About this plugin
Formsieve is built to keep spam out of your Gravity Forms and Contact Form 7 (CF7) forms, including the sales pitches that people type or paste by hand, with no CAPTCHA for your visitors: free local checks stop common bot spam before any AI check. Honeypots and CAPTCHAs judge the visitor, so a person with a pitch gets through them. The AI check reads the message itself, so SEO offers, link building and other pitches can be caught even when a person sent them.
The AI check blocks only confident spam: a spam probability of 85% or more at the default setting (90% when the site’s first language is not English). By default, a message it is unsure about still reaches you, tagged as possible spam. Every AI decision comes with a probability, a category and a short reason.
The plugin and its local checks are free and need no key. com/pricing/). The AI is included, so you need no account with an AI provider.
How it works
Formsieve checks form submissions for spam in two layers. Free local checks run first on your own server. Submissions that pass them get one AI spam check from the Formsieve service, which asks TypeSafe AI’s Jev model a fixed set of questions; the plugin turns the answers into a calibrated spam probability and decides.
- Local checks first, with or without a key: a honeypot, a signed time-to-submit token, a replay cache, a per-IP rate limit, allow and block lists, WordPress’s Disallowed Comment Keys, disposable e-mail domains and heuristics. What they stop needs no AI check.
- One AI check for what passes them: a spam probability, a category (such as vendor solicitation or scam) and a short reason.
- Three bands: allow, review and block, from presets or your own thresholds, per form if you like. Review-band submissions are delivered with a “[Possible spam 62%]” subject tag, so an uncertain lead still reaches you.
- Explained: probability, category, model, request ID and latency on each entry, in Flamingo and in the log.
- Fails open: by default an outage never blocks a form, and a billing state never does: the submission is delivered with a “not checked” note, or held for review if you prefer.
- Learns from you: your spam and not-spam corrections teach it trusted and blocked senders (stored as hashes).
One plugin covers Gravity Forms and Contact Form 7, on the same site if you use both: it turns on a module for each form plugin that is active, with one key, one settings screen, one dashboard and one decision log.
Gravity Forms
- Runs after Gravity Forms’ own honeypot and sends nothing for an entry it has flagged.
- Per form: mark as spam (default), discard, or refuse with a validation error. Not Spam restores a blocked entry.
- An entry panel with the verdict, Re-check and Mark spam or not spam, a sortable probability column, and entry meta for filters and exports.
Contact Form 7 and Flamingo
- Adds a hidden honeypot field and a signed time-to-submit token to each form.
- Uses Contact Form 7’s own spam status, spam log and spam message; mail addressed to the visitor is never tagged.
- With Flamingo (recommended), spam is kept in its Spam folder with the explanation, and “Not spam” teaches the sender.
- Per-form settings in a tab of the form editor, and the “formsieve: off” additional setting.
Privacy
- Nothing is sent before an administrator enters a key and accepts a consent screen that names every recipient.
- Never sent: the visitor’s IP address, user agent or full e-mail address, passwords, payment fields or uploads. Phone numbers are redacted by default, and sensitive fields are left out.
- A one-line notice under forms (“Submissions are screened for spam by an automated AI service.”, with no product name or link), on by default once the AI check runs, off under Settings > Privacy or per form.
- Privacy-policy text, personal-data export and erasure, and log retention.
- What is sent, when and to whom, with the terms and privacy policies: “External services” below.
Also included
- A Dashboard with your plan and the AI checks used this month; notices at 80% and 100%, on the plugin’s own screens only. An optional hourly limit of AI checks per form, to protect your allowance during a bot wave.
- Test mode, WP-CLI commands and developer hooks.
- Translation-ready: translations come from translate.wordpress.org.
Requirements
0 or later (Flamingo recommended), or both.
Documentation and support
- Documentation: https://formsieve.com/docs/
- Questions about the plugin: the support forum here on WordPress.org.
- Questions about your account, plan or invoices: [email protected] (https://formsieve.com/support/). Never post your key in a public forum.
External services
Formsieve uses one external service, the Formsieve service of Thinking42, Inc. com (see “Trial sign-up” below). com/pricing/).
The local checks need no service.
When: never before an administrator enters a key and accepts the notice in the set-up wizard or on the settings screen. Then: once for each submission that passes the local checks (each form can be switched off); when you save a key (to verify it) or click Test connection (a sample, no form data); when you open the Dashboard (plan and usage, at most every 15 minutes); once a day (key, plan, usage and this site’s slot); and when you disconnect the key or delete the plugin (to free this site’s slot).
Test mode sends nothing.
What each check sends: the site name, the form name, the site and form descriptions you write, the site languages, the label, type and value of the submission’s ordinary fields (phone numbers redacted by default; passwords, payment, identity-document and health fields excluded automatically; any field can be excluded; values capped), the sender’s e-mail domain (optional), signals computed on your server (the number of links and their host names, whether a phone number is present, the time taken to submit, the number of submissions from the same IP address in the last hour, the writing systems used, the message length, and whether you marked the sender as spam or not spam before), your key, this site’s address and environment (production, staging or development), and which form plugin handled the submission (for example “gf” or “cf7”).
The key calls send your key, this site’s address and environment and which form plugins are active, and no form data. Every call carries the plugin, WordPress and PHP versions. Never sent: the visitor’s IP address, user agent or full e-mail address, passwords, uploads, payment fields or the plugin’s own hidden fields.
com/wp-json/formsieve/v1/trial/plugin. It sends the e-mail address the administrator entered, this site’s address and environment (production, staging or development), the plugin’s slug and version, which form plugins are active, the site language, and the sentence the administrator ticked with the names of the documents it accepts (Terms, Privacy policy, Data Processing Agreement). No form data is sent.
Thinking42 creates the account and the trial key, e-mails that address, and returns the key, which the plugin saves; the plugin then verifies the key and runs Test connection as described above.
, behind Cloudflare, Inc. ’s Jev model through OpenRouter, Inc. (all US companies; Cloudflare runs a global network, and OpenRouter does not promise to handle a request only in the USA, as of 2026-10-08) and returns the answers; the plugin computes the spam probability on your server.
Thinking42 does not store the content of submissions; it keeps request records without the content (such as the time, key and site identifiers, status, timing and the spam band of the result) for 30 days (as of 2026-09-25).
- Formsieve (Thinking42, Inc.): https://formsieve.com – Terms: https://formsieve.com/terms/ – Privacy policy: https://formsieve.com/privacy-policy/ – Data Processing Agreement: https://formsieve.com/dpa/ – Sub-processors: https://formsieve.com/subprocessors/
- OpenRouter, Inc.: Terms: https://openrouter.ai/terms – Privacy policy: https://openrouter.ai/privacy
- TypeSafe AI, Inc.: Terms: https://typesafe.ai/legal/terms – Master customer agreement: https://typesafe.ai/legal/mca – Privacy policy: https://typesafe.ai/legal/privacy-policy
Credits
- Admin fonts in assets/fonts/, under the SIL Open Font License 1.1, so no font is loaded from another site: Unbounded (Copyright 2022 The Unbounded Project Authors), DM Sans (Copyright 2014 The DM Sans Project Authors) and IBM Plex Mono (Copyright 2017 IBM Corp., with Reserved Font Name “Plex”). Sources: assets/fonts/README.txt.
- Disposable e-mail domain list: https://github.com/disposable-email-domains/disposable-email-domains (CC0 1.0), copied 2026-09-22.
- Composer class loader (MIT licence).
Disclaimer
Formsieve is an independent product of Thinking42. , or Rock Lobster Inc. TypeSafe and Jev are trademarks of TypeSafe AI, Inc.
Gravity Forms is a registered trademark of Rocketgenius, Inc. Contact Form 7 is a registered trademark of Rock Lobster Inc. WordPress is a registered trademark of the WordPress Foundation.
All other names are used only to identify compatibility.