHA,
    • hCaptcha,
    • Cloudflare Turnstile.

    These services act as a visible or invisible verification layer on top of your forms, while CleanTalk continues to filter spam submissions in the background.

    Google reCAPTCHA (WPForms integration)

    WPForms has built-in support for Google reCAPTCHA (v2 Checkbox, v2 Invisible, and v3):

    1. Register your website in the Google reCAPTCHA admin console and generate a Site Key and Secret Key.
    2. In WordPress go to WPForms → Settings → CAPTCHA.
    3. Choose reCAPTCHA as the provider and paste your keys.
    4. Select which reCAPTCHA type you want to use (checkbox, invisible, or v3 score-based).
    5. Edit your forms and enable reCAPTCHA where needed (WPForms shows a toggle or field depending on the type).

    reCAPTCHA helps block obvious automated submissions by requiring users to solve a challenge or by scoring their behavior, while CleanTalk still checks the content and sender reputation.

    hCaptcha

    WPForms also supports hCaptcha as a privacy-focused alternative to Google reCAPTCHA:

    Key benefits of hCaptcha compared to reCAPTCHA:

    • Stronger focus on privacy – hCaptcha collects less user tracking data, which is important for privacy-oriented and GDPR-sensitive projects.
    • Less dependence on Google – useful for brands that prefer to minimize their reliance on Google infrastructure.
    • Optional monetization options for some hCaptcha plans, which reCAPTCHA doesn’t provide.

    To use hCaptcha with WPForms:

    1. Obtain Site Key and Secret Key from the hCaptcha dashboard.
    2. Go to WPForms → Settings → CAPTCHA, choose hCaptcha and paste the keys.
    3. Enable hCaptcha for the forms you want to protect.

    Cloudflare Turnstile

    Cloudflare Turnstile is a quite modern CAPTCHA alternative that often works invisibly in the background, without classic image puzzles. Several WPForms guides cover how to enable Turnstile as a built-in CAPTCHA provider.

    Benefits of Cloudflare Turnstile:

    • Invisible verification – most visitors don’t see any challenge; Turnstile works in the background.
    • Higher completion rates – fewer puzzles means less friction and fewer abandoned forms.
    • Privacy-friendly design – Turnstile is built to minimize user tracking and profiling compared to traditional CAPTCHAs.

    To connect Turnstile:

    1. Get Site Key and Secret Key from your Cloudflare Turnstile dashboard.
    2. In WPForms → Settings → CAPTCHA, select Cloudflare Turnstile and enter your keys.
    3. Enable Turnstile on the forms (contact, registration, checkout, etc.) where you need extra bot protection.

    All three CAPTCHA providers can work alongside CleanTalk Anti-Spam, giving you both:

    • a front-end bot check (CAPTCHA / Turnstile), and
    • deep cloud-based spam filtering in the background.

    Honeypot, WPForms Built-In Anti-Spam, Akismet and Third-Party Plugins

    Alongside CleanTalk and CAPTCHAs, WPForms and WordPress offer several additional anti-spam layers.

    WPForms Anti-Spam Token and Honeypot

    By default, WPForms includes:

    • an anti-spam token that helps block automated form submissions, and
    • an optional honeypot field – a hidden field that humans never see, but bots often fill in.

    When a bot fills the honeypot field or fails the token check, WPForms treats the submission as spam and blocks it.

    You can control these options in each form’s Settings → Spam Protection and Security section inside WPForms.

    Honeypot protection is:

    • invisible for normal visitors,
    • easy to enable,
    • a lightweight extra defense against primitive bots.

    Akismet

    Akismet Anti-Spam is another popular plugin that filters spam by checking submissions against a global spam database. It is especially useful for blog comments and simple contact forms outside WPForms.

    On a site that uses WPForms + CleanTalk you can still use Akismet to:

    • keep comment sections clean,
    • filter spam from default WordPress forms or other plugins.

    To activate Akismet:

    1. Install and activate Akismet Anti-Spam from Plugins → Add New.
    2. Obtain an API key from Akismet and enter it in the plugin settings.
    3. Enable spam checking for the content types you need (comments, possibly other forms).

    Other universal anti-spam plugins

    Plugins like WP Armour, OOPSpam, Maspik, and Simple CAPTCHA Alternative provide generic honeypot or anti-spam protection for various forms and comment areas across WordPress.

    They can be used alongside CleanTalk if you want additional defense for:

    • contact forms created outside WPForms,
    • comments,
    • custom theme forms and widgets.

    You can find them via:

    Plugins → Add New → Search → “WP Armour” | “OOPSpam” | “Maspik” | “Simple CAPTCHA Alternative”

    Install, activate, and configure each plugin according to its documentation.

    Frequently Asked Questions (FAQ)

    I already use WPForms’ built-in anti-spam. Do I really need CleanTalk?

    WPForms includes an anti-spam token and optional honeypot, which is great for stopping very basic bots.
    However, they don’t:

    • check global spam activity across thousands of sites,
    • analyze IP and email reputation,
    • or block known spam networks at the cloud level.

    CleanTalk adds an extra layer on top of WPForms’ native tools. It filters submissions using a global spam database and the SpamFireWall, so most spam is blocked before it reaches your entries, inbox or CRM.

    Will CleanTalk slow down my WPForms submissions?

    No. CleanTalk is designed to work in the background and the request to the cloud is lightweight.

    From the visitor’s point of view:

    • they fill out the WPForms form as usual,
    • click submit,
    • and either see a normal success message or an anti-spam message if they are blocked.

    For normal users, there are no extra steps, pop-ups or CAPTCHAs to solve.

    Can CleanTalk protect all my WPForms forms or only the main contact form?

    Once the Anti-Spam plugin is installed and connected to the CleanTalk cloud, it can protect any WPForms form that uses the standard WPForms processing flow:

    • simple contact forms,
    • quote / booking / consultation forms,
    • lead generation and newsletter sign-up forms,
    • surveys, polls and feedback forms.

    You don’t need to add a special field to each form – protection works on the server side.

    What happens to blocked WPForms submissions? Are they lost forever?

    When CleanTalk blocks a submission, the user is shown an anti-spam message and the entry is not stored as a normal form submission.

    However, the attempt is:

    • logged in your CleanTalk dashboard with IP, email, date, URL and the reason,
    • available for review if you suspect a false positive,
    • easy to whitelist (by IP, email, country, etc.) if you decide that a sender is legitimate.

    So you still have visibility into what was blocked, but your WPForms entries, inbox and CRM stay clean.

    Recommended Anti-Spam Stack for WPForms (2026)

    No single tool can block every kind of spam or bad bot. The most reliable approach for WPForms is to build a layered anti-spam stack, where each component handles a different part of the problem.

    The key element is the Anti-Spam plugin by CleanTalk, which:

    • integrates directly with Contact Form by WPForms,
    • uses both application-level checks and the SpamFireWall to block many bots before they reach WordPress.

    On top of this, you can combine CAPTCHAs, WPForms’ built-in tools, and moderation policies.

    Recommended setup by site type

    Business websites and standard contact forms

    • CleanTalk Anti-Spam enabled (with SpamFireWall).
    • WPForms anti-spam token + honeypot enabled in each important form.
    • Optionally, Google reCAPTCHA or Cloudflare Turnstile on high-risk forms (contact, quote, booking).

    High-traffic landing pages and lead generation

    • CleanTalk Anti-Spam (cloud + plugin).
    • Cloudflare Turnstile or reCAPTCHA for minimal-friction verification.
    • WPForms honeypot enabled.
    • Optional extra filters: block high-risk countries or networks in CleanTalk if you notice patterns in spam logs.

    Membership / registration-heavy sites using WPForms

    • CleanTalk Anti-Spam to protect registration, login, and profile forms where applicable.
    • Cloudflare Turnstile or hCaptcha on registration / login forms for additional protection.
    • WPForms built-in spam protection turned on for all authentication forms.
    • Optionally, Akismet or other plugins for comments and non-WPForms areas.

    By this point, most spam problems in your WPForms contact, lead, survey, and payment forms should be significantly reduced. If you’re still seeing unwanted submissions, simply create a CleanTalk account (or log in to your existing one) and reach out to our support team – we’ll gladly help you fine-tune WPForms spam protection for your specific site.

    Stop WPForms spam without hurting conversions

    Create your CleanTalk account and connect it to WPForms to block spam contacts, leads, surveys and payment forms — no extra CAPTCHAs and no friction for real users.

    CleanTalk Account

    No credit card required • Setup takes less than a minute • Your temporary password will be sent by email.

CleanTalk

About

Create a support ticket

Contact us

Dashboard

Sign up / Sign in

Anti-Spam

Anti-Spam for Websites

Anti-Spam API

Best Anti-Spam Plugins in 2026

IP Checker

Email Checker

Filter fake emails

Hide contact data

Security

Website Malware Scanner

WordPress Malware Removal

WordPress Security Plugin