Overview
Spam eventually affects all publicly accessible forms, and combating it is difficult due to the ever-evolving tactics used by spammers and bots. No single method can catch 100% of spam, so for optimal results, it’s recommended to use multiple solutions simultaneously.
The FAQ below groups common spam problems and lists the add-ons and features best suited to each. For built-in spam protection and detection features, as well as other tips, see the First Steps article.
How to catch spam from bots
Advanced Honeypot
A built-in Gravity Forms feature is available in the Spam Detection section of each form’s Form Settings. When enabled, it detects bots using several techniques: the traditional hidden honeypot field; a JavaScript-inserted site-specific version hash; state validation checks; and an optional Submission Speed Check that flags submissions completed faster than a human could.
Zero Spam
A free plugin by GravityKit that detects bots using a time-limited token injected by JavaScript into the form submission. If the token is missing or doesn’t match the expected value, the entry is marked as spam.
Spam Hexer
A free plugin by Gravity Wiz that detects bots using a JavaScript-based proof-of-work check. An invisible computational cost paid automatically by the browser before submission, negligible for real users but expensive for bots.
How to detect links/URLs
The built-in Links/URLs detection feature
Introduced in Gravity Forms 3.1.0 and newer, this feature checks supported fields for links and URLs. When a link or URL is detected, the field may fail validation or, if the Advanced Honeypot is enabled, the submission may be flagged as spam.
How to block specific email addresses or domains
The same Zero Spam plugin also includes an email rejection rules feature that extends email fields with global and field-specific rejection rules, letting you block submissions or mark entries as spam when matching addresses, domains, or patterns are found.
How to block disposable or invalid email addresses
QuickEmailVerification
A Gravity Labs experiment that validates Email field values using the QuickEmailVerification API, enabling you to reject free, disposable, catch-all, and role-based email addresses. It can also reject email addresses from specific domains before an API request is even made.
Gravity Wiz Email Validator
An add-on by Gravity Wiz that enhances the Email field with automatic email and email domain validation. It can integrate with the Kickbox and ZeroBounce email validation services.
How to block IPs
AbuseIPDB Add-On
An official Gravity Forms add-on that adds real-time IP reputation checking using the AbuseIPDB database. Entries are marked as spam if the submitter’s IP address is in your blocklist or if its abuse confidence score is at or above your configured threshold.
Gravity Wiz Limit Submissions
An add-on by Gravity Wiz that enables you to limit form submissions by user, role, IP, URL, or field value for specified time periods.
How to block countries
The same AbuseIPDB Add-On also includes a country blocklist feature that lets you block submissions from specific countries using standard two-letter country codes. Blocklisted countries are blocked regardless of the IP’s abuse confidence score.
How to block specific words
The Gravity Wiz Blocklist add-on can block submissions containing blocked words or phrases, using the same blocklist WordPress already uses for comments. This can be configured for a single field, multiple fields, or all fields within a form.
Moderation
An official Gravity Forms Add-On to analyze submissions and filter undesirable language. It supports custom word lists, so entries containing your specified words are automatically marked as toxic.
How to catch spam using random or gibberish values, or the wrong language
Akismet
An official Gravity Forms Add-On that sends form submissions to the Akismet service for analysis. Submissions identified as spam are saved, with the entry marked as spam.
The same Spam Hexer plugin also has an optional AI classification feature that reviews submitted content and flags SEO spam, fake engagement, off-topic posts, and other junk.
The same Zero Spam add-on also has an optional AI-powered spam review that flags likely spam the token check missed and recovers legitimate submissions it mistakenly blocked.
Related Articles
Spam Detection and Protection: First Steps
Spam Detection and Protection: Integrations And Plugins
For additional complementary solutions beyond dedicated add-ons and plugins, see the Resources article.
Disclaimer: Third-party services, plugins, or code snippets that are referenced by our Support documentation or in Support Team communications are provided as suggestions only. We do not evaluate, test or officially support third-party solutions. You are wholly responsible for determining if any suggestion given is sufficient to meet the functional, security, legal, ongoing cost and support needs of your project.
Feedback, feature, and integration requests, and other functionality ideas can be submitted at https://gravity.com/feature-request/.