Five layers check every submission. Visitors never see a puzzle.
The five built in layers:
- Honeypot: an invisible field that only bots fill in. A bot that fills it is shown the normal thank you and nothing is stored, so it learns nothing about your protection.
- Time trap: a form sent faster than the minimum, 3 seconds by default, is turned away with "That was a little too fast. Please try again." The time is measured by the visitor's own browser from the moment the form appeared, so a visitor whose computer clock is wrong is never affected.
- Rate limit: 10 submissions per 5 minutes from the same visitor address, then "Too many submissions. Please wait a few minutes."
- Duplicate guard: the identical answers from the same visitor within 10 minutes are not stored twice. The visitor simply sees the normal thank you again, which is what someone who double clicked expects.
- Word blocklist: your own filter.
Your settings:
Open Settings, Spam protection.
- "Word blocklist (one word or phrase per line)": a submission containing any of them, anywhere, in capitals or not, is refused with "Your submission could not be accepted."
- "Minimum seconds to fill a form": from 0 to 30. "3 is a good default; 0 turns the trap off." If real visitors on a very short form report the too fast message, lower it.
Google reCAPTCHA v3 (optional, off by default):
Invisible scoring, no puzzles.
- Get free keys at google.com/recaptcha/admin and choose reCAPTCHA v3.
- Paste the "Site key" and "Secret key" into Settings, Spam protection. "Minimum score (0 to 1)" starts at 0.5, and higher is stricter.
- In the builder, tick "Google reCAPTCHA v3 on this form" in the Style panel of each form that should use it.
Google's script loads only on pages that carry one of those forms. Each answer from Google is checked to be for your site and for this form before it counts. A visitor who fails the check sees "We could not verify you are human. Please reload the page and try again." If Google cannot be reached, the submission is allowed through and the five built in layers still apply, so a Google outage never costs you a lead.
Your reCAPTCHA secret key stays secret:
Once saved, the secret key is never shown on the page again. The box shows only a masked hint that a key is saved, beginning "Saved:". Leave the box blank to keep the saved key, or paste a new one to replace it. To take it away, tick "Remove the saved secret key" and save.
Akismet (optional, off by default):
If the separate Akismet plugin is installed with its own API key, tick "Check every submission against Akismet". Submissions are then also checked by Akismet under your own Akismet account. Until Akismet is set up the box stays greyed out.
Caching:
Forms are recognised by a private token built into each form, not by a short lived security code, so they keep working on pages served from a full page cache.
With reCAPTCHA and Akismet both left off, all spam checking happens on your own site. The Diagnostics tab shows which optional layers are active, and its error log notes submissions turned away by the time trap, your blocklist or Akismet, so you can tell whether a real visitor was caught.