About this plugin
Honeypot Guard is a powerful, privacy-focused anti-spam solution that protects your WordPress forms without annoying your visitors with CAPTCHAs. Using invisible detection techniques, it blocks spam bots while maintaining a seamless user experience.
Why Choose Honeypot Guard?
Unlike CAPTCHA-based solutions that frustrate users and hurt conversions (studies show CAPTCHAs reduce form submissions by 10-40%), Honeypot Guard provides superior spam protection with zero user friction.
How It Works
Honeypot Guard uses multiple layers of intelligent detection to catch spam automatically:
- Invisible Honeypot Fields – Hidden fields that real users never see, but bots fill out automatically
- Dynamic Field Rotation – Constantly changing field names make it harder for sophisticated bots to adapt
- Timestamp Validation – Detects instant submissions (bots can’t read like humans)
- Intelligent Gibberish Detection – Catches keyboard mashing and random text patterns
- Advanced Heuristic Analysis – Pattern-based detection of common spam characteristics
- Character Script Filtering – Optionally block submissions containing specific character scripts (Cyrillic, Chinese, etc.)
- Dotted Email Detection – Catches spammers using excessive dots to generate infinite email addresses (e.g. [email protected])
- Cookie Verification – Proves JavaScript execution in a real browser environment
Key Features
- Zero User Friction – Completely invisible protection, no annoying puzzles
- Privacy-Focused – All processing on your server, no third-party tracking by default
- Granular Blacklisting – Block by email, domain, IP address, or keywords
- Rate Limiting – Prevent spam floods with configurable submission limits
- Detailed Spam Logs – View blocked submissions with one-click IP blocking
- Multi-Language Admin – Available in 9 languages (English, German, Spanish, Italian, Lithuanian, Swedish, Polish, Estonian, Spanish-Mexico)
- GDPR Compliant – No data sent to external services (unless you enable optional AI detection)
- Works Automatically – Integrates seamlessly with popular form plugins
Supported Form Plugins
- Contact Form 7
- WPForms
- Gravity Forms
- Ninja Forms
- Formidable Forms
- WordPress Registration Forms
- WordPress Comments
- WooCommerce Checkout & Registration
- bbPress Forums
- Any HTML form with minimal configuration
Advanced Protection Options
- Cloudflare Turnstile (Optional) – Invisible CAPTCHA that catches headless browsers, Tor/VPN bots, and bot farms. Free up to 1M validations/month. Fails open — never blocks real users if Cloudflare is down.
- AI-Powered Gibberish Detection (Optional) – Use OpenAI or Anthropic APIs for advanced content analysis
- Meta Pixel Protection – Block form submission tracking until verification
- Custom Honeypot Field Names – Define your own field names for added security
- Whitelist Trusted Users – Bypass checks for logged-in users or specific IPs
Privacy & Performance
Honeypot Guard is designed with privacy and performance in mind:
- Lightweight – Adds virtually zero latency to your site
- No External Calls – Basic protection requires no API calls
- Cache Compatible – Works with WP Super Cache, W3 Total Cache, WP Rocket, LiteSpeed, and more
- No Cookies Required – Core functionality works without cookies (optional cookie verification available)
Professional Support
Need help? com/honeypot-guard for documentation and support.
Privacy Policy
Honeypot Guard collects and stores:
- IP addresses of form submissions (for spam detection and blocking)
- Form submission data flagged as spam (for review and pattern detection)
- Timestamps of submissions (for rate limiting)
This data is stored in your WordPress database and is never sent to external services unless you enable optional AI-powered detection.
You can configure automatic deletion of spam logs in Settings > Honeypot Guard.
External Services
This plugin can optionally connect to external AI services for advanced gibberish detection. These services are disabled by default and must be explicitly enabled by the administrator.
OpenAI API (Optional)
When AI gibberish detection is enabled and configured with an OpenAI API key:
- What it does: Analyzes suspicious form field content to detect nonsensical or spam text
- Data sent: Only the specific text field being analyzed (not the entire form submission)
- When sent: Only when a submission is flagged as potentially suspicious and AI detection is enabled
- Service provider: OpenAI, L.L.C.
- Terms of use: https://openai.com/policies/terms-of-use
- Privacy policy: https://openai.com/policies/privacy-policy
Anthropic API (Optional)
When AI gibberish detection is enabled and configured with an Anthropic API key:
- What it does: Analyzes suspicious form field content to detect nonsensical or spam text
- Data sent: Only the specific text field being analyzed (not the entire form submission)
- When sent: Only when a submission is flagged as potentially suspicious and AI detection is enabled
- Service provider: Anthropic, PBC
- Terms of use: https://www.anthropic.com/legal/consumer-terms
- Privacy policy: https://www.anthropic.com/legal/privacy
Cloudflare Turnstile (Optional)
When Turnstile is enabled and configured with site/secret keys:
- What it does: Verifies that form submissions come from real browsers, not headless bots
- Data sent: A challenge token and the visitor’s IP address
- When loaded: By default, only when a visitor starts using a form (can be changed to load on every page with forms)
- When sent: On every form submission when Turnstile is enabled
- Service provider: Cloudflare, Inc.
- Terms of use: https://www.cloudflare.com/website-terms/
- Privacy policy: https://www.cloudflare.com/privacypolicy/
- Fail-open: If Cloudflare is unreachable, no penalty is applied — real users are never blocked
Important: These services are entirely optional. Honeypot Guard provides effective spam protection without any external services using its built-in detection methods.
Additional Info
- Plugin Website
- Documentation
- Support
- GitHub Repository