WPZOOM Forms protects your forms in layers: an invisible honeypot on every form, an optional CAPTCHA (Google reCAPTCHA or Cloudflare Turnstile), automatic Akismet filtering, and a Spam folder where suspicious entries wait for review instead of disappearing. This guide explains each layer, how to set it up, and how to deal with spam that still gets through.
Table of Contents
| Layer | Where | Scope | What happens to a blocked submission |
|---|---|---|---|
| Honeypot | Builder → Settings → Enable spam honeypot field | per form (default on) | Silently discarded — the bot sees a “success” message, nothing is stored or emailed |
| reCAPTCHA / Turnstile | WPZOOM Forms → Settings → Spam Protection | global, one service for all forms | Submission is rejected with an error; nothing stored |
| Akismet | automatic when the Akismet plugin is active | global | Stored with the Spam status, not emailed; you can review and restore |
| Manual | Submissions list | per entry | Mark as Spam / Not Spam, Delete All Spam |
Use the honeypot always, add one CAPTCHA service for bot traffic, and Akismet for human-written spam.
Every form created in the 2.0 builder includes a hidden field that visitors never see but bots tend to fill in. It is enabled per form under Settings → Enable spam honeypot field in the builder and needs no configuration.
Leave it on unless you are debugging a submission problem.
reCAPTCHA is configured once under WPZOOM Forms → Settings → Spam Protection and applies to every form.
Which type?
localhost / staging domains if you test there).
Turnstile is a privacy-friendly alternative: no cookies, no tracking, and usually no interaction — it runs a quick check and only shows a challenge when needed.
The widget’s look (light/dark, size) is controlled by the mode you picked in Cloudflare; the Widget Theme setting applies only to forms created with WPZOOM Forms 1.x.
Akismet filters content, so it catches human-written spam that CAPTCHAs let through. WPZOOM Forms integrates automatically:
CleanTalk Anti-Spam has a direct integration with WPZOOM Forms (since July 2025): install it, enter your CleanTalk access key and make sure Contact Forms protection is enabled in its settings. It checks submissions invisibly against CleanTalk’s database and works alongside the honeypot, a CAPTCHA and Akismet. Other anti-spam plugins that hook into generic form submissions may work as well, but are not tested by WPZOOM.
Anything Akismet flags (or you mark) sits in WPZOOM Forms → Submissions → Spam:
Details in Managing Form Submissions.
| Situation | Suggested setup |
|---|---|
| Most sites | Honeypot + reCAPTCHA v3 or Turnstile + Akismet |
| Privacy-sensitive / EU audience | Honeypot + Turnstile (no cookies, no tracking) + Akismet |
| Heavy targeted spam | Honeypot + reCAPTCHA v2 checkbox (forces interaction) + Akismet, review Spam weekly |
| Intranet / low traffic | Honeypot only |
All CAPTCHA scripts load only where a form is rendered (or everywhere if Load assets on all pages is on); Akismet checks run server-side, so none of this slows pages without forms.
Privacy: reCAPTCHA sends behavioural data to Google and Turnstile to Cloudflare; Akismet and CleanTalk receive the submitted content. Mention the services you use in your privacy policy. Keys are stored in your WordPress database like other plugin settings — don’t share exports of your options table.
The CAPTCHA widget doesn’t show up
– Keys pasted into the wrong fields (v2 vs v3), or a domain missing in the Google/Cloudflare console.
– The page is built with a page builder/widget and the plugin’s scripts aren’t loaded — turn on Settings → General → Load assets on all pages.
– A caching or JavaScript-optimisation plugin delays the script; exclude recaptcha/api.js / challenges.cloudflare.com from deferral, and clear caches.
– Check the browser console for errors.
“ERROR for site owner: Invalid key type” on the widget The reCAPTCHA v2 keys were created as Invisible; 2.0 forms need “I’m not a robot” Checkbox keys (see Step 1). Create a new key pair of the right type.
Real visitors are rejected (false positives) – reCAPTCHA v3 scores under 0.5 are rejected and the threshold can’t be changed — switch to Turnstile or v2 if your audience (VPNs, privacy browsers) scores low. – Check the Spam view: if entries land there, it’s Akismet, not the CAPTCHA — restore them with Mark as Not Spam so Akismet learns.
The form doesn’t submit at all after enabling protection
– Verify the Secret Key; for Turnstile use the Widget Preview on the settings page, which tells you whether the secret is accepted.
– Your server must be able to reach www.google.com / challenges.cloudflare.com (outbound connections, cURL). System Status (PRO) shows whether cURL is enabled.
– Temporarily select None, save, and test — this isolates the CAPTCHA from other causes.
Using two services at once Only one CAPTCHA service can be active. Akismet, CleanTalk and the honeypot always work in addition to it.
What’s Next?