Blog Post

Fighting spam in WPForms Lite & Pro

WPForms is a very popular plugin for creating contact forms, and a free version is available in the WordPress.org repository. But both versions have very basic spam protection, and that’s why coreSecurity Pro has an Antispam feature for the WPForms plugin.

WPForms Lite is one of the most popular forms of plugins on WordPress.org, with millions of websites using it, despite a lot of limitations compared to the WPForms Pro plugin version. When creating support for WPForms in coreSecurity Pro, the goal was to support both plugins, and both WPForms Lite and WPForms Pro are supported, with a full range of antispam measures available.

Configure Antispam for WPForms

To use coreSecurity Pro Antispam for WPForms, you need Lite or Pro versions of WPForms active, and you need to enable the feature via the coreSecurity Pro Features panel. Now, you need to enable coreSecurity Pro support for forms you want to protect. Some forms in WPForms may not be public or may not be used for contact purposes, so you need to decide which forms you want to have protected against spam.

Now, for every form in WPForms you want to protect, open the Settings for that form, find the Spam Protection and Security section, and in the Filtering box, you have the option to ‘Enable coreSecurity Pro Antispam protection’. This option is available in both Lite and Pro versions of WPForms.

antispam wpforms
WPForms Form Settings – Spam Protection Settings

coreSecurity Pro Antispam measures

WPForms antispam supports almost every antispam measure implemented by coreSecurity Pro, and that includes over 20 different antispam checks and filters. At this time, the option to check for existing spam in the WPForms saved entries is not implemented because WPForms Lite doesn’t save entries into the database, and this may be implemented at a later time for WPForms Pro.

Antispam measures that are in use include basic things: trust selected user roles or check for the BBCode style URLs. Advanced filters check for Unicode scripts, invalid referrers, number of allowed links, and more. It includes a full set of filters related to the domain check, a full set of regular expression filters, external DNS-based checks, and DNSBL checks. A full set of antispam measures coreSecurity Pro implements is available here.

Antispam violation and IP banning

As with all other antispam measures for comments, bbPress content, and other contact form plugins, repeated violations coming from the same IP can end up with banning IP from accessing the website, in the end, that is the best way to prevent repeated violations – stopping spammers from accessing the website.

Additional WPForms specific actions

WPForms Lite doesn’t save entries in the database, and it only sends emails for new entries. But, it sends the email regardless of the content of the contact entry, and even if the entry is classified as spam, it will be sent as a contact entry to a linked email address. To remedy that, coreSecurity Pro will stop email sending from WPForms if the contact entry is classified as spam. This will greatly improve spam handling for the Lite version of the WPForms plugin.

Let me know if you want to see more antispam measures, or something specific to WPForms Lite or WPForms Pro.

Please wait...
coreSecurity Pro plugin for WordPress
Proactive protection and security hardening

Deploy a wide array of security measures to stop spam registrations, spam content, various types of malicious threats, limit and ban access to repeated offenders and more.

About the author

Milan Petrovic
Milan Petrovic

CEO and Lead developer of Dev4Press Web Development company, working with WordPress since 2008, first as a freelancer, later founding own development company. Author of more than 250 plugins and more than 20 themes.

Subscribe to Dev4Press Newsletter

Get the latest announcements, release digests, promotions and exclusive discounts, and general Dev4Press-related news straight into your mailbox.


This form collects your email (optionally your name) for the purpose of sending you newsletters. Check out our Privacy Policy for more information on how we store and manage your data. We will not send you any spam. Newsletters are sent 2 to 4 times every month.

Latest From The Blog

license management

License Code Validation and Management

Dev4Press License validation system updates will soon be deployed, including license code management via the Dev4Press Account Dashboard. All updates will be deployed on April 14, 2024.
panel options

In Development: SweepPress Pro 5.0 and Lite 3.0

In about two weeks, brand new, significant updates to SweepPress Pro and Lite plugins will be released, bringing several game-changing features to WordPress cleanup and maintenance tools already included.

GD Press Tools Pro 6.3

The new major release for GD Press Tools Pro, version 6.2 is here, and it brings some major changes. First of all, the plugin has two addons less, one addon is added and one more addon has been deprecated (but still included for now).

Leave a Comment

WP Rocket - Make WordPress Load Fast in a Few Clicks
GeneratePress - The perfect lightweight theme for your next project
0
0
0
0
0
0