About this plugin
Contact forms attract bots. The usual answer is reCAPTCHA, which loads scripts from a third party, slows the page down and is not reliable everywhere in the world.
This plugin takes a smaller approach. It adds a short arithmetic question, such as 7 - 6 =, to every form built with the Elementor Forms widget. You do not edit a single form: the field places itself right above the submit button, on every form, including forms inside popups and the last step of multi-step forms.
How it stays compatible with caching
The question is never printed into the page HTML. The page ships with an empty placeholder and the browser fetches a signed question separately. That means a cached page can never serve a stale question, and a bot that only reads HTML finds nothing to answer.
What it does not do
No external requests, no tracking, no cookies, no extra database tables. Answers are verified with an HMAC signature, so nothing has to be stored server side.
Features
- Added automatically to every Elementor form, with no form editing
- Compatible with any page caching plugin
- No third-party service and no external requests
- No custom database tables
- Single use tokens and an attempt limit, so a question cannot be replayed or brute forced
- Hidden honeypot field as a second layer
- Skips forms that already use reCAPTCHA, hCaptcha or Turnstile
- Works with multi-step forms and Elementor popups
- admin-ajax fallback for sites where the REST API is disabled
- Accepts answers typed with Persian, Arabic-Indic or Latin digits
- Inherits your theme’s field styling, so it never looks bolted on
- Around 3 KB of CSS and 7 KB of JavaScript, loaded only on pages that have a form
- Fully translatable through translate.wordpress.org
Requirements
Elementor and Elementor Pro must be active, since the Form widget is part of Elementor Pro.
For developers
Two filters are available:
apply_filters( 'kianimr_fac_protect_form', true, $widget_id, $form_name )
Return false to leave a specific form untouched. The same filter runs on both the rendering side and the validation side, so a form can never end up locked.
apply_filters( 'kianimr_fac_error_message', $message, $code )
Change any error message. Codes are missing, malformed, expired, used, mismatch and spam.