Form spam is a reality of publishing forms on the internet. Bots crawl websites looking for forms to submit with junk data, fake leads, and even malicious content. Without protection, a public form can receive hundreds of spam submissions per day, drowning out real responses and wasting your time. Fillin Forge includes multiple layers of protection to keep spam out of your submissions without annoying real visitors with puzzles or challenges.
Good spam protection is invisible. Your real visitors should never know it is there. Fillin Forge’s approach is to layer silent detection methods so bots are caught automatically while humans breeze through without interruption.
Built-in Protection (Free)
These three methods work silently in the background with zero configuration:
| Method | How it works | What it catches |
|---|---|---|
| Honeypot | Adds an invisible field to every form. Real humans never see it, but bots fill it in automatically. Any submission with this field filled is rejected. | Basic automated bots that fill every field they find |
| Time Check | A form submitted less than 2 seconds after it was loaded is rejected. | High-speed automated scripts |
| Token Validation | Each form generates a unique security token when loaded. This prevents cross-site request forgery and blocks external scripts that try to POST data directly to your form endpoint. | Direct POST attacks from external scripts |
Together, these three methods work against common automated spam, and for many sites they are enough. Many Fillin Forge users never need anything beyond these built-in protections.
Optional Extra Protection
For sites that get heavy, persistent bot traffic, you can add reCAPTCHA v3 with your own Google keys. IP rate limiting is always on:
Google reCAPTCHA v3 runs in the background and scores each visitor on how “human” they appear based on their behavior on your site. There is no checkbox, no image puzzle — it is completely invisible to real visitors. Submissions from likely bots are automatically blocked. IP Rate Limiting prevents the same IP address from submitting a form more than 10 times in 60 seconds. It is always on and the limit cannot be changed. This stops automated scripts that hammer your form repeatedly.Setting Up reCAPTCHA v3
- Go to the Google reCAPTCHA admin console at google.com/recaptcha/admin.
- Click the + button to create a new site.
- Give it a label (for example, “My Website Forms”).
- Choose reCAPTCHA v3 as the type.
- Add your domain (for example, “yourcompany.com”).
- Click Submit and copy both the Site Key and Secret Key.
- In WordPress, go to Fillin Forge > Settings and find the Google reCAPTCHA v3 card.
- Paste the Site Key into the Site Key field.
- Paste the Secret Key into the Secret Key field.
- Set the score threshold. The default is 0.5 on a scale of 0.0 (definitely a bot) to 1.0 (definitely human). Higher values are stricter; lower values allow more visitors through. Set the threshold to 0 only when you want Fillin Forge to require a valid reCAPTCHA token but skip score-based blocking.
- Click Save Settings.
Choosing the Right Protection Level
| Your situation | Recommended protection |
|---|---|
| Small site, low traffic | Built-in honeypot + time check (free, no setup needed) |
| Medium site, occasional spam | Add reCAPTCHA v3 |
| High-traffic site with persistent spam | reCAPTCHA v3 (IP rate limiting is always on) |
| Under active spam attack | All of the above + raise the reCAPTCHA threshold above 0.5 |
What to Do If Spam Still Gets Through
- First, confirm that both reCAPTCHA keys are saved in Fillin Forge > Settings.
- Verify your reCAPTCHA keys are correct by visiting the Google reCAPTCHA admin console.
- Try raising the score threshold (for example, from 0.5 to 0.7). This blocks more borderline visitors.
- Consider adding a simple custom question field (like “What is the name of our company?”) as an extra barrier that bots cannot answer.
> Tip: Very rarely, a legitimate submission gets blocked, especially from visitors using VPNs, corporate networks, or older browsers. Blocked submissions are not saved, so if a customer says their message never arrived, ask them to try again without a VPN.
> Good to know: The honeypot, time check, and token validation are built in and need no setup. reCAPTCHA v3 is there for sites that face heavy, persistent attacks.
Common Mistakes to Avoid
- Mixing up reCAPTCHA v2 and v3 keys. Fillin Forge uses v3, which is invisible. If you accidentally paste v2 keys (the checkbox version), it will not work.
- Setting the reCAPTCHA threshold too high (like 0.9). This blocks many real humans who browse in ways Google scores lower. Start at 0.5 and adjust.
- Setting the threshold to 0 by accident. A zero threshold disables score-based rejection, so any visitor with a valid Google token can submit even if Google returns score 0.
[Screenshot: The Settings page showing the Google reCAPTCHA v3 card with the Site Key, Secret Key and Threshold fields]
—