Get Plugin

Docs Stop WordPress form spam without CAPTCHAs

Form honeypot and WordPress nonces

Built-in traps and WordPress security tokens that run on every Sobi Forms submission—no setup required.

The problem

Many bots still fill every field they see, including hidden ones. Others forge POST requests without a valid WordPress session.

The solution

Every Sobi Forms front-end includes:

  • Honeypot — a hidden trap field. Humans never see it; simple bots often fill it and get rejected.
  • WordPress nonce — a security token loaded on hover/focus (cache-friendly). Invalid or missing tokens are rejected.
  • Server-side validation — field types and JSON schema checks so bad data never reaches the inbox.

No toggle in Settings—these always run.

What you should know

  • Nonces load late on purpose so cached pages stay fast.
  • Combined with rate limiting, this stops a large share of automated abuse before optional Akismet or Turnstile.
  • File uploads get extra checks (MIME, extension blocklist, private storage).

Next layer

If you still get spam through the honeypot, enable Akismet and/or Cloudflare Turnstile under Settings → Spam protection.