Overview
The Submission Speed Check is one of the detection methods that make up the Advanced Honeypot. It is based on a simple idea: humans need at least a few seconds to read a form, fill it out, and submit it, while spam bots or automated requests fill out and submit a form almost instantly.
By measuring the time between page load and submission, Gravity Forms can flag bot traffic that other detection methods might miss, without requiring the visitor to solve a CAPTCHA or complete any extra steps.
Use Cases
The Submission Speed Check is especially effective against automated bot submissions, which tend to load a form and post the results within a fraction of a second, often without ever rendering the page in a real browser. The Submission Speed Check is a good fit for:
- Public-facing forms that receive high volumes of automated spam, such as contact or registration forms.
- Forms where other honeypot checks (such as the hidden field or JavaScript hash) are being bypassed by more sophisticated bots.
- Sites that want spam protection without adding friction to the form itself, such as a CAPTCHA.
Choosing a Threshold
The right threshold depends on the form’s complexity. You can base the threshold on real visitor behavior. Enabling the “Submission Speed” column on the Entries list page shows how long legitimate submissions actually took, providing a baseline. Setting the threshold too high risks flagging genuine visitors who fill out the form quickly, while setting it too low lets faster bots slip through undetected.
Note: Account for visitors who may naturally take longer to interact with a page, such as people using assistive technology. Also consider a higher threshold for forms that are frequently filled out on mobile, where page load itself may take longer.
Normal vs. Strict Mode
On multi-page forms or any form where a visitor submits more than once after a validation error, multiple submission speeds are captured. The Mode setting decides how those multiple speeds are weighed against each other, and the right choice depends on how much benefit of the doubt you want to give visitors:
Normal mode is more forgiving. A visitor needs only one recorded speed above the threshold to pass, which accommodates situations such as a visitor quickly correcting a single validation error after already spending time on the rest of the form.
Strict mode is more aggressive. Every recorded speed must be above the threshold, which is a better fit for forms facing persistent, more sophisticated bot attacks, but carries a higher chance of flagging legitimate visitors who move quickly through part of a form.
Reducing False Positives
If legitimate submissions are being flagged as spam, a few things are worth checking before assuming the feature isn’t a good fit for the form:
- Review recorded speeds on the Entries list to see whether the threshold is set too high.
- Consider switching from Strict to Normal mode if the form triggers validation errors.
Note: The Submission Speed Check works alongside the honeypot’s other detection methods and isn’t meant to catch spam on its own. It’s one layer in a broader, layered spam-prevention strategy.