CleanTalk's blog

Sign Up

Stop spam without frustrating your visitors

Create your CleanTalk account and start blocking spam — no CAPTCHA challenges and no impact on visitors.

Security Block Lists

CleanTalk Account

No credit card required • Setup takes less than a minute • Your temporary password will be sent by email.

Category: Anti-Spam

  • How to Stop Spam in Contact Form 7: Best Protection Methods in 2026

    How to Stop Spam in Contact Form 7: Best Protection Methods in 2026

    Contact Form 7 remains one of the most widely used contact form plugins in the WordPress ecosystem, with more than 10 million active installations listed in the official WordPress plugin directory. It has stayed popular for years because it gives site owners a practical, lightweight, and flexible way to add contact forms without switching to a heavier all-in-one form builder. WordPress.org also notes that the plugin uses its own Schema-Woven Validation technology, which shows that Contact Form 7 is built not just as a basic form tool, but as a structured system for handling user input reliably.

    In 2026, however, popularity also means exposure. Public-facing contact forms are easy for bots and abusive senders to find, test, and submit at scale, which is why Contact Form 7 gets spammed so often. Contact Form 7’s own documentation treats spam as a normal operational issue, not a rare exception: the plugin officially supports multiple anti-spam layers, including Akismet, Cloudflare Turnstile, the disallowed list, and reCAPTCHA v3. The project also explicitly warns that weak protection or unsafe mail configuration can allow spammers to abuse a form and send messages through the site itself.

    That is why Contact Form 7 spam should not be framed as a plugin defect or an unusual technical failure. It is a predictable consequence of running a highly visible form on a public website. In practice, especially in 2026, the real question is not whether a Contact Form 7 form can attract spam, but which protection stack is strong enough to block automated submissions without creating unnecessary friction for real users. Contact Form 7 itself recommends combining different types of spam protection rather than relying on a single mechanism alone.

    Contact form 7 at https://wordpress.org/plugins/contact-form-7/
    Contact form 7 at https://wordpress.org/plugins/contact-form-7/

    Common types of spam in Contact Form 7 (CF7)

    Spam in Contact Form 7 is not limited to one obvious pattern. The most common and best-documented category is automated bot spam – scripts that submit forms at scale faster than a human team can review them manually. Google has explicitly warned that bots are commonly used to fill out web forms automatically, which is one of the main reasons public-facing forms become a frequent target for abuse. Contact Form 7 reflects the same reality in its own documentation by offering multiple official anti-spam options and integrations rather than treating spam as an exceptional case.

    Another important category is human spam or human-assisted spam. Contact Form 7’s own reCAPTCHA FAQ explains that CAPTCHA tools can block spambots effectively but are “helpless against other types of spam,” and specifically notes that human spammers can easily get around them. That makes this a critical distinction for site owners: blocking bots alone does not mean the form is fully protected. This is also why Contact Form 7 advises using two or more spam protection modules together instead of relying on one layer only.

    A third risk is form abuse caused by unsafe configuration. Contact Form 7 explicitly warns that if mail settings are configured unsafely and sufficient spam protection is not in place, spammers may abuse the form to send messages through the site itself. In other words, some Contact Form 7 abuse is not just about junk submissions cluttering an inbox – it can also turn the form into a delivery mechanism for unwanted email.

    If you want to broaden this section beyond strictly official Contact Form 7 documentation, you can also mention fake contact data, direct POST abuse, and human-like spam that slips through basic CAPTCHA checks as practical patterns observed by CleanTalk in real-world Contact Form 7 cases. Those points are useful, but they should be framed as product or field observations rather than as claims directly documented by Contact Form 7 itself.

    Official anti-spam options and integrations in Contact Form 7

    Contact Form 7 includes several official anti-spam options and integrations, which shows that spam protection is not treated as an afterthought. In its own FAQ, Contact Form 7 says users can protect forms with anti-spam features such as Akismet, Cloudflare Turnstile, and the disallowed list. The plugin also maintains an official integration for reCAPTCHA v3, which remains part of its supported anti-spam stack.

    One of the most important options is Akismet. Contact Form 7 explains that Akismet works through specific form-tag options such as akismet:author, akismet:author_email, and akismet:author_url, allowing the plugin to evaluate the submission itself rather than simply challenge the user. The documentation goes even further and says that Akismet forms the “centerpiece” of Contact Form 7’s spam prevention strategy.

    Another major option is Cloudflare Turnstile. Contact Form 7 now provides an official Turnstile integration module and describes it as an effective way to protect forms from spam bots. More importantly, the project explicitly states, “We recommend Turnstile unless you have reasons to use reCAPTCHA.” That makes Turnstile the strongest current CAPTCHA-style recommendation inside the official Contact Form 7 ecosystem.

    Contact Form 7 also supports reCAPTCHA v3, but it should be described carefully. The official documentation says the integration is designed to block abusive submissions by spam bots, and the reCAPTCHA FAQ clarifies that Contact Form 7 5.1 and higher support only reCAPTCHA v3 natively. In other words, reCAPTCHA is still a valid option, but it is no longer the only CAPTCHA path inside Contact Form 7.

    The simplest built-in filtering layer is the disallowed list. According to Contact Form 7’s FAQ, it can block messages containing specified keywords or submissions coming from specified IP addresses. It is not a complete anti-spam solution on its own, but it works well as an extra rule-based layer when a site repeatedly sees the same phrases, links, or IP-based abuse patterns.

    Taken together, these options show that Contact Form 7 approaches spam protection as a layered system, not as a one-click fix. Akismet helps filter suspicious submissions, Turnstile and reCAPTCHA v3 are aimed at stopping spambots, and the disallowed list adds a simple keyword- and IP-based filter. Contact Form 7’s own guidance also recommends combining different anti-spam modules rather than relying on a single method alone. 

    CAPTCHA options in Contact Form 7

    If you specifically want to add CAPTCHA protection to Contact Form 7, there are two main options to focus on in the current Contact Form 7 ecosystem: reCAPTCHA v3 and Cloudflare Turnstile. Both are supported in Contact Form 7, but they should not be treated as identical solutions. They solve a narrower problem – mainly reducing automated bot submissions – and are usually most effective when combined with other filtering layers rather than used alone.

    reCAPTCHA v3 is Contact Form 7’s native Google-based CAPTCHA option. It works in the background and uses a score-based system instead of the classic checkbox challenge most users associate with older CAPTCHA tools. That makes it more convenient from a UX perspective, but it also means it is better at dealing with bots than with every kind of spam. In practice, reCAPTCHA v3 is still a valid option for Contact Form 7, especially for sites already using Google services, but it should not be positioned as a complete anti-spam solution by itself.

    Cloudflare Turnstile is now the stronger default recommendation for many Contact Form 7 sites. It is designed as a more lightweight CAPTCHA alternative and usually creates less friction for visitors than traditional challenge-based verification. More importantly, current Contact Form 7 documentation treats Turnstile as the preferred CAPTCHA-style option unless there is a specific reason to stay with reCAPTCHA. For that reason, if the goal is to choose the most up-to-date CAPTCHA layer inside the official Contact Form 7 stack, Turnstile is the better place to start.

    Some websites also use third-party CAPTCHA plugins, such as hCaptcha-based integrations, but these should be described as external add-ons rather than as Contact Form 7’s main official path. They can still be useful in certain setups, especially where privacy, policy, or infrastructure preferences matter, but for most readers the core CAPTCHA decision in Contact Form 7 today is really reCAPTCHA v3 vs Cloudflare Turnstile.

    The key point is that CAPTCHA is only one part of the protection strategy. It can help reduce automated spam, but it does not replace submission filtering, keyword blocking, or broader server-side anti-spam protection. That is why the best Contact Form 7 setups usually combine a CAPTCHA-style layer with other anti-spam methods instead of relying on CAPTCHA alone.

    Best ways to stop spam in Contact Form 7

    The most reliable way to reduce spam in Contact Form 7 is to use more than one protection layer. Contact Form 7’s own documentation says that the plugin provides several spam protection modules and advises users to use two or more modules together. In practice, that means the best setup is usually not a single tool, but a combination of bot protection, submission filtering, and rule-based blocking.

    For websites that want to stay within Contact Form 7’s official ecosystem, Cloudflare Turnstile is now the clearest starting point. Contact Form 7 provides an official Turnstile integration, says it effectively protects forms from spam bots, and explicitly states, “We recommend Turnstile unless you have reasons to use reCAPTCHA.” That makes Turnstile the strongest default CAPTCHA-style recommendation in the current Contact Form 7 stack.

    A second important layer is Akismet. Contact Form 7 says that Akismet forms the centerpiece of its spam prevention strategy and recommends combining different protection types instead of relying on only one module. Unlike a visible CAPTCHA challenge, Akismet is configured through specific form-tag options and evaluates the submission data itself, which makes it a strong complementary layer alongside Turnstile.

    The disallowed list is also worth using as a supporting layer. Contact Form 7’s FAQ says it can block messages containing specific keywords or submissions coming from specified IP addresses. It is not presented as a full standalone solution, but it is useful when a site repeatedly receives the same phrases, links, or IP-based abuse patterns.

    reCAPTCHA v3 remains a supported option, but it should be described carefully. Contact Form 7’s documentation says that version 5.1 and later uses the reCAPTCHA v3 API, while the FAQ notes that CAPTCHA tools are effective against spambots but can be ineffective against other spam types, including spam generated by humans. For that reason, reCAPTCHA is better presented as one possible layer, not as a complete answer by itself.

    Comparison table: reCAPTCHA vs Akismet vs Turnstile vs CleanTalk

    If you want to compare Contact Form 7’s native stack with an external service, CleanTalk is a reasonable option to include in the comparison section. WordPress.org describes it as a CAPTCHA-free anti-spam plugin that blocks contact form spam, fake users, and spam comments, and lists it at 200,000+ active installations. That makes it a valid external alternative to compare against Turnstile, Akismet, and reCAPTCHA – but in the article it should be presented as an external anti-spam service, not as one of Contact Form 7’s built-in protections.

    How to read this table: inside the official Contact Form 7 ecosystem, the strongest setup is usually Turnstile + Akismet, because CF7 explicitly recommends using multiple spam-protection modules together, calls Akismet the “centerpiece” of its spam-prevention strategy, and says, “We recommend Turnstile unless you have reasons to use reCAPTCHA.”

    reCAPTCHA v3 is still an official CF7 option, but it should be positioned carefully. Contact Form 7 says reCAPTCHA v3 is its officially supported CAPTCHA solution and that it works in the background, but the same FAQ also warns that CAPTCHA tools can be helpless against other spam types, including human spammers.

    Akismet deserves a higher position in the comparison than many WordPress articles give it. CF7 says Akismet is the centerpiece of its spam-prevention strategy and explains that it works by evaluating submission data, not just by placing a challenge in front of the visitor.

    Turnstile is the clearest current default inside Contact Form 7. CF7’s integration page says all contact forms are protected after setup, while Cloudflare positions Turnstile as a CAPTCHA replacement that works without showing visitors a traditional CAPTCHA and aims for a less intrusive experience.

    CleanTalk should be presented honestly as an external alternative, not a native Contact Form 7 feature. The WordPress.org listing describes it as a no-CAPTCHA anti-spam plugin and says it stops spam contact emails; the same listing also has a dedicated Contact Form 7 section saying the plugin extends spam protection for CF7 and can be used with other third-party spam filters.

    Bottom line: if the article is comparing the best practical options, the cleanest conclusion is this – Turnstile is the best default native entry point, Akismet is the strongest native filtering layer, reCAPTCHA v3 is still valid but weaker as a primary recommendation, and CleanTalk is the most natural external no-CAPTCHA alternative to compare against the CF7 stack.

    Anti-Spam solutions for Contact form 7 comparison chart.
    Anti-Spam solutions for Contact form 7 comparison chart.

    Anti-Spam plugin by CleanTalk for WordPress

    The next tool we’re going to use is the Anti-Spam plugin by CleanTalk.

    Here’s a short overview:

    • CleanTalk is a cloud-based spam protection service for websites, founded in 2012.
    • It automatically blocks spam without CAPTCHAs and doesn’t interrupt the user experience.
    • Protects many types of forms: contact forms, payment forms, registrations, comments, surveys and more.
    • Stops both automated bots and human spam submissions.
    • Uses advanced filtering algorithms and a global spam detection network.
    • Detects spam based on IP address, email address and user behavior.
    • Lets you create custom filtering rules for specific cases.
    • Allows blocking or filtering by IP, email and country.
    • Works quietly in the background and is very easy to install and configure.

    According to WordPress.org, Anti-Spam by CleanTalk for WordPress has over 200,000 active installations, with thousands of reviews and an average rating around 4.7 out of 5.

    Plugin Homepage at cleantalk.org | Latest release at GitHub.com | Website cleantalk.org

    According to WordPress.org, Anti-Spam by CleanTalk for WordPress has over 200,000 active installations, with 3,168 reviews and an average rating of 4.7.

    Plugin Homepage at cleantalk.org | Latest release at GitHub.com

    Install the CleanTalk Anti-Spam plugin

    To install the Anti-Spam plugin, go to your WordPress admin panel→ Plugins→ Add New.

    image

    Then enter «СleanTalk» in the search box and click the Install button for «Spam protection, Anti-Spam, FireWall by CleanTalk».

    image

    After installing the plugin, click the «Activate»‎ button.

    image

    After it is done go to the plugin settings and click the «Get Access Key Automatically» button. Then just click the «Save Settings»‎ button.

    image

    That’s all –  Contact Form 7 are now protected From this moment,CleanTalk automatically protects the  Contact Form 7 registration form (REST route /wp-json/Contact Form 7press/v1/users/), and the Add Listing form used to submit new listings.
    You don’t need to paste any shortcodes – just use  Contact Form 7 as usual, and CleanTalk will filter spam in the background.

    Check if spam protection works with Contact Form 7 (CF7)

    The best way to text the spam protection by using a test email,

    stop_email@example.com

    1. Open a page with a Contact Form 7 (for example, the registration popup or the Add Listing form) in an Incognito / private browser tab.
    2. Fill out the Contact form using stop_email@example.com as sender’s email.
    3. Send the form.
    4. You should see a message from the Anti-Spam plugin confirming that a spam submission was blocked.

    *** Forbidden. Sender blacklisted. Anti-Spam by CleanTalk. ***

    image

    If you see this message, it means CleanTalk successfully protects your Contact Form 7 (registration and Add Listing) from spam.

    Cloud Dashboard

    In addition, in the Cloud Dashboard you can find extra details regarding all submissions processed by CleanTalk, including Contact Form 7 registration and Add Listing forms:

    • IP and email of the sender, as well as the sender’s activity history across other websites connected to the CleanTalk cloud.
    • Geolocation of the sender.
    • Date and time of the submission.
      Page (URL) where the form was submitted (for example, a specific listing submission page).
    • Cloud decision – Approved or Denied.
    • Cloud explanation for the decision (e.g. blacklisted email, bad IP reputation, spam text, etc.).
    • Tools to move the sender to Block or Allow lists so you can fine-tune  Contact Form 7 spam protection.

    FAQ

    I still get spam in Contact Form 7 after setting everything up. What should I do?

    If spam still gets through, the first step is to stop treating any one plugin as a complete solution. Contact Form 7 itself recommends using two or more spam-protection modules together, because different tools catch different abuse patterns. In practice, that usually means combining a bot-reduction layer such as Turnstile or reCAPTCHA with a filtering layer such as Akismet or an external service such as CleanTalk, plus simple rule-based blocking through the disallowed list when you see repeated phrases or IP-based abuse.

    Should I choose Turnstile or reCAPTCHA for Contact Form 7?

    If you want to stay within Contact Form 7’s official CAPTCHA-style options, Cloudflare Turnstile is now the clearer default choice. Contact Form 7 explicitly says, “We recommend Turnstile unless you have reasons to use reCAPTCHA.” reCAPTCHA v3 remains supported, but Contact Form 7 also warns that CAPTCHA solutions are mainly effective against spambots and can be weak against other types of spam, including human spam.

    Is Akismet enough on its own?

    Akismet is one of the strongest native filtering layers in the Contact Form 7 stack, and CF7 even calls it the “centerpiece” of its spam-prevention strategy. But Contact Form 7 does not frame Akismet as a one-plugin answer to every spam problem. The project recommends combining different protection types, which is why Akismet works best alongside another layer such as Turnstile, reCAPTCHA, or an external server-side anti-spam service.

    Contact Form 7 says the message was sent, but I never received the email. Is that a spam issue?

    Not necessarily. Contact Form 7’s FAQ explains that if you see the green success message, the PHP mail function completed successfully, but the message may still have been filtered or lost afterward. The same FAQ notes that spam filters often cause this kind of problem. That means this is usually a mail deliverability issue rather than a form-spam issue.

    How do I improve email deliverability for Contact Form 7 notifications?

    Start with Contact Form 7’s own mail best practices. The plugin recommends using a From address that belongs to the same domain as the website, setting a proper Reply-To header for the sender’s real email, and enabling email authentication methods such as SPF and DKIM. WordPress also explains that wp_mail() depends on the site’s mailing environment, so if local mail is not configured properly, routing mail through a correctly configured SMTP or mail provider setup is often more reliable.

    Final recommendation

    If your goal is to stop Contact Form 7 spam reliably without making the form harder for real users, the best approach is a layered protection stack. In 2026, inside the official Contact Form 7 ecosystem, the strongest starting point is usually Cloudflare Turnstile + Akismet, supported by the disallowed list where repeated patterns appear. That recommendation matches Contact Form 7’s own guidance: use multiple anti-spam modules together, treat Akismet as a core filtering layer, and prefer Turnstile over reCAPTCHA unless there is a specific reason to stay with Google’s solution.

    If you want broader site-wide protection without relying only on CAPTCHA-style challenges, an external server-side solution such as CleanTalk is a reasonable alternative to include in the comparison, especially for sites that want a CAPTCHA-free layer across Contact Form 7, comments, and registrations. The right choice depends on how much spam you get, how much friction you can tolerate, and whether you need protection only for Contact Form 7 or across WordPress more broadly.

    The most important takeaway is simple: in 2026, no single anti-spam method is enough for every Contact Form 7 site. CAPTCHA can reduce automated abuse, Akismet can evaluate suspicious submissions, rule-based filters can block recurring patterns, and external services can add broader server-side protection. The sites that perform best usually combine these layers instead of expecting one plugin or one checkbox to solve the entire problem.

    Stop Contact Form 7 spam without CAPTCHAs

    Create your CleanTalk account and protect Contact Form 7 from bot and human spam with server-side filtering. Keep forms easy for real visitors while extending protection across comments, registrations, and other WordPress forms.

    CleanTalk Account

    No credit card required • Setup takes less than a minute • Your temporary password will be sent by email.

  • Formidable Forms Spam Protection in 2026

    Formidable Forms Spam Protection in 2026

    If you use Formidable Forms on a WordPress website, spam will eventually become a real issue. It usually starts with a few junk submissions in a contact form, quote request form, survey, quiz, or registration form. Then it turns into fake leads, bot traffic, meaningless messages, and wasted admin time.

    That is not a Formidable-specific flaw. It is a normal consequence of running public-facing forms on a visible website. The more accessible the form is, the more often bots and abusive senders will try to submit it. That is why Formidable Forms spam protection should be configured from the start, not only after your inbox is already full of garbage entries.

    This guide explains how to build a practical layered setup for Formidable spam protection. The main solution here is the Anti-Spam plugin by CleanTalk, and then we will also cover additional tools such as built-in anti-spam options, honeypot protection, reCAPTCHA, hCaptcha, Cloudflare Turnstile, and other WordPress anti-spam plugins.

    By the end of this article, you will know how to stop most fake submissions in Formidable Forms without making your forms harder for real visitors to use.

    formidable logo

    Formidable Forms – WordPress Form Builder Plugin

    First, let’s take a quick look at Formidable Forms itself.

    Formidable Forms is a WordPress form builder used for much more than a basic contact form. Website owners use it to create contact forms, lead forms, quote request forms, surveys, quizzes, registration flows, calculators, payment forms, and other custom workflows. That flexibility is exactly why the plugin is attractive for businesses, agencies, and content-driven sites.

    But that same flexibility also increases spam exposure. The more public forms a website has, the more entry points it gives to spambots and abusive users.

    Typical Formidable spam problems include:

    • fake contact messages,
    • junk quote requests,
    • automated survey submissions,
    • low-quality leads,
    • bot-driven registration attempts,
    • repeated testing of form fields and validation logic.

    So when users search for formidable spam, they are usually not describing one single issue. They often mean a broader set of problems: fake submissions, spammy messages, junk leads, bot traffic, and abusive attempts to use public forms.

    A strong anti-spam strategy should address all of those while keeping the experience simple for legitimate users.

    As WordPress.org shows, Formidable Forms is currently used on over 300,000 websites and has 1,357 user reviews with an average rating of 4.8.

    Plugin Homepage at wordpress.org | Website formidableforms.com

    Install Formidable Forms to create contact forms, quote request forms, surveys, quizzes, registration forms, and other custom forms in WordPress.

    You can set it up in just a few easy steps:

    1. Search for the plugin in WordPress console -> Plugins -> Add Plugin -> Search -> Type ‘Formidable Form

    Search for the plugin in WordPress console

    2. Install and Activate the plugin

    Install and Activate the plugin

    3. Create your first form in WordPress console -> Formidable -> Forms -> Add New.

    WordPress console -> Formidable -> Forms -> Add New -> choose a template or start with a blank form -> add fields and settings -> Save.

    4. That’s all! Your first form is ready and Formidable Forms is now set up on your site.

    Anti-Spam plugin by CleanTalk for WordPress

    The main solution in this guide is the Anti-Spam plugin by CleanTalk.

    CleanTalk is a cloud-based anti-spam service for WordPress and other CMS platforms. Instead of making every visitor solve a challenge, it checks submissions in the background and filters spam automatically. This matters because one of the biggest weaknesses of CAPTCHA-only protection is friction: every extra test can reduce conversion rate and annoy real users.

    Here is why CleanTalk works well for Formidable Forms websites:

    • it checks submissions automatically in the background,
    • it helps protect contact, registration, survey, quote, and feedback forms,
    • it reduces fake entries before they clutter your inbox or database,
    • it does not rely on classic CAPTCHA for every visitor,
    • it gives you a cloud dashboard for reviewing decisions and fine-tuning protection if needed.

    In practical terms, this means you can keep the form experience clean for real users while filtering suspicious behavior in the background.

    For most websites, CleanTalk should be the primary spam filter, while CAPTCHA and other tools are used only as additional layers on higher-risk forms.

    According to WordPress.org, Anti-Spam by CleanTalk for WordPress has over 200,000 active installations, with 3,168 reviews and an average rating of 4.7.

    Plugin Homepage at cleantalk.org | Latest release at GitHub.com | Website cleantalk.org

    Install the CleanTalk Anti-Spam plugin

    Show Instructions

    To install the Anti-Spam plugin, go to your WordPress admin panel → Plugins → Add New.

    forminator-spam-protection

    Then enter «СleanTalk» in the search box and click the Install button for «Spam protection, Anti-Spam, FireWall by CleanTalk».

    testing-forminator-spam-protection

    After installing the plugin, click the «Activate»‎ button.

    testing-forminator-spam-protection

    After it is done go to the plugin settings and click the «Get Access Key Automatically» button. Then just click the «Save Settings»‎ button.

    forminator-spam-protection

    That’s it! From now you know how to completely protect your HivePress from spam.

    Check if spam protection works with Formidable Forms

    The easiest way to test the setup is to use the CleanTalk test email:

    stop_email@example.com

    Use this method:Open a page with your Formidable form in an Incognito or Private browser window.

    1. Fill out the form.
    2. Use stop_email@example.com as the sender email.
    Screenshot 2026 03 21 at 19.48.18

    4. Submit the form.

    5. You should see a blocking message from the Anti-Spam plugin instead of a successful submission.

    Screenshot 2026 03 21 at 22.21.13

    If that happens, the protection is working correctly and your Formidable form is already filtering known spam submissions.

    Cloud Dashboard

    In addition, the CleanTalk Cloud Dashboard gives you more visibility into what is happening with submissions processed through the anti-spam service.

    For Formidable Forms websites, this is useful because it helps you review not only whether a submission was blocked, but also why it was blocked.

    In the dashboard, you can usually find details such as:

    • sender IP and email,
    • geolocation of the sender,
    • date and time of the submission,
    • page URL where the form was submitted,
    • cloud decision – Approved or Denied,
    • explanation for the decision,
    • tools to move the sender to Allow or Block lists.

    This is especially helpful if the site receives repeated attacks, recurring junk leads, or suspicious activity from the same sources.

    Built-in Spam Protection in Formidable Forms

    Besides CleanTalk, Formidable Forms itself can be used with built-in anti-spam measures and additional anti-abuse checks.

    These are useful, but in most real-world cases they work best as secondary protection, not as the only defense.

    Honeypot protection

    A honeypot is one of the simplest anti-spam methods. It adds hidden fields that real visitors do not interact with, but simple bots often fill automatically. When that happens, the submission can be rejected.

    Why honeypot is useful:

    • it is invisible to legitimate users,
    • it creates no extra friction,
    • it catches primitive bots efficiently.

    Why it is not enough on its own:

    • more advanced bots can bypass it,
    • it does not handle every case of fake leads or manual spam,
    • it is better as a supporting layer than as a full anti-spam strategy.

    That is why honeypot is a good addition, but not a complete replacement for a broader spam filter.

    Native anti-spam and validation options

    Form builders often include basic anti-abuse logic, validation rules, and submission checks. These can help reduce low-quality automated submissions and obvious junk entries.

    However, built-in checks are usually narrower than a dedicated anti-spam service. They may stop some bot patterns, but they do not always provide broader reputation analysis, behavior-based filtering, or cloud-level spam intelligence.

    For that reason, a layered setup works better: use Formidable’s own checks where appropriate, but keep CleanTalk as the main filter working in the background.

    reCAPTCHA, hCaptcha, and Cloudflare Turnstile for Formidable Forms

    Another common question is whether CAPTCHA should be used together with Formidable Forms.

    The answer is: yes, sometimes – but not as the only protection layer.

    CAPTCHA-style tools are most useful for higher-risk forms, such as:

    • registration forms,
    • quote request forms,
    • lead generation landing pages,
    • public surveys,
    • pages that receive repeated bot attacks.

    Google reCAPTCHA

    Google reCAPTCHA is one of the best-known anti-bot tools. It can reduce obvious automated abuse, but it also has downsides:

    • it may interrupt the user experience,
    • it can lower form completion rates,
    • some spam still passes through,
    • it does not replace a complete anti-spam strategy.

    So reCAPTCHA can help, but it should not replace your main spam filter.

    hCaptcha

    hCaptcha is often chosen by site owners who want an alternative to Google-based services. It can be useful as an additional challenge layer for forms that receive repeated automated abuse.

    Its role in a Formidable setup is simple: increase resistance on risky forms while CleanTalk continues filtering quietly in the background.

    Cloudflare Turnstile

    Cloudflare Turnstile is a more modern alternative that often works with less visible friction than classic CAPTCHA challenges. For websites that want extra bot protection with a lighter user experience, it can be a strong second layer.

    But the same principle still applies:

    Do not rely on Turnstile alone.
    Use it together with CleanTalk, not instead of CleanTalk.

    Akismet and other third-party anti-spam plugins

    There are also other WordPress anti-spam solutions that site owners may consider.

    Akismet

    Akismet is well known in the WordPress ecosystem and is often used for comments and basic spam filtering. On a Formidable-based website, it may help with broader site-level anti-spam needs outside the form workflow itself.

    But for a forms-heavy website, Akismet is usually better treated as a supporting layer rather than the core Formidable spam protection strategy.

    Other universal anti-spam plugins

    Some website owners also try solutions such as:

    • WP Armour,
    • OOPSpam,
    • Maspik,
    • honeypot plugins,
    • CAPTCHA-focused plugins.

    These can be useful in specific projects, especially if a website has unusual traffic patterns or several different plugins handling different submission points.

    At the same time, using too many overlapping anti-spam plugins can also create conflicts, duplicate filtering, false positives, or an unnecessarily complicated admin workflow.

    That is why the cleaner approach is usually better:

    one primary spam filter, one optional CAPTCHA layer, and extra tools only where they solve a clear problem.

    Frequently Asked Questions

    Why am I still getting fake submissions in Formidable Forms after enabling spam protection?

    Spam protection blocks most automated junk, but not every unwanted lead is a classic bot submission. Some low-quality entries may be submitted manually or by more advanced automated methods. In that situation, the best fix is layered protection: keep CleanTalk as the main background filter and add CAPTCHA or Turnstile only to the forms that receive repeated abuse.

    Can CleanTalk protect all Formidable Forms or do I need to configure each form separately?

    In most cases, CleanTalk starts checking form submissions after installation and activation, so you do not need to rebuild every Formidable form manually. That makes it convenient for websites with multiple contact forms, quote request forms, survey forms, and registration pages.

    Should I use CAPTCHA together with CleanTalk for Formidable Forms?

    For many standard contact forms, CleanTalk alone is enough. But if a site runs registration forms, quote pages, paid-traffic landing pages, or other high-risk forms, adding reCAPTCHA, hCaptcha, or Cloudflare Turnstile as a second layer is a good idea.

    What types of Formidable forms attract the most spam?

    The most common targets are contact forms, lead generation forms, quote request forms, registration forms, and surveys on public pages. These forms are easy for bots to discover and usually contain clear fields that can be abused at scale.

    How can I check whether CleanTalk is actually blocking Formidable spam?

    The simplest test is to open your Formidable form in an Incognito window and submit it using stop_email@example.com. If CleanTalk is working correctly, the form submission should be blocked and a spam warning should appear.

    Why would a legitimate Formidable form submission be blocked as spam?

    Occasional false positives can happen with any anti-spam system. This may be caused by unusual sender behavior, shared networks, VPN use, aggressive browser settings, or plugin conflicts. If needed, review the event in the CleanTalk dashboard and move trusted senders to the allow list.

    What is the best anti-spam setup for contact, quote, and registration forms built with Formidable?

    For most websites, the best setup is CleanTalk as the main spam filter, Formidable’s built-in checks or honeypot as a lightweight extra layer, and CAPTCHA only on the forms with the highest spam risk. This keeps the user experience smoother than forcing challenge-based verification everywhere.

    Why are my Formidable form notifications landing in spam folders even when submissions are blocked correctly?

    This usually points to an email delivery issue rather than a form filtering problem. If form notifications go to spam, configure SMTP for the WordPress site, avoid relying on the default PHP mail function, and make sure the sending domain has valid SPF, DKIM, and DMARC records.

    Recommended Anti-Spam Stack for Formidable Forms 

    No single anti-spam method stops every type of spam. The most reliable approach is a layered anti-spam stack, where each layer deals with a different category of abuse.

    Small business website with a contact form

    Recommended setup:

    • CleanTalk Anti-Spam as the main protection,
    • optional honeypot or built-in checks,
    • occasional dashboard review if spam appears.

    That is usually enough for a simple business website with normal traffic.

    Lead generation, quote request, survey, or registration forms

    Recommended setup:

    • CleanTalk Anti-Spam as the main protection,
    • honeypot or built-in validation as an extra layer,
    • reCAPTCHA, hCaptcha, or Turnstile on the most attacked forms.

    This setup gives better resistance against recurring bot attacks and fake leads.

    High-traffic or high-risk forms

    Recommended setup:

    • CleanTalk Anti-Spam as the main protection,
    • CAPTCHA or Turnstile on targeted forms,
    • allow/block list tuning in the dashboard,
    • checks for plugin conflicts,
    • SMTP configuration for reliable email notifications.

    This is the best option for websites that actively attract spam traffic.

    Final thoughts

    If you are trying to stop Formidable Forms spam in WordPress, the most effective approach is not to rely on one tool alone.

    A reliable setup usually looks like this:

    • CleanTalk as the main background spam filter,
    • honeypot or built-in checks as lightweight support,
    • reCAPTCHA, hCaptcha, or Turnstile only where additional verification is needed,
    • dashboard monitoring and personal lists for fine-tuning.

    That combination helps reduce fake submissions, keeps the form experience cleaner for real users, and gives you more control when spam patterns change over time.

    Stop Formidable Forms spam without frustrating your visitors

    Create your CleanTalk account and start blocking spam form submissions, fake registrations, survey spam, quiz abuse, and junk leads — no CAPTCHA challenges and no impact on real visitors.

    CleanTalk Account

    No credit card required • Setup takes less than a minute • Your temporary password will be sent by email.

  • HivePress Spam Protection in 2026

    HivePress Spam Protection in 2026

    If you use HivePress to power a directory, classifieds, or marketplace website, you will eventually face spam – fake listings, bot registrations, and junk messages.

    This guide explains how to set up HivePress spam protection using:

    • the Anti-Spam plugin by CleanTalk with direct integration for HivePress, and
    • additional tools like Google reCAPTCHA and basic moderation.

    The integration now protects both:

    • the registration form of HivePress (requests to /wp-json/hivepress/v1/users/), and
    • the Add Listing form used to submit new listings.
    hivepress logo

    HivePress – Business Directory & Classified Ads Plugin

    First, let’s take a quick look at HivePress itself and the types of sites you can build with it.

    HivePress is a free and highly flexible WordPress plugin for building any type of directory or listing website: business directory, job board, classifieds, real estate catalog, rental marketplace, and more.

    Out of the box HivePress provides:

    • listing types, categories and custom fields;
    • powerful search filters and location-based search;
    • user accounts, ratings, reviews, private messages and favorites.

    Because HivePress relies heavily on user-generated content and public forms, it quickly becomes a target for spambots. That’s why it is important to have a reliable HivePress spam protection setup from the beginning.

    As WordPress.org shows, HivePress is currently used on over 10,000 websites and has 213 user reviews with an average rating of 4.9.

    Plugin Homepage at wordpress.org | Website hivepress.io


    Install HivePress to build business directories, classifieds, marketplaces and other listing websites.

    You can set it up in just a few easy steps:

    1. Search for the plugin in WordPress console -> Plugins -> Add plugin -> Search -> Type ‘hivepress‘

    Untitled design

    2. Install and Activate the plugin.

    3. Add the very first listing in WordPress console -> Listings -> Add New.

    Untitled design (2)

    WordPress console -> Listings -> Add New -> add title, description, images and other fields -> Publish.

    4. That’s all! Your first listing is live and HivePress is ready to use on your site.

    Anti-Spam plugin by CleanTalk for WordPress

    The next tool we’re going to use is the Anti-Spam plugin by CleanTalk.
    Here’s a short overview:

    • CleanTalk is a cloud-based spam protection service for websites, founded in 2012.
    • It automatically blocks spam without CAPTCHAs and doesn’t interrupt the user experience.
    • Protects many types of forms: contact forms, payment forms, registrations, comments, surveys and more.
    • Stops both automated bots and human spam submissions.
    • Uses advanced filtering algorithms and a global spam detection network.
    • Detects spam based on IP address, email address and user behavior.
    • Lets you create custom filtering rules for specific cases.
    • Allows blocking or filtering by IP, email and country.
    • Works quietly in the background and is very easy to install and configure.

    According to WordPress.org, Anti-Spam by CleanTalk for WordPress has over 200,000 active installations, with 3,168 reviews and an average rating of 4.7.

    Plugin Homepage at cleantalk.org | Latest release at GitHub.com | Website cleantalk.org

    Install the CleanTalk Anti-Spam plugin

    Show Instructions

    To install the Anti-Spam plugin, go to your WordPress admin panel → Plugins → Add New.

    forminator-spam-protection

    Then enter «СleanTalk» in the search box and click the Install button for «Spam protection, Anti-Spam, FireWall by CleanTalk».

    testing-forminator-spam-protection

    After installing the plugin, click the «Activate»‎ button.

    testing-forminator-spam-protection

    After it is done go to the plugin settings and click the «Get Access Key Automatically» button. Then just click the «Save Settings»‎ button.

    forminator-spam-protection

    That’s it! From now you know how to completely protect your HivePress from spam.

    Check if spam protection works with HivePress

    The best way to test the spam protection by using a test email,

    stop_email@example.com

    1. Open page with your form (don’t forget to add the shortcode in the page content) in Incognito browser tab.
    2. Fill out the Contact form using stop_email@example.com as sender’s email.
    3. Send the form.
    4. You should see a message from the Anti-Spam plugin confirming that a spam submission was blocked.

    *** Forbidden. Sender blacklisted. Anti-Spam by CleanTalk. ***

    Untitled design (9)
    If you see this message, it means CleanTalk successfully protects your HivePress forms (registration and Add Listing) from spam.

    Cloud Dashboard

    In addition, in the Cloud Dashboard you can find extra details regarding all submissions processed by CleanTalk, including HivePress registration and Add Listing forms:

    • IP and email of the sender, as well as the sender’s activity history across other websites connected to the CleanTalk cloud.
    • Geolocation of the sender.
    • Date and time of the submission.
      Page (URL) where the form was submitted (for example, a specific listing submission page).
    • Cloud decision – Approved or Denied.
    • Cloud explanation for the decision (e.g. blacklisted email, bad IP reputation, spam text, etc.).
    • Tools to move the sender to Block or Allow lists so you can fine-tune HivePress spam protection.

    Google reCAPTCHA, hCaptcha, and Cloudflare Turnstile

    Besides CleanTalk and the built-in HivePress tools, you can also use cloud CAPTCHA / anti-bot services together with HivePress to reduce spam and protect registration and Add Listing forms.

    Google reCAPTCHA (native HivePress integration)

    HivePress has a core integration with Google reCAPTCHA v2:

    • First, register your site in the Google reCAPTCHA admin and generate a Site Key and Secret Key.
    • Then go to WordPress console → HivePress → Settings → Integrations → reCAPTCHA and paste these keys.
    • In the same section you can select which HivePress forms to protect (for example, registration, login, listing submission).

    This helps reduce spam submissions and adds an extra security layer to HivePress forms, while CleanTalk continues to filter all submissions in the background.

    hCaptcha

    HivePress does not currently include native hCaptcha support. However, you can use hCaptcha on your site via separate WordPress plugins (for example, “hCaptcha for Forms and More”) that add hCaptcha to standard WordPress forms and some popular plugins.

    Key benefits of hCaptcha compared to reCAPTCHA:

    • Better privacy for visitors. hCaptcha collects less tracking data and is more focused on privacy and GDPR-friendly use.
    • Reduced dependence on Google services. Useful for projects that prefer not to rely on Google infrastructure for branding or compliance reasons.
    • Optional monetization. hCaptcha offers a program where site owners can earn small rewards for solved challenges, something reCAPTCHA does not provide.

    To use hCaptcha you need to:

    • obtain a Site Key and Secret Key in the hCaptcha dashboard,
    • install and configure the corresponding WordPress plugin,
    • and test that hCaptcha is correctly displayed and working on your HivePress registration and Add Listing forms (since there is no direct HivePress integration yet).

    Cloudflare Turnstile

    Cloudflare Turnstile is a modern CAPTCHA alternative that verifies users mostly in the background, without classic image puzzles.

    Turnstile can be connected to WordPress via dedicated plugins that integrate Turnstile with standard WordPress forms and some third-party plugins.

    Main benefits of Cloudflare Turnstile compared to classic reCAPTCHA:

    • Invisible verification. Turnstile usually works silently in the background, so users can submit forms without extra clicks and image challenges.
    • Higher form completion rates. With fewer interruptions, registration and listing submission forms tend to have fewer abandoned attempts.
    • Strong privacy approach. Turnstile is designed to minimize user tracking and does not rely on heavy behavioral profiling, which makes it more privacy-friendly than traditional CAPTCHA solutions.

    As with hCaptcha, you need to:

    • obtain a Site Key and Secret Key in the Cloudflare Turnstile dashboard,
    • configure the chosen WordPress plugin,
    • and verify that Turnstile is actually applied to the pages where HivePress renders registration or Add Listing forms.

    Honeypot, Akismet and third-party Anti-Spam plugins

    Additionally, let’s consider standalone plugins and anti-spam mechanics that also work for HivePress-based websites.

    Honeypot

    Honeypot is one of the simplest anti-spam mechanics against primitive spam bots. It works by adding hidden fields that are only detected and filled by bots. When a bot fills these fields, the submission is blocked automatically, while legitimate users never see any additional challenges.

    Because no CAPTCHA or interaction is required, honeypots:

    • help maintain a smooth user experience,
    • reduce friction on registration and Add Listing forms,
    • and add a lightweight extra layer of protection.

    You can enable honeypot protection via a dedicated WordPress plugin, for example WP Armour – Honeypot Anti Spam.

    Settings are available in the plugin configuration, for example:

    • WordPress console -> Plugins -> Add New -> Search -> type ‘WP Armour’
    • Install and Activate the plugin.
    • WordPress console -> Settings -> WP Armour (or the plugin’s own menu item) -> enable honeypot protection for the forms used with HivePress (registration / Add Listing pages).

    Effective on March 19th, 2026 users report that WP Armour does not protect or support HivePress. They observe spam subscriptions and accounts. Read more.

    Third-party Anti-Spam plugins

    Akismet

    Akismet Anti-Spam helps WordPress users automatically filter spam submissions by analyzing form data against its global spam detection network. It works in the background to identify suspicious content and prevent unwanted messages from reaching your inbox or database. This reduces manual moderation and helps keep comments and basic contact forms clean.

    For HivePress websites, Akismet can be used together with CleanTalk to:

    • filter blog comments and simple contact forms,
    • reduce low-quality submissions outside of HivePress-specific forms.

    In order to activate protection the user must:

    1. Install and activate the third-party plugin Akismet Anti-Spam.
    2. Get an API key from Akismet and enter it in the plugin settings.
    3. Enable spam checking for the content types you need (comments, contact forms, etc.).

    Typical path:

    • WordPress console -> Plugins -> Add New -> Search -> type ‘Akismet’
    • Install and Activate the plugin.
    • WordPress console -> Settings -> Akismet Anti-Spam -> enter API key and save.

    Other universal Anti-Spam plugins

    OOPSpam, Maspik, and Simple CAPTCHA Alternative are universal anti-spam plugins for WordPress that provide additional spam protection at the site level. They can help filter spam on contact forms, comments and other areas of your site that are not covered directly by HivePress integration.

    All of these solutions can be found in the search results at wordpress.org:

    WordPress console -> Plugins -> Add New -> Search -> type ‘WP Armour’ | ‘OOPSpam’ | ‘Maspik’ | ‘Simple CAPTCHA Alternative’
    Install and Activate the chosen plugin, then configure it according to its documentation.

    These third-party plugins can be used alongside CleanTalk and HivePress as optional extra layers of protection for high-risk or high-traffic projects.

    This guide explains how to protect HivePress forms using the Anti-Spam plugin by CleanTalk together with additional tools such as Google reCAPTCHA, hCaptcha, Cloudflare Turnstile, honeypot mechanisms and third-party anti-spam plugins like Akismet, OOPSpam and Maspik.

    Frequently Asked Questions (FAQ)

    Still getting spam through your HivePress forms?

    If nothing works in this guide, try a few more things:

    1. Block spammers by particular IPs, countries and email masks via Personal lists in your CleanTalk account.
    2. Enable listing moderation in HivePress, so new listings must be approved by an admin before they go live.
    3. Check for plugin conflicts – temporarily disable other anti-spam / security plugins and test HivePress registration and Add Listing forms only with CleanTalk enabled.
    4. Submit a support request to CleanTalk, attaching examples of spam submissions (IPs, emails, message text, page URLs). The support team will do their best to tune spam protection for your specific case.
    reCAPTCHA not saving in HivePs settingress or showing errors

    If reCAPTCHA keys are not saved or you see an error in HivePress → Settings → Integrations → reCAPTCHA:

    1. Make sure you are using the correct key type (usually reCAPTCHA v2 for HivePress).
    2. Double-check that the domain in the Google reCAPTCHA admin exactly matches your site.
    3. Remove any extra spaces when pasting the Site Key and Secret Key.
    4. Try temporarily disabling other CAPTCHA / security plugins and saving the settings again.
    5. If the issue persists, you can switch to an alternative solution such as hCaptcha or Cloudflare Turnstile via a separate WordPress plugin, while keeping CleanTalk as your main spam filter.
    HivePress + hCaptcha / Turnstile does not prevent spam

    If you enabled hCaptcha or Cloudflare Turnstile but spam still comes through:

    1. Do not rely on hCaptcha / Turnstile alone – always keep CleanTalk Anti-Spam enabled as the primary filter.
    2. Enable honeypot protection if it is available in your chosen security / form plugins to catch simple bots.
      Check that there are no plugin conflicts disabling CleanTalk checks or bypassing them.
    3. Use layered protection: CleanTalk + CAPTCHA (reCAPTCHA / hCaptcha / Turnstile) + HivePress moderation usually works much better than any single method.
    Emails from HivePress forms are going to spam.
    1. Check SMTP configuration and avoid sending mail via the default PHP mail() function.
    2. Install and configure an SMTP plugin, so your site sends messages through an authenticated email account (hosting mail, Gmail, or a transactional service).
    3. Verify that your domain has proper SPF / DKIM / DMARC records to improve sender reputation.
    4. After configuring SMTP, send a few test submissions from HivePress forms and confirm that notifications now arrive in the inbox, not in spam.

    Recommended Anti-Spam Stack for HivePress (2026)

    Finally, no single anti-spam tool can stop every type of spam submission. The most reliable approach for HivePress websites is a layered protection stack, where each tool blocks a different category of bots and spam behavior.

    Starting from the latest plugin update, the Anti-Spam plugin by CleanTalk includes a direct integration with HivePress. It automatically protects the HivePress registration form and the Add Listing form before a new user account or listing is created, without any extra settings inside HivePress. This integration is the core of the recommended anti-spam stack below.

    Recommended setup by site type

    Small business directory / local listings

    • CleanTalk Anti-Spam (with direct HivePress integration)
    • Optional honeypot protection in a security/form plugin
    • Basic HivePress listing moderation

    High-traffic classifieds or service marketplace

    • CleanTalk Anti-Spam (with direct HivePress integration)
    • Google reCAPTCHA or Cloudflare Turnstile on registration and Add Listing forms
    • Listing moderation for new or untrusted users

    Membership / registration-heavy HivePress sites

    • CleanTalk Anti-Spam (with direct HivePress integration)
    • Cloudflare Turnstile or hCaptcha on registration and login
    • Optional honeypot protection for additional bot filtering

    By now, most spam issues in your HivePress registration, login and Add Listing forms should be resolved. If not, sign up for a CleanTalk account or log in to your existing one and contact our support team – we will be happy to help you fine-tune spam protection for your specific case.

    Stop spam without frustrating your visitors

    Create your CleanTalk account and start blocking spam forms, surveys, polls and quiz answers — no CAPTCHA challenges and no impact on visitors.

    CleanTalk Account

    No credit card required • Setup takes less than a minute • Your temporary password will be sent by email.

  • Is zekisuquc419@gmail.com Spam Bot? How to Stop It

    Is zekisuquc419@gmail.com Spam Bot? How to Stop It

    The email address zekisuquc419@gmail.com has been reported for sending spam and launching automated malicious requests on thousands of websites. According to CleanTalk Block Lists, this address has:

    • Attacked over 10,000 websites.
    • Generated approximately 12,144 spam requests in the last 24 hours.
    • Used Russian IP addresses to send requests.
    • First detected on March 19, 2025.
    • Last activity recorded on March 18, 2026, attacked over 18,661 websites.

    What Does This Spam Bot Do?


    This bot attempts to register accounts, submit forms, and post comments on websites using the email zekisuquc419@gmail.com. The activity is fully automated and intended to spread spam or malicious links. This can:

    • Clutter your website with junk content
    • Expose your visitors to phishing or malware
    • Harm your SEO and domain reputation

    This spam bot uses multiple languages to send what look like harmless price inquiries, helping it evade standard spam detection systems. At first sight, these messages seem genuine, which makes them especially dangerous for site administrators who could easily confuse them with real customer requests.

    • Hi, I wanted to know your price.
    • Прывітанне, я хацеў даведацца Ваш прайс.
    • Salam, qiymətinizi bilmək istədim.
    • Zdravo, htio sam znati vašu cijenu.
    • Xin chào, tôi muốn biết giá của bạn.
    • Aloha, makemake wau eʻike i kāu kumukūʻai.
    • Ողջույն, ես ուզում էի իմանալ ձեր գինը.
    • Kaixo, zure prezioa jakin nahi nuen.
    • Hola, volia saber el seu preu.

    This bot uses this template to submit contact forms.

    Here is a snapshot from CleanTalk’s logs:

    “2160 requests in 24 hours detected from multiple Russian IP addresses. All actions associated with spam form submissions and bot-like behavior.”

    zekisuquc419@gmail.com reported for spam.
    zekisuquc419@gmail.com reported for spam.

    How to Block Spam from zekisuquc419@gmail.com

    If you’re seeing traffic or spam submissions from this email, here’s how to stop it:

    1. Use CleanTalk Anti-Spam Plugin
      Install the CleanTalk Anti-Spam plugin for your CMS (WordPress, Joomla, Drupal, etc.). It automatically filters requests by checking emails, IPs, and behavior against the global CleanTalk Spam Database. This email is already blacklisted and will be blocked automatically by the plugin.
    2. Manually Block the Email (if needed) through Personal lists in your Dashboard. If you want to block it manually in addition to using CleanTalk,
      – Add zekisuquc419@gmail.com to your site’s block list.
      – Block common IPs that were used in attacks (CleanTalk logs show many from Russian ranges).
    3. Monitor your server logs for repetitive POST requests in the Anti-Spam log at your Dashboard.
    Anti-Spam Dashboard at cleantalk.org.
    Anti-Spam Dashboard at cleantalk.org.
    Anti-Spam log at the Dashboard cleantalk.org.
    Anti-Spam log at the Dashboard cleantalk.org.

    zekisuquc419@gmail.com is a known spammer attacking thousands of sites daily. By installing proper anti-spam protection like CleanTalk and staying vigilant, you can block these threats before they reach your visitors.

    If you’re already using CleanTalk, rest assured — this spammer is on the blacklist and will be filtered automatically.

    You can check any email or check any IP for spam activity on our Block Lists page.

    🧩 Want full protection?

    ✅ Blocks fake registrations and spam submissions
    ✅ Filters bots and fake emails in real time
    ✅ No CAPTCHAs or puzzles – clean and fast

    Stay ahead of spam – let CleanTalk handle the bots so you can focus on your content. Protect your site in under 5 minutes.
    👉 Start now

    Have you come across this kind of spam? Share your experience in the comments.

  • Reducing Disk Load in High-Traffic PHP Applications: Switching from SQLite to Redis for Anti-Crawler Storage

    Reducing Disk Load in High-Traffic PHP Applications: Switching from SQLite to Redis for Anti-Crawler Storage

    Automated crawlers and scraping bots are a growing problem for modern websites. While search engine bots are useful, many other crawlers generate excessive traffic, scrape content, or overload servers.

    To help website owners control this type of traffic, we recently released the Anti-Crawler PHP Library by CleanTalk, an open-source tool designed to detect and limit aggressive crawlers before they cause performance problems.

    GitHub repository: https://github.com/CleanTalk/php-anticrawler

    anti crawler storage architecture

    The library analyzes incoming requests and applies rate-limiting logic to detect crawler-like behavior. Once a bot exceeds defined limits, the system blocks or restricts further requests.

    In the first version of the library we chose SQLite as the storage backend. SQLite allowed the library to work immediately after installation without requiring additional infrastructure such as Redis or Memcached.

    However, after deploying the library on our own high-traffic website cleantalk.org, we encountered an unexpected performance issue: disk load increased significantly.

    The result was a simple architectural change that completely removed the disk load increase while improving scalability.

    The First Version of the Anti-Crawler Library

    The goal of the library was to provide a simple crawler protection mechanism for PHP applications. Typical anti-crawler logic requires storing temporary request data. Each request updates this data so the system can determine whether a visitor behaves like a normal user or an automated crawler. Because the data must be updated frequently, the storage backend plays a critical role in overall performance.

    Why SQLite Was Chosen

    For the initial release we selected SQLite for several reasons:

    1. Zero configuration. SQLite is included in most PHP environments and does not require running an additional service.
    2. Single-file storage. All data is stored in a single database file, making installation extremely simple.
    3. Good performance for moderate workloads. SQLite performs very well for many typical web applications.
    4. Easy deployment. Users could install the library without modifying their infrastructure.

    This approach allowed the library to work immediately after installation and made it suitable for shared hosting environments. For many websites this configuration works perfectly. However, high-traffic environments behave differently.

    Deploying the Library on a High-Traffic Website

    After releasing the first version of the library, we deployed it on our own website https://cleantalk.org Our infrastructure handles a large volume of traffic, including both legitimate users and automated bots. Shortly after enabling the library, our monitoring systems detected something unusual. Disk Activity Increased. Server monitoring showed a noticeable increase in disk activity. After analyzing the metrics we observed: Disk load increased by approximately 30%.

    This was unexpected because the library itself performs only lightweight operations. The problem was not CPU usage or memory consumption. Instead, the issue was directly related to disk I/O. Further investigation showed that the additional disk operations were coming from the SQLite database used by the anti-crawler system.

    Why SQLite Became a Bottleneck

    SQLite is a reliable and efficient embedded database, but its design has limitations under certain workloads. The anti-crawler system generates a very specific traffic pattern. For each HTTP request the library needs to:

    • read crawler counters
    • update request statistics
    • write the updated data back to storage

    This means the database receives frequent write operations.

    Because SQLite stores data on disk, every update results in disk activity. Under high traffic this leads to a large number of disk writes. SQLite also uses file-level locking to ensure consistency. When many requests attempt to update the database simultaneously, additional locking overhead appears.

    As a result, frequent writes combined with locking increased disk activity on our production servers.

    Moving the Storage Layer to Redis / KeyDB

    To eliminate disk operations we needed a storage system optimized for frequent updates. The natural solution was an in-memory data store, so we added support for: Redis and KeyDB. Both systems keep data in memory and provide extremely fast read and write operations. This approach removes disk I/O and allows the crawler detection logic to update counters much more efficiently.

    The Anti-Crawler PHP Library was updated to support multiple storage backends. Users can now choose between:

    • SQLite (default)
    • Redis
    • KeyDB

    SQLite remains useful for simple deployments, while Redis or KeyDB can be enabled for high-traffic environments. The crawler detection logic itself remains unchanged — only the storage backend is replaced.

    Results After Switching to Redis

    After switching the storage backend to Redis on our production servers we immediately saw improvements. Disk activity returned to normal because the crawler counters were now stored in memory instead of on disk. The previous 30% increase in disk load disappeared, and request processing became faster. The Redis-based architecture also scales better under heavy traffic and avoids locking issues associated with file-based databases.

    When to Use SQLite vs Redis

    Both storage options remain available because they fit different environments.

    SQLite works well for:

    • small and medium websites
    • environments without Redis
    • simple installations

    Redis or KeyDB is recommended for:

    • high-traffic websites
    • infrastructure already using Redis
    • environments with heavy bot traffic

    How to Use the Anti-Crawler PHP Library

    The library is open source and available on GitHub: https://github.com/CleanTalk/php-anticrawler It can be integrated into any PHP application to detect aggressive crawlers and limit automated traffic.

    Installation

    composer require cleantalk/php-anticrawler

    Quick start – https://github.com/CleanTalk/php-anticrawler?tab=readme-ov-file#anti-crawler-php-library-by-cleantalk

    Conclusion

    Switching the storage backend of our Anti-Crawler PHP Library from SQLite to Redis/KeyDB allowed us to eliminate the disk I/O overhead that appeared under high traffic. This small architectural change removed the 30% disk load increase and made the crawler detection system faster and more scalable for busy websites.

    Anti-Spam Dashboard with results for Anti-Crawler PHP Library.
    Anti-Spam Dashboard with results for Anti-Crawler PHP Library
    SpamFireWall log and Anti-Crawler sessions.
    SpamFireWall log and Anti-Crawler sessions

    On cleantalk.org Anti-Crawler PHP Library serves about 20k sessions weekly, wich gives roughly 500k hits weekl.

    Anti-Crawler PHP Library by CleanTalk

    Protect your website from aggressive crawlers, automated scraping, and unwanted bot traffic using the CleanTalk Anti-Crawler PHP library.

  • Forminator Forms – Spam Protection Guide in 2026

    Forminator Forms – Spam Protection Guide in 2026

    If you use Forminator Forms, you may occasionally experience spam submissions. In the guide below, you’ll learn about several tools that help achieve complete spam protection for Forminator. In this post we will look at as built-in (in the plugin core) anti-spam tools like Honeypot, Google reCAPTCHA, hCaptcha, Cloudflare Turnstile. As well as, spam protection via third party plugins like Akismet, CleanTalk and OOPSpam.

    Forminator, WordPress.org plugin banner https://wordpress.org/plugins/forminator/

    Forminator Forms – Contact Form, Payment Form & Custom Form Builder

    First of all, let’s figure out what Forminator Forms are.

    Forminator Forms is a powerful and user-friendly form builder plugin for WordPress that allows you to create contact forms, registrations, payment forms, quizzes, and polls without coding. Developed by WPMU DEV, the plugin has gained popularity for its flexibility and reliable spam protection designed to reduce spam submissions across websites. Since its release in 2018, Forminator has continued to evolve, introducing new integrations, improving usability, and strengthening tools that help website owners fight spam more effectively. The plugin supports payment providers such as Stripe and PayPal, enabling secure transactions while maintaining strong spam protection for payment and contact forms. Regular updates keep the plugin compatible with modern WordPress versions and current security standards, helping prevent spam attacks and automated bot activity.

    As WordPress.org shows, Forminator is currently used on over 600,000 websites and has 2,034 user reviews with an average rating of 4.8.

    Plugin Homepage at wordpress.org | Website wpmudev.com

    Install Forminator Forms, Surveys, Quizzes, Polls, Calculations and More…

    Installation is as easy as following these steps.

    1. Search for the plugin in WordPress console -> Plugins -> Add plugin -> Search -> Type ‘forminator‘

    WordPress console -> Plugins -> Add plugin -> Search -> forminator.
    Forminator search, install and activation.

    2. Install and Activate the plugin.

    3. Add the very first contact form in WordPress console -> Forminator > Forms -> +ADD NEW -> Customer service -> Contact form.

    WordPress console -> Forminator > Forms -> +ADD NEW -> Customer service -> Contact form.
    WordPress console -> Forminator > Forms -> +ADD NEW -> Customer service -> Contact form.

    4. Click Publish in top-left corner.

    5. That’s all! Your form is ready to go, just use a short code like this on any page or post of your site.

    [forminator_form id="123"]
    Use a short code like this on any page or post of your site
    Form is ready to go, use shortcode.

    Anti-Spam plugin by CleanTalk for WordPress

    The next plugin we are going to use is the Anti-Spam plugin by CleanTalk. Here is a short description of it,

    • CleanTalk is a cloud-based spam protection for websites, founded in 2012.
    • It automatically blocks spam without CAPTCHAs or disrupting user experience.
    • Protects multiple form types: contact forms, payment forms, registrations, comments, and surveys.
    • Stops both automated bots and manual spam submissions.
    • Uses advanced filtering algorithms and a global spam detection network.
    • Detects spam activity based on IP addresses, email addresses, and behavioral patterns.
    • Users can apply custom filtering rules.
    • Allows filtering or blocking by IP, email, and country.
    • Works automatically in the background with easy installation.


    According to WordPress.org, Anti-Spam by CleanTalk for WordPress has over 200,000 active installations, with 3,165 reviews and an average rating of 4.8.

    Plugin Homepage at cleantalk.org | Latest release at Github.com | Website cleantalk.org

    Install the CleanTalk Anti-Spam plugin

    Show Instructions

    To install the Anti-Spam plugin, go to your WordPress admin panel → Plugins → Add New.

    forminator-spam-protection

    Then enter «СleanTalk» in the search box and click the Install button for «Spam protection, Anti-Spam, FireWall by CleanTalk».

    testing-forminator-spam-protection

    After installing the plugin, click the «Activate»‎ button.

    testing-forminator-spam-protection

    After it is done go to the plugin settings and click the «Get Access Key Automatically» button. Then just click the «Save Settings»‎ button.

    forminator-spam-protection

    That’s it! From now you know how to completely protect your Forminator Forms from spam.

    Check if spam protection works with Forminator Forms

    The best way to text the spam protection by using a test email,

    stop_email@example.com

    1. Open page with your form (don’t forget to add the shortcode in the page content) in Incognito browser tab.
    2. Fill out the Contact form using stop_email@example.com as sender’s email.
    3. Send the form.
    4. You should see a message from the Anti-Spam plugin confirming that a spam submission was blocked.

    *** Forbidden. Sender blacklisted. Anti-Spam by CleanTalk. ***

    Spam submission was blocked in contact form by Forminator.
    Spam submission was blocked in contact form by Forminator.

    Cloud Dashboard

    In addition, in the Cloud Dashboard you can find extra details regarding all submissions made via form,

    • IP, Email of the sender. As well as history of activity a sender among other sites connected to CleanTalk’s cloud.
    • Geolocation of the sender.
    • Date and time of submission.
    • Page (URL) of the submission.
    • Cloud decision – Approved, Denied.
    • Cloud explanation for the decision.
    • Tools to move the sender to Block or Allow lists.
    Anti-Spam Cloud Dashboard, Forminator form.
    Anti-Spam Cloud Dashboard, Forminator form.

    Google reCAPTCHA, hCaptcha, and Cloudflare Turnstile

    Also, let’s have a look at cloud, anti-spam services that we have for Forminator forms,

    1. The plugin has core integration with many CAPTCHA services,
      • Forminator integrates with Google reCAPTCHA, helping users reduce spam submissions while adding an extra layer of security to contact forms, registrations, and surveys. This allows website owners to protect their forms automatically without complex configuration. To activate this service obtain Site key and Secret key on the site.
      • hCaptcha support. Forminator users can reduce spam submissions while maintaining better privacy for visitors and improving overall form security.
        • Key benefits of hCaptcha over reCAPTCHA,
          • Better privacy for visitors. hCaptcha collects less user tracking data compared to Google reCAPTCHA, which is important for privacy-focused websites and GDPR-sensitive regions.
          • Reduced dependence on Google services. Using hCaptcha allows Forminator users to avoid relying on Google infrastructure, which some organizations prefer for compliance or branding reasons.
          • Potential monetization option. hCaptcha offers a program where site owners can earn small rewards for solving challenges, something reCAPTCHA does not provide.
        • hCaptcha requires Site Key and Secret key as well, which can be obtained on site.
      • Cloudflare Turnstile. By integrating with Cloudflare Turnstile, Forminator users can protect their forms from spam and bots without showing traditional CAPTCHA challenges. Turnstile works invisibly in the background, helping improve user experience while maintaining strong spam protection for contact forms, registrations, payments, and surveys. This reduces friction for real visitors, increases form completion rates, and keeps submissions clean without interrupting the workflow.
        • Main benefits of Cloudflare Turnstile over Google reCAPTCHA,
          • Invisible verification. Turnstile works mostly in the background without puzzles or image challenges, so visitors can submit Forminator forms faster and with less frustration compared to reCAPTCHA.
          • Higher form conversion rates. Because users are not interrupted by CAPTCHA challenges, contact forms, surveys, and payment forms typically see fewer abandoned submissions.
          • Strong privacy approach. Turnstile is designed to minimize user tracking and does not rely on extensive behavioral profiling, which makes it more privacy-friendly than reCAPTCHA.
        • Site Key and Secret key can be obtained on site.
      • All CAPTCHA services are aviable under settings Settings are under path WordPress console -> Forminator > Forms -> Settings -> CAPTCHA -> reCAPTCHA | hCaptcha | Turnstile.

    Honeypot, Akismet and third-party Anti-Spam Plugins

    Additionally, let’s consider standalone plugins and anti-spam mechanics that also works for Forminator forms,

    1. Honeypot. Which is most simple anti-spam mechanic against primitive spam bots. It works by adding hidden fields that are only detected and filled by bots, allowing spam to be blocked automatically while legitimate users never see additional challenges. Because no CAPTCHA or interaction is required, honeypots help maintain a smooth user experience and improve form completion rates. This lightweight method is easy to enable and adds an extra layer of protection for contact forms, surveys, and registrations.
      • Settings are available per each individual form, the path is WordPress console -> Forminator > Forms -> FORM -> Settings -> Behavior -> Security. Please look at screenshots down below.
    2. Third-party Anti-Spam plugins.
      • Akismet. Akismet helps Forminator users automatically filter spam submissions by analyzing form data against its global spam detection network. It works in the background to identify suspicious content and prevent unwanted messages from reaching your inbox or database. This reduces manual moderation and helps keep contact forms, surveys, and registrations clean. As a widely used WordPress anti-spam solution, Akismet is easy to enable and integrates naturally into existing WordPress workflows.
        • In order to activate protection user must install, activate and get API key for third-party plugin Akismet and then turn integration under the settings WordPress console -> Forminator > Forms -> FORM -> Settings -> Behavior -> Security. Please look at screenshots down below.
      • WP Armour, OOPSpam, Maspik, and Simple CAPTCHA Alternative are universal anti-spam plugins for WordPress that provide reliable spam protection for Forminator users. All of these solutions can be found in the search results at wordress.org.
    CAPTCHA services at Forminator settings. Google reCAPTCHA, hCaptcha, Cloudflare Turnstile.
    CAPTCHA services at Forminator settings. Google reCAPTCHA, hCaptcha, Cloudflare Turnstile.
    Honeypot and Akismet in Forminator.
    Honeypot and Akismet in Forminator.
    WP Armour, OOPSpam, Maspik, and Simple CAPTCHA Alternative in https://wordpress.org/plugins/search/forminator+spam/
    WP Armour, OOPSpam, Maspik, and Simple CAPTCHA Alternative.

    Here is a guide by WPMU DEV. It tells how to protect Forminator with additional cloud services such as Honeypot (not as service), Google reCAPTCHA, hCaptcha, Cloudflare Turnstile. Third party plugins like Akismet, and OOPSpam.

    Frequently Asked Questions (FAQ)

    Cannot stop spam from coming through forms no matter what…

    If nothing works in this guide, try a few more things,

    1. Block spammers by particular IPs, Countries via Personal lists under your CleanTalk’s account.
    2. Submit a support request, we will do our best to tune spam protection for your specific case.
    v3 reCAPTCHA not saving in Forminator Settings. V2 shows ‘ERROR for site owner: Invalid key type’

    Forminator’s team doesn’t have a solution for this error, but advices to switching to hCaptcha, read more.

    Forminator x hCaptcha does not prevent spam

    The main recommendation is to avoid relying on hCaptcha alone, enable Forminator’s honeypot protection, prevent plugin conflicts, and use layered anti-spam methods for better results. WordPress.org.

    Emails from website contact form going to spam.

    The recommended solution is to check SMTP configuration using a real email account so the website sends messages through authenticated mail servers instead of the default PHP mail system. Installing and configuring an SMTP plugin ensures proper email delivery and improves sender reputation, preventing form notifications from being marked as spam. WordPress.org.

    Recommended Anti-Spam Stack for Forminator (2026)

    Finally, no single anti-spam tool can stop every type of spam submission. The most reliable approach for Forminator users is a layered protection stack, where each tool blocks a different category of bots and spam behavior.

    Recommended setup by site type

    • Business website: CleanTalk + Honeypot.
    • High-traffic landing pages: CleanTalk + Turnstile.
    • Membership / registration sites: CleanTalk + Turnstile or hCaptcha.

    By now, all spam issues in your Forminator contact, survey, poll, or quiz forms should be resolved. If not, Sign Up for an account and our support team will be happy to help you.

    Stop spam without frustrating your visitors

    Create your CleanTalk account and start blocking spam forms, surveys, polls and quiz answers — no CAPTCHA challenges and no impact on visitors.

    CleanTalk Account

    No credit card required • Setup takes less than a minute • Your temporary password will be sent by email.

  • GiveWP – Spam Protection guide in 2026. Stop spam donations!

    GiveWP – Spam Protection guide in 2026. Stop spam donations!

    CleanTalk has added spam protection for GiveWP using direct form integration. This makes it a good opportunity to explore how to protect GiveWP against spam submissions using both built-in anti-spam tools integrated into the plugin core and third-party solutions. We will start with CleanTalk and then move on to Akismet, Google reCAPTCHA, Cloudflare Turnstile, honeypot techniques, and universal anti-spam plugins available on WordPress.org.

    GiveWP banner at https://wordpress.org/plugins/give/
    GiveWP banner at https://wordpress.org/plugins/give/

    GiveWP – Donation & Fundraising Plugin for WordPress

    In case of any misunderstanding or misinterpretation about which plugin we are referring to, allow me to provide a brief overview of GiveWP

    GiveWP is a powerful WordPress donation plugin that helps nonprofits, charities, and organizations accept online donations directly on their websites. It allows you to create fully customizable donation forms and securely collect one-time or recurring donations without relying on third-party fundraising platforms. To maintain secure fundraising, GiveWP can be combined with spam protection solutions that help prevent fake donations, bot submissions, and fraudulent registrations. The plugin supports popular payment gateways such as PayPal and Stripe, making it easy for donors to contribute using their preferred payment method. Built-in reporting, donor management tools, and fundraising goal tracking help organizations monitor performance and grow contributions. With a wide range of add-ons and integrations, GiveWP scales from small campaigns to large nonprofit organizations while following WordPress best practices for reliability and security.

    According to WordPress.org, over 100,000 websites use this plugin.

    Install GiveWP – Donation Plugin and Fundraising Platform

    Show Instructions

    To have the plugin installed follow this steps,

    1. Search for the plugin in WordPress console -> Plugins -> Add plugin -> Search -> givewp

    GiveWP plugin in WordPress catalog.

    2. Install and Activate the plugin.

    3. Add a campaign and forms in WordPress console -> GiveWP -> Campaigns -> Forms.

    GiveWP. First campaign and form.

    That’s all! GiveWP is installed.

    Anti-Spam plugin by CleanTalk for WordPress

    The next plugin we are going to use is the Anti-Spam plugin by CleanTalk. Here is a short description of it,

    CleanTalk Anti-Spam plugin for WordPress protects your site from spam comments, contact forms, registrations, and fake donations without CAPTCHA. It uses cloud-based spam detection and real-time databases to block bots automatically while keeping the experience smooth for real users. CleanTalk works in the background and requires minimal setup, making it a reliable hands-off anti-spam solution.

    CleanTalk has additional features like Block and Allow lists to manage specific Emails, IPs, Countries, custom frontend message to blocked donations and Emails obfuscation which might be helpful during fundraising events.

    According to WordPress.org, over 200,000 websites use this plugin. All features of Anti-Spam plugin for WordPress.

    How to install CleanTalk Anti-Spam plugin

    Show Instructions

    To install the Anti-Spam plugin, go to your WordPress admin panel → Plugins → Add New.

    Then enter «СleanTalk» in the search box and click the Install button for «Spam protection, Anti-Spam, FireWall by CleanTalk».

    After installing the plugin, click the «Activate»‎ button.

    After it is done go to the plugin settings and click the «Get Access Key Automatically» button. Then just click the «Save Settings»‎ button.

    That’s it! GiveWP is completely protected, let’s see how to test the protection.

    How to check spam protection for GiveWP Forms

    You can test the work of Anti-Spam protection for GiveWP by using a test email,

    stop_email@example.com

    1. First, open the form in an Incognito browser tab.
    2. Choose amount to donate.
    3. In the next step fill out the account name data and the stop_email@example.com.
    4. You must see a message as below and in the screenshot.

    *** Forbidden. Fraud prevention. Sender blacklisted. Anti-Spam by CleanTalk. ***

    Testing spam protection for GiveWP.

    In addition, in the Cloud Dashboard you can find extra details regarding all submissions for the donation form,

    • IP, Email of the donator. As well as history of activity a sender among other sites connected to CleanTalk’s cloud.
    • Geolocation of the sender.
    • Date and time of submission.
    • Page (URL) of the submission.
    • Cloud decision – Approved, Denied.
    • Cloud explanation for the decision.
    • Tools to move the sender to Block or Allow lists.
    Anti-Spam log in the CleanTalk's Dashboard.

    What additional anti-spam tools are available for GiveWP?

    Here are a few more tools on the market,

    1. Akismet is a cloud-based anti-spam service that works in the background and has excellent compatibility with WordPress. Most importantly, the GiveWP team has included Akismet integration directly in the core of the plugin, providing a seamless user experience for those who choose Akismet as their anti-spam solution. Akismet settings are located under WordPress console -> GiveWP -> Settings -> Advanced -> Akismet SPAM Protection. Here is full guide how to setup protection.
    2. Honeypot anti-spam techniques protect websites by adding invisible form fields that real users never see but spambots automatically fill in. When these hidden fields are completed, the submission is flagged and blocked, stopping spam without CAPTCHAs or user interaction. GiveWP has built-in honeypot which is located under settings WordPress console -> GiveWP -> Settings -> Security -> Enable Honeypot Field. This option is On in default setting, so should filter some primitive spam bots out of the box.
    3. reCAPTCHA is a spam protection technology by Google that helps protect WordPress websites by distinguishing real users from bots using challenges or behavioral analysis. It reduces automated spam submissions but may require user interaction, such as clicking a checkbox or solving a challenge. GiveWP supports reCaptcha in the core and settings are located by path WordPress console -> GiveWP -> Settings -> General -> Access Control -> reCaptcha. The first step to activate this protection is getting Site and Secret keys, which are available on website.
    4. Turnstile by Cloudflare is another great anti-spam tool which is available for GiveWP. Protects WordPress websites by verifying visitors automatically without CAPTCHAs or puzzles. It blocks bots using browser and behavioral signals while keeping the experience seamless for real users. One drawback is to use Turnstile user must install extra plugin – ‘Give – Cloudflare Turnstile’. The full guide is here.
    5. And we have bunch of standalone, universal, all-in-one plugins like Zero Spam, OOPSpam, hCaptcha for WP which provide anti-spam protection for GiveWP as well. Here is a link to download one of them.

    Here are screenshots for tools above.

    I have questions… (FAQ)

    Does CleanTalk protect against donors emails leak?

    In July 2025, a vulnerability in GiveWP led to an email data leak of Pihole donators. Yes, Anti-Spam by CleanTalk helps protect against such issues. In this case, email addresses were exposed in the HTML code, even though they were invisible on public pages. The plugin prevents this by obfuscating email addresses by default.

    We received hundreds of spam donations immediately after installing GiveWP plugin. How to fix it?

    If you do not have specific anti-spam tool installed. Increasing the minimum donation amount can help stop spam, as bots usually test forms with small payments like $1–$5. Setting a $10+ minimum helps filter out these low-effort automated attacks.

    A donor is trying to submit recurring donations but the transaction isn’t being processed because the donor’s email is considered spam.

    False/positives sometimes happen. In this case just post a support ticket or put this donor in Allow list.

    Final thoughts

    I hope this guide helped resolve all spam issues on your donation form. If not, Sign Up for an account and our CleanTalk team will be happy to help.

    Stop spam without frustrating your visitors

    Create your CleanTalk account and start blocking spam donations — no CAPTCHA challenges and no impact on visitors.

    CleanTalk Account

    No credit card required • Setup takes less than a minute • Your temporary password will be sent by email.

  • WPForms Spam Protection in 2026

    WPForms Spam Protection in 2026

    If you use WPForms for contact forms, lead generation, surveys, or payment forms, you will eventually face spam – fake submissions, junk leads, and bot activity.

    This guide explains how to set up WPForms spam protection using:

    • the Anti-Spam plugin by CleanTalk with a direct integration for WPForms, and
    • additional tools like Google reCAPTCHA, hCaptcha, Cloudflare Turnstile, honeypots and third-party anti-spam plugins.

    The integration protects WPForms forms such as:

    • simple contact forms,
    • marketing and lead forms,
    • “Request a quote” and booking forms,
    • registration / login / newsletter forms (where used with WPForms).

    WPForms continues to handle the form UI and workflow, while CleanTalk filters spam in the background without adding CAPTCHAs to every form.

    image

    WPForms – Easy Form Builder for WordPress

    First, let’s quickly look at WPForms itself and the types of sites that rely on it.

    WPForms is a popular drag-and-drop form builder plugin for WordPress that lets you create:

    • contact and feedback forms,
    • quote and booking forms,
    • newsletter and marketing forms,
    • payment / donation forms (Stripe, PayPal, etc.),
    • surveys, polls, and custom calculators,
    • login, registration, and other application-style forms.

    Out of the box WPForms provides:

    • a visual drag-and-drop builder and 2000+ pre-built form templates,
    • responsive, mobile-friendly layouts,
    • built-in spam protection (anti-spam token and optional honeypot),
    • integrations with major email marketing services and CRMs,
    • payment integrations with Stripe, PayPal, Square, and others.

    Because WPForms forms are often publicly accessible (contact pages, landing pages, sign-up forms), they become an easy target for spam bots and human spammers. That’s why it’s important to have a reliable WPForms spam protection setup from the beginning.

    As WordPress.org shows, WPForms Lite is currently active on over 6 million websites and has 14,274 user reviews with an average rating of 4.8 out of 5.

    Plugin Homepage at wordpress.org | Website wpforms.com

    Install WPForms and create your first form

    You can set up WPForms in just a few steps:
    1. In your WordPress admin go to
      Plugins → Add New and search for “WPForms”.
    image
    1. Click Install and then Activate the plugin.
    2. Customize the fields as needed and click Save.
    3. Embed the form on a page using the WPForms block in the editor or the form shortcode.
    Untitled design (8)

    After that, your first WPForms form is live and ready to accept submissions.

    Anti-Spam plugin by CleanTalk for WordPress

    The next tool we’re going to use is the Anti-Spam plugin by CleanTalk.
    Here’s a brief overview:

    • CleanTalk is a cloud-based spam protection platform for websites, operating since 2012.
    • It filters spam without CAPTCHAs, challenge questions or image puzzles, so visitors don’t have to solve anything extra.
    • It protects many kinds of forms: comments, user registrations, contact forms, orders, subscriptions, surveys, and more.
    • It blocks both automated bots and human spammers using advanced filtering algorithms and data from a global spam database.
    • It detects spam based on IP reputation, email reputation and behavioral patterns.
    • It allows you to set custom rules and block by IP, email address, country or language when needed.
    • It runs quietly in the background, and the plugin is straightforward to install and configure.

    According to WordPress.org, Anti-Spam by CleanTalk for WordPress has over 200,000 active installations, with 3,168 reviews and an average rating of 4.7.

    Plugin Homepage at cleantalk.org | Latest release at GitHub.com

    Install the CleanTalk Anti-Spam plugin

    To install the Anti-Spam plugin, go to your WordPress admin panel → Plugins → Add New.

    forminator-spam-protection

    Then enter «СleanTalk» in the search box and click the Install button for «Spam protection, Anti-Spam, FireWall by CleanTalk».

    testing-forminator-spam-protection

    After installing the plugin, click the «Activate»‎ button.

    testing-forminator-spam-protection

    After it is done go to the plugin settings and click the «Get Access Key Automatically» button. Then just click the «Save Settings»‎ button.

    forminator-spam-protection

    That’s all –  WPForms are now protected From this moment,CleanTalk automatically protects the  WPForms registration form (REST route /wp-json/wpformspress/v1/users/), and the Add Listing form used to submit new listings.

    You don’t need to paste any shortcodes – just use  WPForms as usual, and CleanTalk will filter spam in the background.

    Check if spam protection works with WPforms.

    The best way to text the spam protection by using a test email,

    stop_email@example.com

    1. Open a page with a WPForms (for example, the registration popup or the Add Listing form) in an Incognito / private browser tab.
    2. Fill out the Contact form using stop_email@example.com as sender’s email.
    3. Send the form.
    4. You should see a message from the Anti-Spam plugin confirming that a spam submission was blocked.

    *** Forbidden. Sender blacklisted. Anti-Spam by CleanTalk. ***

    image

    If you see this message, it means CleanTalk successfully protects your WPForms (registration and Add Listing) from spam.

    Cloud Dashboard

    In addition, in the Cloud Dashboard you can find extra details regarding all submissions processed by CleanTalk, including WPForms registration and Add Listing forms:

    • IP and email of the sender, as well as the sender’s activity history across other websites connected to the CleanTalk cloud.
    • Geolocation of the sender.
    • Date and time of the submission.
      Page (URL) where the form was submitted (for example, a specific listing submission page).
    • Cloud decision – Approved or Denied.
    • Cloud explanation for the decision (e.g. blacklisted email, bad IP reputation, spam text, etc.).
    • Tools to move the sender to Block or Allow lists so you can fine-tune  WPForms spam protection.

    Google reCAPTCHA, hCaptcha, and Cloudflare Turnstile in WPForms

    In addition to CleanTalk, WPForms itself supports several CAPTCHA and anti-bot services:

    • Google reCAPTCHA,
    • hCaptcha,
    • Cloudflare Turnstile.

    These services act as a visible or invisible verification layer on top of your forms, while CleanTalk continues to filter spam submissions in the background.

    Google reCAPTCHA (WPForms integration)

    WPForms has built-in support for Google reCAPTCHA (v2 Checkbox, v2 Invisible, and v3):

    1. Register your website in the Google reCAPTCHA admin console and generate a Site Key and Secret Key.
    2. In WordPress go to WPForms → Settings → CAPTCHA.
    3. Choose reCAPTCHA as the provider and paste your keys.
    4. Select which reCAPTCHA type you want to use (checkbox, invisible, or v3 score-based).
    5. Edit your forms and enable reCAPTCHA where needed (WPForms shows a toggle or field depending on the type).

    reCAPTCHA helps block obvious automated submissions by requiring users to solve a challenge or by scoring their behavior, while CleanTalk still checks the content and sender reputation.

    hCaptcha

    WPForms also supports hCaptcha as a privacy-focused alternative to Google reCAPTCHA:

    Key benefits of hCaptcha compared to reCAPTCHA:

    • Stronger focus on privacy – hCaptcha collects less user tracking data, which is important for privacy-oriented and GDPR-sensitive projects.
    • Less dependence on Google – useful for brands that prefer to minimize their reliance on Google infrastructure.
    • Optional monetization options for some hCaptcha plans, which reCAPTCHA doesn’t provide.

    To use hCaptcha with WPForms:

    1. Obtain Site Key and Secret Key from the hCaptcha dashboard.
    2. Go to WPForms → Settings → CAPTCHA, choose hCaptcha and paste the keys.
    3. Enable hCaptcha for the forms you want to protect.

    Cloudflare Turnstile

    Cloudflare Turnstile is a quite modern CAPTCHA alternative that often works invisibly in the background, without classic image puzzles. Several WPForms guides cover how to enable Turnstile as a built-in CAPTCHA provider.

    Benefits of Cloudflare Turnstile:

    • Invisible verification – most visitors don’t see any challenge; Turnstile works in the background.
    • Higher completion rates – fewer puzzles means less friction and fewer abandoned forms.
    • Privacy-friendly design – Turnstile is built to minimize user tracking and profiling compared to traditional CAPTCHAs.

    To connect Turnstile:

    1. Get Site Key and Secret Key from your Cloudflare Turnstile dashboard.
    2. In WPForms → Settings → CAPTCHA, select Cloudflare Turnstile and enter your keys.
    3. Enable Turnstile on the forms (contact, registration, checkout, etc.) where you need extra bot protection.

    All three CAPTCHA providers can work alongside CleanTalk Anti-Spam, giving you both:

    • a front-end bot check (CAPTCHA / Turnstile), and
    • deep cloud-based spam filtering in the background.

    Honeypot, WPForms Built-In Anti-Spam, Akismet and Third-Party Plugins

    Alongside CleanTalk and CAPTCHAs, WPForms and WordPress offer several additional anti-spam layers.

    WPForms Anti-Spam Token and Honeypot

    By default, WPForms includes:

    • an anti-spam token that helps block automated form submissions, and
    • an optional honeypot field – a hidden field that humans never see, but bots often fill in.

    When a bot fills the honeypot field or fails the token check, WPForms treats the submission as spam and blocks it.

    You can control these options in each form’s Settings → Spam Protection and Security section inside WPForms.

    Honeypot protection is:

    • invisible for normal visitors,
    • easy to enable,
    • a lightweight extra defense against primitive bots.

    Akismet

    Akismet Anti-Spam is another popular plugin that filters spam by checking submissions against a global spam database. It is especially useful for blog comments and simple contact forms outside WPForms.

    On a site that uses WPForms + CleanTalk you can still use Akismet to:

    • keep comment sections clean,
    • filter spam from default WordPress forms or other plugins.

    To activate Akismet:

    1. Install and activate Akismet Anti-Spam from Plugins → Add New.
    2. Obtain an API key from Akismet and enter it in the plugin settings.
    3. Enable spam checking for the content types you need (comments, possibly other forms).

    Other universal anti-spam plugins

    Plugins like WP Armour, OOPSpam, Maspik, and Simple CAPTCHA Alternative provide generic honeypot or anti-spam protection for various forms and comment areas across WordPress.

    They can be used alongside CleanTalk if you want additional defense for:

    • contact forms created outside WPForms,
    • comments,
    • custom theme forms and widgets.

    You can find them via:

    Plugins → Add New → Search → “WP Armour” | “OOPSpam” | “Maspik” | “Simple CAPTCHA Alternative”

    Install, activate, and configure each plugin according to its documentation.

    Frequently Asked Questions (FAQ)

    I already use WPForms’ built-in anti-spam. Do I really need CleanTalk?

    WPForms includes an anti-spam token and optional honeypot, which is great for stopping very basic bots.
    However, they don’t:

    • check global spam activity across thousands of sites,
    • analyze IP and email reputation,
    • or block known spam networks at the cloud level.

    CleanTalk adds an extra layer on top of WPForms’ native tools. It filters submissions using a global spam database and the SpamFireWall, so most spam is blocked before it reaches your entries, inbox or CRM.

    Will CleanTalk slow down my WPForms submissions?

    No. CleanTalk is designed to work in the background and the request to the cloud is lightweight.

    From the visitor’s point of view:

    • they fill out the WPForms form as usual,
    • click submit,
    • and either see a normal success message or an anti-spam message if they are blocked.

    For normal users, there are no extra steps, pop-ups or CAPTCHAs to solve.

    Can CleanTalk protect all my WPForms forms or only the main contact form?

    Once the Anti-Spam plugin is installed and connected to the CleanTalk cloud, it can protect any WPForms form that uses the standard WPForms processing flow:

    • simple contact forms,
    • quote / booking / consultation forms,
    • lead generation and newsletter sign-up forms,
    • surveys, polls and feedback forms.

    You don’t need to add a special field to each form – protection works on the server side.

    What happens to blocked WPForms submissions? Are they lost forever?

    When CleanTalk blocks a submission, the user is shown an anti-spam message and the entry is not stored as a normal form submission.

    However, the attempt is:

    • logged in your CleanTalk dashboard with IP, email, date, URL and the reason,
    • available for review if you suspect a false positive,
    • easy to whitelist (by IP, email, country, etc.) if you decide that a sender is legitimate.

    So you still have visibility into what was blocked, but your WPForms entries, inbox and CRM stay clean.

    Recommended Anti-Spam Stack for WPForms (2026)

    No single tool can block every kind of spam or bad bot. The most reliable approach for WPForms is to build a layered anti-spam stack, where each component handles a different part of the problem.

    The key element is the Anti-Spam plugin by CleanTalk, which:

    • integrates directly with Contact Form by WPForms,
    • uses both application-level checks and the SpamFireWall to block many bots before they reach WordPress.

    On top of this, you can combine CAPTCHAs, WPForms’ built-in tools, and moderation policies.

    Recommended setup by site type

    Business websites and standard contact forms

    • CleanTalk Anti-Spam enabled (with SpamFireWall).
    • WPForms anti-spam token + honeypot enabled in each important form.
    • Optionally, Google reCAPTCHA or Cloudflare Turnstile on high-risk forms (contact, quote, booking).

    High-traffic landing pages and lead generation

    • CleanTalk Anti-Spam (cloud + plugin).
    • Cloudflare Turnstile or reCAPTCHA for minimal-friction verification.
    • WPForms honeypot enabled.
    • Optional extra filters: block high-risk countries or networks in CleanTalk if you notice patterns in spam logs.

    Membership / registration-heavy sites using WPForms

    • CleanTalk Anti-Spam to protect registration, login, and profile forms where applicable.
    • Cloudflare Turnstile or hCaptcha on registration / login forms for additional protection.
    • WPForms built-in spam protection turned on for all authentication forms.
    • Optionally, Akismet or other plugins for comments and non-WPForms areas.

    By this point, most spam problems in your WPForms contact, lead, survey, and payment forms should be significantly reduced. If you’re still seeing unwanted submissions, simply create a CleanTalk account (or log in to your existing one) and reach out to our support team – we’ll gladly help you fine-tune WPForms spam protection for your specific site.

    Stop WPForms spam without hurting conversions

    Create your CleanTalk account and connect it to WPForms to block spam contacts, leads, surveys and payment forms — no extra CAPTCHAs and no friction for real users.

    CleanTalk Account

    No credit card required • Setup takes less than a minute • Your temporary password will be sent by email.

  • Avada Form Builder – Spam protection guide in 2026

    Avada Form Builder – Spam protection guide in 2026

    Avada Form Builder is a great choice when you need to create contact forms, surveys, quizzes, and more. In this post, we will review available anti-spam services such as Google reCAPTCHA and Cloudflare Turnstile, tools like honeypots, and anti-spam plugins including CleanTalk, Akismet, hCaptcha, and OOPSpam available to Avada users as of March 2026.

    Avada Form Builder https://avada.com/feature/form-builder/
    Avada Form Builder https://avada.com/feature/form-builder/

    Avada Form Builder, Avada Website Builder, Avada WordPress Theme and Plugins

    First, let’s take a closer look at what Avada is and how it works.

    Avada Form Builder is a flexible drag-and-drop form solution built directly into the Avada WordPress theme, allowing users to create contact forms, registration forms, surveys, polls, quizzes, feedback forms, and other interactive form types without installing additional plugins. It offers an intuitive visual interface that makes form creation fast and accessible for both beginners and experienced website owners. To help protect websites from unwanted submissions, Avada Form Builder supports built-in spam protection features and integration with popular anti-spam services such as Google reCAPTCHA, Cloudflare Turnstile. With proper spam protection enabled, website owners can reduce bot submissions, fake registrations, and malicious form activity while maintaining a smooth experience for real visitors. This improves data quality, saves administrative time, and keeps communication channels reliable.

    In my personal opinion, Avada is a very flexible theme that offers many features out of the box. However, one downside is that it may require some time to build and launch the first version of a website using this theme. I spent more than hour to launch a demo site (including purchasing the theme), it’s much more my average installation process for a theme, which usually takes 10-15 minutes.

    The theme is premium and costs $69, with 6 months of support included. Its official website is avada.com, and it can be purchased and downloaded from Envato Market. Envato Market shows 1,054,005 sales, 26.5k reviews with average score 4.78.

    Anti-Spam plugin by CleanTalk

    As the anti-spam solution, I’m going to use the Anti-Spam by CleanTalk plugin for WordPress. Let’s see what this plugin is.

    Anti-Spam by CleanTalk is a cloud-based spam protection plugin that automatically blocks spam submissions on WordPress websites without using CAPTCHAs. It protects contact forms, registration forms, comments, surveys, polls, and other interactive elements from both automated bots and manual spam. Avada users can also protect Avada Form Builder forms, including contact forms, feedback forms, surveys, and registration forms, without adding extra CAPTCHA challenges for visitors. The service analyzes submissions using advanced filtering algorithms and a global spam database that tracks suspicious activity by IP addresses, email addresses, and other parameters. CleanTalk works in the background, allowing real visitors to submit Avada forms normally while blocking spam attempts automatically. Website owners can also review detailed logs of blocked submissions and manage personal allow and deny lists for IP addresses, email addresses, and countries.

    According to WordPress.org, Anti-Spam by CleanTalk for WordPress has over 200,000 active installations, with 3,168 reviews and an average rating of 4.8.

    Plugin Homepage at cleantalk.org | Latest release at Github.com | Website cleantalk.org

    How to install CleanTalk Anti-Spam plugin

    Click to see the Installation guide.

    To install the Anti-Spam plugin, go to your WordPress admin panel → Plugins → Add New.

    Then enter «СleanTalk» in the search box and click the Install button for «Spam protection, Anti-Spam, FireWall by CleanTalk».

    After installing the plugin, click the «Activate»‎ button.

    After it is done go to the plugin settings and click the «Get Access Key Automatically» button. Then just click the «Save Settings»‎ button.

    That’s it! From now your WordPress website and Avada forms are protected from spam.

    How to check spam protection

    You can test the work of anti-spam protection for your Avada forms by applying a test email,

    stop_email@example.com

    Test sequence is,

    1. Open a page with your form in Incognito Window.
    2. Fill out the form with any valid data plus stop_email@example.com in the Email field.
    3. Submit the form.
    4. You should get a message like this,

    *** Forbidden. Sender blacklisted. Anti-Spam by CleanTalk. ***

    Spam (test) submission is blocked at Avada form.
    Spam (test) submission is blocked at Avada form.

    Cloud Dashboard

    In the Cloud Dashboard you can find extra details regarding all submissions made via form,

    • IP, Email of the sender. As well as history of activity a sender among other sites connected to CleanTalk’s cloud. Geolocation of the sender. Date and time of submission.
    • Tools to move the sender to Block or Allow lists.
    Cloud Dashboard, Anti-Spam Log, spam submission is blocked for an Avada form.
    Cloud Dashboard, Anti-Spam Log, spam submission is blocked for an Avada form.

    If you have any questions, add a comment and we will be happy to help you.

    Create your Cleantalk account – Register now and enjoy your spam-free Avada forms.

    You may view a complete list of CleanTalk Anti-Spam plugin features here. https://cleantalk.org/help/introduction 

    Google reCAPTCHA, and Cloudflare Turnstile

    There are two anti-spam services integrated into the Avada forms core,

    1. Google reCAPTCHA is the first services, that we have in the core. By analyzing user behavior and verifying whether a visitor is human, reCAPTCHA adds an extra layer of security to contact forms, registration forms, surveys, and other form types created with Avada. It is widely used and easy to integrate, making it a convenient option for many website owners. reCAPTCHA can help reduce the number of fake submissions and automated attacks targeting Avada forms. However, depending on the version used, it may also add additional steps for visitors, such as solving challenges or running background behavioral analysis.
      • Service is available under settings Settings are under path WordPress console -> Avada > Maintenance -> Forms -> Google reCaptcha.
      • To activate this service obtain Site key and Secret key on the site.
    2. Cloudflare Turnstile provides an easy way for Avada Form Builder users to protect their forms from automated spam and bot submissions. Unlike traditional CAPTCHAs, Turnstile verifies visitors quietly in the background, helping reduce friction for real users filling out contact forms, registrations, surveys, or polls created with Avada. It integrates easily into websites and focuses on privacy by avoiding invasive tracking methods. For Avada users, this means stronger bot protection while maintaining a smoother and more user-friendly form experience.
      • Main benefits of Cloudflare Turnstile over Google reCAPTCHA.
        • One of the main benefits is a better user experience, as Turnstile verifies visitors automatically in the background without showing image puzzles or interactive challenges.
        • It also focuses more on privacy, because it does not rely on extensive user tracking or Google cookies.
        • Turnstile is designed to be lightweight and fast, which can help maintain page performance on Avada-based websites.
      • Service is available under settings Settings are under path WordPress console -> Avada > Maintenance -> Forms -> CloudFlare Turnstile.
      • Site Key and Secret key can be obtained on site.
    Screenshot 2026 03 04 at 11.13.05 PM
    Cloudflare Turnstile settings. Avada theme.
    Screenshot 2026 03 04 at 11.13.12 PM
    Google reCAPTCHA settings. Avada theme.

    Honeypot, Akismet, and Anti-Spam plugins

    Here we have few additional anti-spam mechanics available for Avada users.

    1. Akismet is one of the most popular anti-spam services for websites, with background spam checking as its key feature. Unfortunately,Akismet is not available for Avada users, either as an element or as an integration within the plugin, and I have found no evidence that such integration exists.
    2. Honeypot is a simple anti-spam technique that works silently in the background. It adds an invisible field to your Avada forms that real visitors never see, but spam bots often fill out automatically. When the hidden field is completed, the submission is identified as spam and blocked before it reaches your website. The main benefit for Avada users is that honeypot protection does not require CAPTCHA or extra steps from visitors, helping keep the form experience fast and user-friendly while reducing automated spam.
      • This technique works through a form element. This is the best guide to activate a honeypot for your form
    3. Also in the market we have universal, anti-spam plugins SilentShield, OOPSpam, hCaptcha and a few more that protects Avada users against spam. These plugins are listed in wordpress.org.
    SilentShield, OOPSpam, hCaptcha as anti-spam plugins for Avada users.
    SilentShield, OOPSpam, hCaptcha as anti-spam plugins for Avada users.

    Frequently Asked Questions (FAQ)

    Is WP Armour compatible with Avada?

    There is no evidence that WP Armour support Avada users.

    I have problems with the reCaptcha, I have registered and put the key ods, but it’s not working. 

    You have to all the form elements enabled from the builder options. Here is the guide.

    Does this come with captcha? or can google captcha work and be added to contact form?

    Yes, you can definitely add Google reCaptcha to your contact form or login element with Avada.

    Recommended Anti-Spam Stack for Avada Form Builder (2026)

    Finally, here in March 2026 I can recommend the following anti-spam stack for Avada users.

    1. Small Websites and Personal Blogs: CleanTalk Anti-Spam + Avada Honeypot field.
      • For small websites, portfolios, and personal blogs using Avada Form Builder, CleanTalk alone is often enough to stop most automated spam and manual submissions.
    2. High-Traffic Websites, Agencies: CleanTalk Anti-Spam + Cloudflare Turnstile + CleanTalk personal allow/deny lists.
      • High-traffic Avada websites and agency projects often experience both automated and manual spam attacks. In this setup, CleanTalk performs the main filtering, SpamFireWall blocks bot traffic early, and Turnstile provides an additional verification step for sensitive forms such as registrations or payments. Website administrators can further refine protection using CleanTalk’s logs and personal filters by IP address, email, or country.

    By this point, spam issues should be resolved on your site. If not, Sign Up for an account and our support team will be happy to help you.

    Stop spam without frustrating your visitors

    Create your CleanTalk account and start blocking spam forms, surveys, polls and quiz answers — no CAPTCHA challenges and no impact on visitors.

    CleanTalk Account

    No credit card required • Setup takes less than a minute • Your temporary password will be sent by email.

  • reCAPTCHA v3 always returns 0.9 score. Avoid false positives

    reCAPTCHA v3 always returns 0.9 score. Avoid false positives

    Many reCAPTCHA v3 users complain about always receiving a score of 0.9 despite multiple attempts and changes in their Google Cloud integration. In this article, we reproduce this issue and explain why reCAPTCHA always returns a score of 0.9.

    reCAPTCHA v3 always returns 0.9 score

    Research Objective

    Users complain that when testing reCAPTCHA v3, they always receive the same score of 0.9. However, in the same environments with reCATPCHA v2, the score varies.

    What is a Score?

    The score is the result of the reCAPTCHA check. The closer it is to 1, the more likely the visitor is human. The closer it is to 0, the more likely the visitor is a bot.

    How reCAPTCHA v3 Works

    Note: The following findings are based on publicly available code and our interpretation.

    1. A user integrates the ReCaptcha script on a form page.
    2. A unique frontend token is added to each form.
    3. The script loads additional obfuscated code.
    4. The obfuscated code collects frontend data (a “black box” not accessible due to Google’s code obfuscation).
    5. Aggregated and encoded data + frontend token is sent to Google’s cloud to get a result token.
    6. The result token is sent to the backend of the testing environment.
    7. The backend validates the token via Google’s API, sending the backend token, result token, and the visitor’s IP address.
    8. Based on the score result, the backend environment can decide whether to allow the visitor to proceed.

    The backend environment decides whether to allow the visitor to proceed based on the score.

    We believe reCAPTCHA v3 relies on machine learning based on the traffic environment. The exact decision-making algorithms are proprietary and remain a trade secret of Google.

    Why You Always Get a Score = 0.9 in reCAPTCHA v3

    ReCaptcha v3 relies on machine learning based on traffic data.

    A consistent score of 0.9 indicates the system lacks sufficient data about your typical traffic to make an accurate decision. To avoid false positives, the system grants a 0.9 score to all visitors until trained.

    Why You Get Score <> 0.9 in reCAPTCHA v2

    ReCaptcha v2 does not use machine learning for decision-making. It operates in one of two modes:

    1. in the user interaction mode (presence of click-the-flag mechanism on the page).
    2. In silent mode (reCaptcha v2 badge on the page).

    The data collection and processing occur in real time, allowing for accurate, immediate results. Learn more: https://developers.google.com/recaptcha/docs/versions.

    Our Testing Process

    Test Environment

    • A PHP website running WordPress 6.2.
    • ReCaptcha v3 integrated according to instructions.

    Bot

    A simple bot created in Python using Selenium. The bot was run from three IP addresses, emulating the following parameters

    • headless
    • user agents
    • headers
    • clicks
    • form submissions

    Process

    The bot ran for 24 hours, performing sequential visits and form submissions with random parameters. No live traffic was sent to the site.

    Results

    • All bot requests returned a score of 0.9.
    • The score did not change over time.
    • No statistics appeared in Google Analytics.
      We hypothesize that traffic presence, volume, and quality in Google Analytics may act as a training marker for the ReCaptcha system.

    How to Get an Accurate Score in a Test Environment

    The reCAPTCHA v3 model assumes long-lasting training on live traffic. This means that the test environment must be loaded in the same way as the production environment. Which will undoubtedly cause some difficulties in deploying such an environment and getting the payload.

    We believe that to get the right score a user will have to turn to testing in a productive environment. However, the policy of most companies we know of (including CleanTalk of course) restricts any testing in a production environment.

    Unfortunately, we couldn’t find specific terms for the duration of training in Google’s official documentation. We believe that the duration of training depends on the following parameters:

    • Traffic load
    • Ratio of bots to real users
    • Percentage of “intelligent” bots among total bot traffic

    Without live traffic, no settings or configurations will yield an accurate score in a test environment.

    If you keep getting a repeated 0.9 score and want to inspect what your environment is actually returning, try our reCAPTCHA v3 score test. It helps you review not only the score itself, but also the validation details behind it.

    CleanTalk’s Solutions

    If you would like to try a reCAPTCHA alternative, please find more details about CleanTalk’s solutions below. There, we explain how to use the API, plugins, and ready-to-use libraries to protect against spam bots without issues such as a 0.9 score being assigned to every visit.

    Here we show all the differences between CleanTalk as reCAPTCHA alternative.

    CleanTalk Check Bot

    • Decisions are made online without machine learning.
    • Simpler integration—no need to manually add tokens to forms.
    • Extensive documentation available: GitHub CleanTalk API
    • Immediate and relevant testing results.
    • Technical support response within 24 hours.

    Anti-Spam Cloud for CMS

    CleanTalk provides a cloud-based Anti-Spam service for websites, blocking spam in real time without CAPTCHAs. It integrates with CMS platforms like WordPress, Drupal, Joomla, and etc. Securing comments, registrations, and contact forms. Features include SpamFireWall, email validation, and detailed logs, ensuring seamless protection and improved user experience.

    The best way to connect your site is to install one of our Anti-Spam plugins.

    Anti-Spam CleanTalk API

    CleanTalk offers a suite of APIs that integrate anti-spam functionalities into various applications. The Anti-Spam API includes methods like,

    The Database (Blacklists) API provides

    • spam_check() to verify IP and email records against CleanTalk’s database;
    • backlinks_check() to detect domains associated with spam;
    • the ip_info() method returns country codes for IP addresses.

    For managing personal lists and uptime monitoring, the Dashboard API offers dedicated methods. These APIs enable developers to enhance their applications’ security and spam prevention capabilities effectively.

CleanTalk

About

Create a support ticket

Contact us

Dashboard

Sign up / Sign in

Anti-Spam

Anti-Spam for Websites

Anti-Spam API

Best Anti-Spam Plugins in 2026

IP Checker

Email Checker

Filter fake emails

Hide contact data

Security

Website Malware Scanner

WordPress Malware Removal

WordPress Security Plugin