Get Plugin

Docs Stop WordPress form spam without CAPTCHAs

Rate-limit form submissions

Cap how many times a visitor can submit WordPress forms per hour using hashed IPs only.

The problem

Bots and scrapers hammer forms with dozens of posts per minute. Even without “smart” spam content, volume alone wastes inbox space and mail quota.

The solution

Rate limiting caps submissions per visitor over a rolling hour. Sobi Forms stores a hashed IP only—raw IPs are never kept in the database for this purpose.

Default: 10 submissions per hour per hashed IP. Set to 0 to disable.

How to configure it

  1. Go to Sobi Forms → Settings → Spam protection.
  2. Under Rate limiting, set Max submissions per visitor per hour.
  3. Save settings.

Notes

  • The limit applies to everyone equally—including logged-in admins. It is based on hashed IP, not WordPress role.
  • Rate limiting is site-wide (all forms share the same counter per visitor).
  • Combine with Akismet and Turnstile for layered protection.