How to Protect WordPress Forms From Spam

Any public form on the internet eventually attracts bots. The good news is that stopping most of them doesn’t require a visible CAPTCHA at all — the most effective spam protection is invisible to real visitors and only gets in a bot’s way. Here’s how to layer it, using Contactum as the example.

Layer 1: What’s Already On

Contactum forms carry three invisible defenses by default, with nothing to configure:

• An invisible honeypot field — a field real visitors never see (and so never fill in), but that simple bots fill in automatically. Any submission with that field populated is silently rejected.
• A minimum-time-to-submit check — a submission that arrives faster than a human could plausibly read and fill the form is rejected. Bots that submit instantly on page load get caught here.
• A per-IP rate limit — by default, five submissions per ten minutes from the same IP address. This blocks rapid repeat submissions, whether from a script or a person mashing the button.

This combination alone stops the majority of automated spam without ever showing a visitor a puzzle to solve — which matters, because every CAPTCHA you add also adds friction for real people trying to reach you.

Layer 2: A Visible CAPTCHA

For forms that attract more targeted spam (open comment-style forms, high-traffic contact pages), add a CAPTCHA. Contactum supports three, and you only need one:

• Google reCAPTCHA — the most widely recognized option; get a Site Key and Secret Key from google.com/recaptcha.
• hCaptcha — a privacy-focused alternative with the same Site Key/Secret Key setup pattern.
• Cloudflare Turnstile — Cloudflare’s CAPTCHA replacement, often the least intrusive to visitors since it can pass silently for most users.

Whichever you pick, save the keys under Contactum → Settings, then add the matching field (reCAPTCHA / hCaptcha / Turnstile) to your form in the builder — the widget only renders once both the keys are saved and the field has been added, which is the most common thing people miss when a CAPTCHA “isn’t showing up.”

Layer 3: A Server-Side Spam Service

If you’d rather not show visitors any widget at all, CleanTalk screens submissions server-side against a spam database, invisibly. Enter your CleanTalk credentials under Contactum → Settings → CleanTalk and it works in the background — no field to add to the form, no puzzle for visitors to solve.

Choosing a Combination

For most sites, the always-on protection plus one CAPTCHA provider (Turnstile if you want the least visible friction, reCAPTCHA if you want the most recognizable brand) is enough. Reserve a server-side service like CleanTalk for forms that keep getting through despite a CAPTCHA — it’s an additional layer, not a replacement for one.

Whatever you choose, spam filtering never blocks a submission silently without a trace — a rejected attempt simply never becomes an entry, while everything legitimate still lands in Contactum → Entries for you to review.