Overview
Spam eventually affects all publicly accessible forms, and combating it is difficult due to the ever-evolving tactics used by spammers and bots. No single method can catch 100% of spam, so for optimal results, it’s recommended to use multiple solutions simultaneously.
The listings below group common spam problems and list the add-ons and features that may help to provide some relief. For built-in spam protection and detection features, as well as other tips, see the First Steps article.
Key
A key symbol is used to identify the source of each suggested solution. We recommend you carefully review the support terms, license, requirements, and applicability of each solution, and test in a sandbox or limited production environment before implementation.
🚀 Indicates an official Gravity Forms Add-On or feature.
🧪 Indicates a Gravity Lab project. Refer to the Labs FAQ for important information on support and updates.
🔱 Indicates a third-party solution. Refer to the disclaimer at the bottom of this article.
How to catch spam from bots
🚀 Advanced Honeypot
A built-in Gravity Forms feature is available in the Spam Detection section of each form’s Form Settings. When enabled, it detects bots using several techniques: the traditional hidden honeypot field; a JavaScript-inserted site-specific version hash; state validation checks; and an optional Submission Speed Check that flags submissions completed faster than a human could.
🔱 Zero Spam • GravityKit
A free plugin that detects bots using a time-limited token injected by JavaScript into the form submission. If the token is missing or doesn’t match the expected value, the entry is marked as spam.
🔱 Spam Hexer • Gravity Wiz
A free plugin that detects bots using a JavaScript-based proof-of-work check. An invisible computational cost paid automatically by the browser before submission, negligible for real users but expensive for bots.
How to detect links/URLs
🚀 The built-in Links/URLs detection feature
Introduced in Gravity Forms 3.1.0 and newer, this feature checks supported fields for links and URLs. When a link or URL is detected, the field may fail validation or, if the Advanced Honeypot is enabled, the submission may be flagged as spam.
How to block specific email addresses or domains
🔱 Zero Spam • GravityKit
Includes an email rejection rules feature that extends email fields with global and field-specific rejection rules, letting you block submissions or mark entries as spam when matching addresses, domains, or patterns are found.
How to block disposable or invalid email addresses
🧪 QuickEmailVerification
A Gravity Labs experiment that validates Email field values using the QuickEmailVerification API, enabling you to reject free, disposable, catch-all, and role-based email addresses. It can also reject email addresses from specific domains before an API request is even made.
🔱 Email Validator • Gravity Wiz
Enhances the Email field with automatic email and email domain validation. It can integrate with the Kickbox and ZeroBounce email validation services.
How to block IPs
🚀 AbuseIPDB Add-On
An official Gravity Forms Add-On that adds real-time IP reputation checking using the AbuseIPDB database. Entries are marked as spam if the submitter’s IP address is in your blocklist or if its abuse confidence score is at or above your configured threshold.
🔱 Limit Submissions • Gravity Wiz
Enables limiting of form submissions by user, role, IP, URL, or field value for specified time periods.
How to block countries
🚀 AbuseIPDB Add-On
Includes a country blocklist feature that lets you block submissions from specific countries using standard two-letter country codes. Blocklisted countries are blocked regardless of the IP’s abuse confidence score.
How to block specific words
🔱 Blocklist • Gravity Wiz
An add-on that can block submissions containing blocked words or phrases, using the same blocklist WordPress already uses for comments. This can be configured for a single field, multiple fields, or all fields within a form.
🚀 Moderation
Analyzes submissions and filters undesirable language. It supports custom word lists, so entries containing your specified words are automatically marked as toxic.
How to catch spam using random or gibberish values, or the wrong language
🚀 Akismet
Sends form submissions to the Akismet service for analysis. Submissions identified as spam are saved, with the entry marked as spam.
🔱 Spam Hexer • Gravity Wiz
Has an optional AI classification feature that reviews submitted content and flags SEO spam, fake engagement, off-topic posts, and other junk.
🔱 Zero Spam • GravityKit
Has an optional AI-powered spam review that flags likely spam the token check missed and recovers legitimate submissions it mistakenly blocked.
Related Articles
Spam Detection and Protection: First Steps
Spam Detection and Protection: Integrations And Plugins
For additional complementary solutions beyond dedicated add-ons and plugins, see the Resources article.
Disclaimers
Disclaimer: Third-party services, plugins, or code snippets that are referenced by our Support documentation or in Support Team communications are provided as suggestions only. We do not evaluate, test or officially support third-party solutions. You are wholly responsible for determining if any suggestion given is sufficient to meet the functional, security, legal, ongoing cost and support needs of your project.
Feedback, feature, and integration requests, and other functionality ideas can be submitted at https://gravity.com/feature-request/.