Stop WordPress form spam without CAPTCHAs

The problem

Contact forms attract bots. Heavy CAPTCHAs hurt conversion. Doing nothing floods your inbox and burns email, webhook, and ESP credits on fake leads.

The solution

Sobi Forms layers protection so most spam never reaches you—while real visitors keep a clean experience.

Built-in on every form:

• Hidden honeypot field
• WordPress nonce on submit
• Strict server-side validation

Optional under Sobi Forms → Settings → Spam protection:

• Rate-limit form submissions — cap submissions per hashed IP
• Filter form spam with Akismet — quarantine spam in the inbox
• Protect forms with Cloudflare Turnstile — invisible bot check

Also see Form honeypot and WordPress nonces for what runs automatically.

Where to configure it

1. Open Sobi Forms → Settings.
2. Click Spam protection.
3. Adjust rate limit, Akismet, and/or Turnstile.
4. Save settings.

Site-wide settings apply to all forms.

Admin emails, webhooks, Brevo, and Mailchimp do not fire on spam ingest. If you later mark a submission as not spam, those automations run once.