Spam Protection and Privacy
FormGlut has several layers of spam protection. Most need no account. You can combine them.
Honeypot (on by default)
A honeypot is a hidden field that people never see but bots fill in. Submissions with the field filled are dropped quietly.
- Turn it on for all forms in Global Settings › Spam protection › Enable honeypot.
- Override it per form in Settings › Spam & privacy › Honeypot: Use global setting, On for this form or Off for this form.
Per-form spam checks
In the form’s Settings › Spam & privacy:
| Setting | What it does |
|---|---|
| Check with Akismet | Sends the submission to Akismet. Needs the Akismet plugin with an API key. Spam goes to the Spam folder. |
| Check with Stop Forum Spam | Checks the visitor’s email and IP address against stopforumspam.com, a free list of known spammers. Listed submissions go to the Spam folder. Mention this in your privacy policy. |
| Blocked words | One word or phrase per line. Whole words only, not case-sensitive. |
| When a blocked word is found | Reject the submission or Save it as spam. |
| Max submissions per visitor per hour | Limits submissions per IP address. 0 means no limit. |
| Only accept submissions from this site | Rejects submissions that were not sent from a page on your website. |
| Minimum time to fill (seconds) | Submissions faster than this are treated as bots. 0 turns it off. |
Captcha fields
Add a captcha by dragging a field from Security Fields into the form.
Math Captcha
A simple sum the visitor must solve. Needs no keys. Choose the Question type: Addition, Subtraction, Multiplication or Mixed.
Google reCAPTCHA
- Create keys at Google reCAPTCHA. Choose v3 (invisible) or v2 (I’m not a robot checkbox).
- Go to Global Settings › Captcha › Google reCAPTCHA, choose the same Version and paste the Site key and Secret key.
- For v3, set the Minimum score: from 0.0 (likely bot) to 1.0 (likely human). Lower scores are rejected.
- Add the reCAPTCHA field to the form, or turn on Protect every form to run reCAPTCHA v3 on all forms.
Keys are tied to a version. Use keys created for the version you pick.
hCaptcha and Cloudflare Turnstile
- Create keys in the provider’s dashboard.
- Paste them in Global Settings › Captcha › hCaptcha or Cloudflare Turnstile.
- Add the hCaptcha or Turnstile field to the form.
Email checks
On the Email Address field you can:
- Block throwaway email addresses (temporary inbox services).
- Only accept these (allowlist) or Refuse these (denylist) for chosen addresses and domains.
Privacy settings
Also in Settings › Spam & privacy:
| Setting | What it does |
|---|---|
| Save entries | Use global setting, Always save, or Email only, do not save. |
| Store IP address and browser | Turn off to keep no IP address or browser details with entries. |
| Delete entries after (days) | Deletes old entries automatically. 0 keeps them forever. |
FormGlut also works with the WordPress personal data export and erase tools (Tools › Export Personal Data and Erase Personal Data).