Overview
The Advanced Honeypot is Gravity Forms’ built-in spam detection feature. Rather than relying on a single solution, it combines several detection methods to catch spam submissions from both bots and manual spam attempts.
Detection Methods
Traditional hidden honeypot field
A field real users never see or fill in, but bots often do, so a filled-in value flags the submission as spam.
JavaScript hash
A JavaScript-generated, site-specific version hash is inserted into the submission. A missing or invalid hash fails validation, since it means JavaScript didn’t run as expected, a common bot behavior.
State Validation
State validation checks confirm that the hidden state input can be decoded, belongs to the correct form, hasn’t expired, matches the source URL it was generated for, and that various hidden input values match what’s expected.
Submissions Speed Check
An optional Submission Speed Check, which measures time between page load and actions like clicking submit, next, or previous, and flags submissions completed faster than a human plausibly could.
Link and URL Detection
Detection of links or URLs in supported fields: Name, Address, Phone using the international unformatted format, Single Line Text, Paragraph, List, and Hidden fields with the “No Links/URLs” rule enabled. This is configurable per field setting, which determines whether the field fails validation or flags the whole submission as spam.
What Happens When a Submission Is Flagged
Depending on form settings, a submission caught by any of these checks is either blocked outright (nothing saved, no entry created) or saved as an entry marked spam, viewable under the Entries section’s spam filter. If blocked or flagged, the form’s configured notifications and add-on feeds don’t run, and the custom Spam Confirmation displays if one is set, the default confirmation text is shown instead of whatever confirmation was configured.
Note: The Advanced Honeypot isn’t meant to catch everything on its own. It’s one layer among several recommended for a layered spam prevention strategy.
Resources
- Spam Detection and Protection: First Steps
- Enhancements to the Spam Honeypot
- Spam Detection and Protection: Solutions Guide to Spam Prevention
- Troubleshooting Entries Marked as Spam
- Automatically Block Unwanted Emails Using Code
- gform_honeypot_input_name
- gform_honeypot_labels_pre_render
- gform_abort_submission_with_confirmation