How does Sense Forms block spam without a CAPTCHA?

Sense Forms layers a honeypot field, a time trap, rate limiting, a duplicate guard and a word blocklist — all invisible to real visitors. Most sites never need to enable reCAPTCHA at all.

Spam protection

Six layers of spam filtering, what each one catches, and how to tune them.

Sense Forms applies several independent filters before a submission is accepted. Most are on by default and none of them ask the visitor to do anything.

Honeypot

A field hidden from humans but visible to bots that fill in every input they find. Anything that completes it is rejected.

Always on, requires no configuration, and costs real visitors nothing.

Time trap

Submissions arriving faster than a human could realistically type are rejected. The default minimum is three seconds.

add_filter( 'sense_forms_min_submit_seconds', function () {
    return 5;
} );

Raise it if you still see automated submissions; lower it if you have a genuinely short form — a single-field newsletter signup can legitimately be completed in under three seconds.

Rate limiting

Caps submissions from one IP address, defaulting to 10. Stops a bot that clears the other checks from flooding you.

Raise it if a form is used by many people behind one office IP address, where legitimate submissions can share an address.

Duplicate guard

Rejects a submission identical to one already received recently. Catches retry loops, and also stops accidental double-submits from impatient visitors.

Word blocklist

Rejects submissions containing words you specify — useful against the recurring spam themes that target your particular site. WordPress’s own disallowed comment keys are also applied.

Add terms in Settings → Spam, one per line.

Akismet

If Akismet is installed and configured, Sense Forms passes submissions to it. Akismet’s network sees spam across millions of sites, so it recognises campaigns before they reach yours.

Enabled by default when Akismet is present. Nothing happens if it is not installed.

reCAPTCHA v3

Optional and off unless you supply keys. Google scores each submission for how human it appears; you set the threshold below which submissions are rejected.

reCAPTCHA v3 shows no puzzle — the visitor does nothing. But it does send their IP address and a token to Google, which is a privacy tradeoff worth considering, and it must be disclosed in your privacy policy. See reCAPTCHA setup.

Try the other layers first. Most sites never need it.

Tuning

If spam still gets through, in this order: add its recurring words to the blocklist, raise the time trap, enable Akismet, and only then consider reCAPTCHA.

If legitimate submissions are being rejected, the usual causes are a rate limit too low for a shared office IP, a time trap too high for a short form, or a blocklist term that appears in ordinary language.