Stopping WordPress Spam Without a CAPTCHA Wall

Most form spam comes from simple bots that find forms, fill every field and submit them in a fraction of a second, often without running JavaScript. A smaller share comes from more capable scripts that load the page in a real browser, and a smaller share again from people paid to post spam by hand.

The defences in this guide are aimed mainly at the first group, because it produces most of the volume and is cheap to stop. The second group needs rate limits and content rules. The third cannot be stopped by any test a human can pass, CAPTCHA included, so it is handled by moderation and by making the reward small, for example by adding nofollow to links in comments.

A honeypot is an extra form field that real visitors never see or fill in, with a plausible name such as website. Simple bots fill every field they find, so any submission with a value in that field can be discarded.

Hide the field with CSS by moving it off screen, rather than using type=hidden, which many bots skip. Add aria-hidden and tabindex=-1 so keyboard and screen reader users never reach it, and set autocomplete=off so browser autofill does not fill it for a real visitor. Give it a label that tells anyone who does encounter it to leave it empty.

When the honeypot is filled, respond exactly as you would to a successful submission, but do not save or send anything. If the bot receives an error, its operator learns which field to avoid. A silent success teaches it nothing.

Real people need time to read a form and type their details. Record when the form was displayed, send the elapsed time with the submission and treat anything below a small threshold, such as two seconds, as automated. On this site's enquiry form, both the browser and the server apply the same two-second floor.

Keep the threshold low so a fast typist using autofill is never caught, and accept submissions where the timing value is missing or invalid rather than rejecting them outright, unless you see abuse. As with the honeypot, return the normal success response for filtered submissions.

Duplicate protection belongs here too. People double-click submit buttons and browsers retry on flaky connections. Hash the key fields of each submission and ignore an identical one that arrives within a few minutes, so genuine visitors produce one enquiry and one email.

Bots that pass the invisible checks still tend to submit many times. Rate limiting caps how many submissions one IP address can make to a form in a given period. It is best done at the edge, in a CDN or web application firewall, so abusive requests never reach PHP, but a simple limit in WordPress using transients also works for low-traffic sites.

Set limits per form and per endpoint, including admin-ajax.php and REST routes that forms post to, and set them high enough that an office sharing one IP address is not blocked. Log what the limit catches for the first few weeks before tightening it. The firewall and WAF guide covers edge rules in more detail.

If a site does not need comments, turn them off under Settings, Discussion, and close comments on existing posts. Pingbacks and trackbacks are rarely useful today and attract their own spam, so disable them as well.

If comments matter, the built-in settings do a lot. Require a name and email, hold a comment for moderation when it contains more than one or two links, automatically close comments on older posts and keep a list of words and patterns that send a comment to moderation. Requiring previously approved comments lets regular readers post freely while new commenters are checked once.

• Disable pingbacks and trackbacks
• Close comments on posts older than a set number of days
• Hold comments with more than one link for moderation
• Use the moderation and disallowed keys lists for known patterns

A hosted anti-spam service compares submissions against data from many sites, which catches spam that local rules cannot recognise. It is worth paying for when spam volume stays high after the invisible defences, when a site has many forms or open registrations, or when moderation is costing staff time every week.

Choose a service that works invisibly or with a low-friction challenge, check how it processes personal data, and mention it in your privacy notice. If you do use a challenge, show it only when other signals look suspicious rather than to every visitor. The security hardening checklist and the login security guide cover related protections for registration and login forms.

Spam filters are judged by what they block, but the expensive mistake is the genuine enquiry they block. A lost lead is invisible unless you look for it. Log filtered submissions for a period, with the reason they were filtered, and review a sample each week.

If real messages appear in the filtered log, relax the rule that caught them. Ask new clients how they contacted you, test the forms yourself from a phone on mobile data and check that confirmation emails arrive. A small amount of spam reaching the inbox is a better outcome than losing one real client. If you want help reviewing your forms, the WordPress performance and maintenance service covers this kind of work.