Free WordPress plugin · about 4,000 sites
Spam protection your visitors never see.
No traffic lights to click. No "I'm not a robot". No Google. Your visitors just press Send — and spam bots quietly lose.
Install free from WordPress.orgThe trick
Make the device pay, not the human.
While someone fills in your form, their browser solves a tiny cryptographic puzzle in a few milliseconds. A real person never notices.
A spam bot sending ten thousand messages has to solve ten thousand puzzles. Either it fails, or spamming your site stops paying off. Under a spam wave the puzzle automatically gets harder for everyone, and relaxes again afterwards.
Every form
Not a list of integrations. Every form you actually have.
Most anti-spam tools only protect the form plugins they wrote an integration for. This one recognises a submission by its signature — the fields and actions the request itself carries — so it covers logins, comments, checkouts and practically every builder.
Recognised automatically on activation:
Contact Form 7 · WPForms · Elementor Pro Forms · Ninja Forms · Fluent Forms · Forminator · Gravity Forms · Formidable · Everest Forms · WS Form · SureForms · MetForm · JetFormBuilder · Otter Blocks · Spectra · Kadence Blocks · Essential Blocks · Divi Forms · Jetpack Forms · WooCommerce · wpForo · Directorist — and dozens more.
Teach it in a minute
Hand-coded form or exotic builder? Switch on analysis mode, submit the form once, click save. No code.
Updates can't break it
No integration code means nothing to break when your form builder updates.
One honest limit
Forms hosted elsewhere and merely embedded (Typeform, Jotform, HubSpot…) never reach WordPress, so no WordPress plugin can check them.
Nothing leaves your server
No account. No API key. No cookie banner entry.
Nothing external can fail
No third-party API whose outage or rate limit silently breaks your forms.
Nothing external slows you down
No remote scripts, no extra DNS lookups. A few kilobytes of JavaScript, no layout shift.
Privacy by design
No cookies, no sessions, no tracking. IP addresses are only stored as hashes.
Why not just use…
The usual suspects, honestly compared.
| This plugin | reCAPTCHA · hCaptcha · Turnstile | Akismet | Honeypots | |
|---|---|---|---|---|
| Visitors have to do something | never | sometimes | no | no |
| Account / API key needed | no | yes | yes | no |
| Data or scripts from third parties | none | scripts from their servers | messages sent for analysis | none |
| Protects forms without a ready integration | yes | usually no | usually no | depends |
| Holds up against modern bots | yes — attacks the economics | yes | yes | often skipped |
More in the box
Login protection
Brute-force protection for logins, with optional Fail2Ban log support.
Your call per site
Block spam, deliver it flagged, or just collect it in a spam inbox and watch.
Free
Everything on this page costs nothing.
Behind the scenes
Maintained by an AI that has to ask first.
Support questions, fixes and releases go through an autonomous maintainer loop — and nothing reaches WordPress.org until I approve it with one word from my phone.
Install free from WordPress.org