WPForms spam protection
WPForms includes anti-spam protection and lets you add a CAPTCHA service from its settings, so most WPForms spam can be stopped without extra plugins.
The short answer
To stop WPForms spam: keep the form's built-in anti-spam protection switched on, add Cloudflare Turnstile, hCaptcha or reCAPTCHA in WPForms' CAPTCHA settings, use the content and country filters if your version has them, and keep entries so you can review what was blocked.
Step by step for WPForms
- Update WPForms to the latest version.
- Check each form's anti-spam setting. In the form builder, open Settings → Spam Protection and Security (the name can differ by version) and make sure the built-in protection is on.
- Add a CAPTCHA service. In WPForms → Settings → CAPTCHA, choose Turnstile, hCaptcha or reCAPTCHA, add the keys, then enable it on each form.
- Use filters if available. Paid versions add filters by country and keywords.
- Keep entries. Paid versions store entries so you can review anything marked as spam.
If WPForms spam keeps coming
- Check that every form has protection, including pop-ups and old forms.
- Look at whether the spam is human (readable sales pitches) or automated (links, nonsense, bursts).
- For human spam, add keyword filters; for automated spam that survives, add server-side protection. See how to stop bots from submitting your contact form.
Common questions
Does WPForms have spam protection?
Yes. It has built-in anti-spam protection and supports several CAPTCHA services in its settings.
Which CAPTCHA should I use with WPForms?
Turnstile is a good first choice: usually invisible and free. Check its privacy implications and mention it in your privacy policy.
Why do I still get spam in WPForms?
Usually human spam, a form without protection, or bots that the chosen CAPTCHA passes. Review your entries to see which.