Description

Honeypot Guard is a powerful, privacy-focused anti-spam solution that protects your WordPress forms without annoying your visitors with CAPTCHAs. Using invisible detection techniques, it blocks spam bots while maintaining a seamless user experience.

Why Choose Honeypot Guard?

Unlike CAPTCHA-based solutions that frustrate users and hurt conversions (studies show CAPTCHAs reduce form submissions by 10-40%), Honeypot Guard provides superior spam protection with zero user friction.

How It Works

Honeypot Guard uses multiple layers of intelligent detection to catch spam automatically:

Invisible Honeypot Fields – Hidden fields that real users never see, but bots fill out automatically
Dynamic Field Rotation – Constantly changing field names make it harder for sophisticated bots to adapt
Timestamp Validation – Detects instant submissions (bots can’t read like humans)
Intelligent Gibberish Detection – Catches keyboard mashing and random text patterns
Advanced Heuristic Analysis – Pattern-based detection of common spam characteristics
Character Script Filtering – Optionally block submissions containing specific character scripts (Cyrillic, Chinese, etc.)
Dotted Email Detection – Catches spammers using excessive dots to generate infinite email addresses (e.g. k..a.ir.vi.n@gmail.com)
Cookie Verification – Proves JavaScript execution in a real browser environment

Key Features

Zero User Friction – Completely invisible protection, no annoying puzzles
Privacy-Focused – All processing on your server, no third-party tracking by default
Granular Blacklisting – Block by email, domain, IP address, or keywords
Rate Limiting – Prevent spam floods with configurable submission limits
Detailed Spam Logs – View blocked submissions with one-click IP blocking
Multi-Language Admin – Available in 9 languages (English, German, Spanish, Italian, Lithuanian, Swedish, Polish, Estonian, Spanish-Mexico)
GDPR Compliant – No data sent to external services (unless you enable optional AI detection)
Works Automatically – Integrates seamlessly with popular form plugins

Supported Form Plugins

Contact Form 7
WPForms
Gravity Forms
Ninja Forms
Formidable Forms
WordPress Registration Forms
WordPress Comments
WooCommerce Checkout & Registration
bbPress Forums
Any HTML form with minimal configuration

Advanced Protection Options

Cloudflare Turnstile (Optional) – Invisible CAPTCHA that catches headless browsers, Tor/VPN bots, and bot farms. Free up to 1M validations/month. Fails open — never blocks real users if Cloudflare is down.
AI-Powered Gibberish Detection (Optional) – Use OpenAI or Anthropic APIs for advanced content analysis
Meta Pixel Protection – Block form submission tracking until verification
Custom Honeypot Field Names – Define your own field names for added security
Whitelist Trusted Users – Bypass checks for logged-in users or specific IPs

Privacy & Performance

Honeypot Guard is designed with privacy and performance in mind:

Lightweight – Adds virtually zero latency to your site
No External Calls – Basic protection requires no API calls
Cache Compatible – Works with WP Super Cache, W3 Total Cache, WP Rocket, LiteSpeed, and more
No Cookies Required – Core functionality works without cookies (optional cookie verification available)

Professional Support

Need help? Visit mantasdigital.com/honeypot-guard for documentation and support.

Privacy Policy

Honeypot Guard collects and stores:

IP addresses of form submissions (for spam detection and blocking)
Form submission data flagged as spam (for review and pattern detection)
Timestamps of submissions (for rate limiting)

This data is stored in your WordPress database and is never sent to external services unless you enable optional AI-powered detection.

You can configure automatic deletion of spam logs in Settings > Honeypot Guard.

External Services

This plugin can optionally connect to external AI services for advanced gibberish detection. These services are disabled by default and must be explicitly enabled by the administrator.

OpenAI API (Optional)

When AI gibberish detection is enabled and configured with an OpenAI API key:

What it does: Analyzes suspicious form field content to detect nonsensical or spam text
Data sent: Only the specific text field being analyzed (not the entire form submission)
When sent: Only when a submission is flagged as potentially suspicious and AI detection is enabled
Service provider: OpenAI, L.L.C.
Terms of use: https://openai.com/policies/terms-of-use
Privacy policy: https://openai.com/policies/privacy-policy

Anthropic API (Optional)

When AI gibberish detection is enabled and configured with an Anthropic API key:

What it does: Analyzes suspicious form field content to detect nonsensical or spam text
Data sent: Only the specific text field being analyzed (not the entire form submission)
When sent: Only when a submission is flagged as potentially suspicious and AI detection is enabled
Service provider: Anthropic, PBC
Terms of use: https://www.anthropic.com/legal/consumer-terms
Privacy policy: https://www.anthropic.com/legal/privacy

Cloudflare Turnstile (Optional)

When Turnstile is enabled and configured with site/secret keys:

What it does: Verifies that form submissions come from real browsers, not headless bots
Data sent: A challenge token and the visitor’s IP address
When loaded: By default, only when a visitor starts using a form (can be changed to load on every page with forms)
When sent: On every form submission when Turnstile is enabled
Service provider: Cloudflare, Inc.
Terms of use: https://www.cloudflare.com/website-terms/
Privacy policy: https://www.cloudflare.com/privacypolicy/
Fail-open: If Cloudflare is unreachable, no penalty is applied — real users are never blocked

Important: These services are entirely optional. Honeypot Guard provides effective spam protection without any external services using its built-in detection methods.

Additional Info

Installation

Upload the plugin files to /wp-content/plugins/honeypot-guard/ or install through the WordPress plugins screen
Activate the plugin through the ‘Plugins’ screen in WordPress
Go to Settings > Honeypot Guard to configure protection options
That’s it! Your forms are now protected

FAQ

Does this work with Contact Form 7?: Yes! Honeypot Guard automatically integrates with Contact Form 7, WPForms, Gravity Forms, Ninja Forms, and most other popular form plugins without any configuration.
Will this slow down my site?: No. Honeypot Guard is lightweight and runs entirely on your server. Basic protection requires no external API calls, adding virtually zero latency.
Does it work with caching plugins?: Yes. Honeypot Guard is compatible with WP Super Cache, W3 Total Cache, WP Rocket, LiteSpeed Cache, and other popular caching solutions.
Can I whitelist certain IPs or users?: Yes. Go to Settings > Honeypot Guard and enable whitelist options for logged-in users or specific IP addresses.
What languages are supported?: The admin interface is available in: English, German, Spanish, Spanish (Mexico), Italian, Lithuanian, Swedish, Polish, and Estonian.
Is it GDPR compliant?: Yes. Honeypot Guard does not send any data to external services by default. All processing happens on your server. IP addresses are logged only for spam protection and can be configured for automatic deletion.
Can I use this with Cloudflare?: Yes. Honeypot Guard automatically detects the real visitor IP when behind Cloudflare or other reverse proxies.
Does Turnstile slow down my pages?: By default (Settings “Load Turnstile only when a form is used”), the Cloudflare script is not loaded on page load. It loads, and the challenge runs, only for a form that scrolls into view (loaded in idle time) or that the visitor starts filling in or submits. Hidden forms never load it. Pages with several forms, such as hidden popups, no longer run one challenge per form.
What happens when a visitor’s browser can’t run Turnstile?: Some privacy browsers, script blockers and corporate proxies block challenges.cloudflare.com. The protection script then sends the reason (script blocked, error or timeout) with the form, and the server adds only the smaller “Turnstile unavailable penalty” (default 30) instead of the full failure penalty, so the honeypot, timing, rate limit and content checks decide. Submissions with no JavaScript at all, and challenges that Cloudflare itself failed as likely bots, still get the full penalty. Trade-off: a bot that runs JavaScript could report “unavailable” too, but it still has to pass every other check. Set the penalty to match the full failure penalty to turn this off.
I see Turnstile errors in the browser console. Is that a plugin bug?: Usually not. Messages that come from inside Cloudflare’s challenge iframe are Cloudflare’s own or come from browser extensions injecting into it, and don’t affect the challenge. Examples: “Creating a TrustedTypePolicy named ‘goog#html’ violates … trusted-types” (the Google Tag Assistant extension), “OTS parsing error … WOFF 2.0”, “No available adapters”, and styled %c / NaN log lines.
Can my theme show that a form is waiting for Turnstile?: Yes. If a form is submitted before its Turnstile token is ready, the form gets the CSS class oh-ts-waiting and its submit button gets aria-busy="true" until the form is sent (at most 8 seconds).
Can a Contact Form 7 message be delivered twice?: No. Each form attempt carries a random submission id. The server claims it atomically right before sending, so a repeated request (double click, network retry, replay) is answered with the normal success message but no second email. A new message, or the same form sent again after a successful send, gets a new id and is delivered normally.
What happens when only Turnstile fails on a Contact Form 7 form?: If a submission would be spam only because of Turnstile (expired, reused or missing token) and every other check is clean, the browser silently re-sends it once with a fresh token. The visitor only sees the form sending. If it still fails, “Borderline submissions” decides: Quarantine (default) delivers it with “[HG review]” in the admin email subject, without the autoresponder and without conversion tracking; Reject treats it as spam. The silent retry does not count toward the rate limit. Lead-routing or CRM code can call honeypot_guard_is_quarantined() or hook honeypot_guard_quarantined to skip quarantined submissions.
What if a visitor submits a Contact Form 7 form very quickly?: Submissions faster than the minimum time (default 2 seconds) are not scored as spam. The browser waits the remaining second or two and re-sends automatically; the visitor only sees the form sending. Bots that post directly never re-send, so nothing is delivered. Their attempts appear in the logs as “Silent retry” and turn into spam (“blocked: no retry”) after 10 minutes.
Does it work with WooCommerce?: Yes. Honeypot Guard protects WooCommerce registration and checkout forms automatically when enabled.

Reviews

paddlepower May 28, 2026 1 reply

Plugin seems to be working well. Not super computer literate but I have pretty much no more fake account setups and card cracking attempts on my site. Thanks team!

Read all 1 review

Contributors & Developers

“Honeypot Guard – Silent Anti-Spam” is open source software. The following people have contributed to this plugin.

MDigital

Translate “Honeypot Guard – Silent Anti-Spam” into your language.

Interested in development?

Browse the code, check out the SVN repository, or subscribe to the development log by RSS.

Changelog

2.5.2

CRITICAL FIX: on sites using a JavaScript-delay optimiser (Seraphinite Accelerator, WP Rocket “Delay JS”, Perfmatters and similar), forms could keep “sending” forever on phones when Cloudflare Turnstile was enabled. The optimiser fires the page-ready event a second time, which set up the protection twice; the two copies then kept handing the submission back and forth. Setup now runs once per page, each submit is handled once, and a form can never be held more than three times in ten seconds

2.5.1

Contact Form 7: too-fast submissions get a silent retry instead of being delivered unchecked. The browser waits the remaining time and re-sends once; bots that post directly are no longer delivered and are logged as spam (“blocked: no retry”) after 10 minutes. Scores of delivered submissions are unchanged
Contact Form 7: duplicate and too-fast checks now run before CF7’s own reCAPTCHA/Turnstile and Akismet, so a duplicate replay shows success instead of a spam message and no captcha token is spent on a request that is re-sent
The Turnstile silent retry is limited (3 per submission, 20 per IP per 10 minutes; a submission’s first retry is always allowed) and is not offered when CF7’s own reCAPTCHA/Turnstile is active — those submissions go to quarantine instead of being rejected
Retries, duplicates and quarantine no longer create spam entries in Flamingo
Fixed a PHP deprecation notice on every Contact Form 7 submission with WP_DEBUG on (wpcf7_ajax_json_echo wpcf7_feedback_response)
Fixed “today”/”last hour” statistics and log cleanup using UTC while log times are stored in site time
Fixed a duplicate-guard claim staying active when a no-JavaScript submission was aborted by another plugin
Developers: honeypot_guard_outcome() returns ”, duplicate, soft_retry, fast_retry or quarantine for the current CF7 submission
Logs: new status “Silent retry (re-sent)”

2.5.0

Contact Form 7: a submission is never delivered twice. Each attempt has a submission id that the server claims atomically before sending; repeats get the normal success message without a second email
Contact Form 7: when only Turnstile timing fails (expired, reused or missing token) and every other check is clean, the form silently re-sends once with a fresh token instead of showing the spam message
New “Borderline submissions” setting: Quarantine (default; delivered with “[HG review]” in the admin subject, no autoresponder, no conversion tracking) or Reject
A form can’t be submitted again while its Contact Form 7 request is still in flight
Logs: new statuses Review (quarantined), Silent retry and Duplicate dropped. Silent retries don’t count toward the rate limit
Developers: honeypot_guard_is_quarantined() and the honeypot_guard_quarantined action

2.4.9

CRITICAL FIX: Contact Form 7 (and other AJAX forms) could be sent twice when submitted before the Turnstile token was ready — once immediately without a token (usually rejected as spam) and again after the wait. The submission is now held until the token arrives (or the wait ends) and sent exactly once, with the button the visitor clicked

2.4.8

With lazy Turnstile loading, a visible form now starts its challenge when it scrolls into view (in browser idle time), so a token is usually ready before the visitor types or autofills. Hidden forms still load nothing
While a submission waits for a Turnstile token, the form gets the class oh-ts-waiting and the submit button gets aria-busy=”true”, so themes can show a sending state

2.4.7

Turnstile now loads only when a visitor starts using a form (new setting “Load Turnstile only when a form is used”, on by default). Pages with several forms no longer run one Cloudflare challenge per form on page load, which helps mobile speed
Visitors whose browser can’t run Turnstile (blocked script, privacy browser, proxy, network error or timeout) are no longer scored as spam for that alone: they get the new “Turnstile unavailable penalty” (default 30) instead of the full penalty. Submissions without JavaScript and challenges Cloudflare failed as likely bots still get the full penalty. The reason is stored in the log details
Added ohTurnstile.prewarm(form) to start the challenge early in multi-step forms
Readme: FAQ about Cloudflare console messages that are not plugin errors

2.4.6

Fixed real visitors being marked as spam because of an expired or already-used Turnstile token. Expired tokens are now cleared immediately, tokens older than 270 seconds are refreshed before submit, and the widget gets a new token after every submission (including Contact Form 7 resends after a validation error)
Server now reads the Turnstile error codes: an expired or duplicate token (timeout-or-duplicate) adds only a small penalty (new “Expired / reused token penalty” setting, default 20) instead of the full failure penalty. Error codes are stored in the log details
Added window.ohTurnstile JavaScript API for forms sent via fetch/XHR: ohTurnstile.fresh(form) resolves with a fresh token (or an empty string after 8 seconds, fail-open) and ohTurnstile.used(form) marks the token as spent. An oh:turnstile-token event fires on the form whenever a new token arrives
Double-clicking submit while waiting for a token no longer queues two submissions

2.4.5

Added Form Integrations setting: the Contact Form 7 integration can now be disabled in Settings (enabled by default, so existing behavior is unchanged)
Added honeypot_guard_enable_cf7 filter for developers to toggle the Contact Form 7 integration in code

2.4.4

CRITICAL FIX: Turnstile submit gate no longer blocks form submission — removed stopImmediatePropagation() that killed CF7/WPForms/Gravity Forms handlers
Fixed fail-open bypass using requestSubmit() instead of unreliable btn.click() for consistent re-submission across all form builders
Turnstile gate now fails open immediately when Turnstile API is blocked (ad blocker, CSP, network error) instead of waiting 3 seconds

2.4.3

Fixed remaining unguarded jQuery calls in listenPopups() — Elementor popup/show and PUM pumAfterOpen listeners now also check typeof jQuery before use

2.4.2

Fixed listenPopups() crash on sites with Seraphinite Accelerator — unguarded jQuery calls threw ReferenceError when protection script ran before jQuery loaded (seraph-accel-crit causes early execution)

2.4.1

Added cookie consent compatibility for Moove GDPR Cookie Compliance (data-gdpr=”necessary”) and Borlabs Cookie (data-borlabs-cookie-type=”essential”)
Turnstile now exempt from consent blocking on all 6 major cookie plugins: CACSP, Complianz, CookieYes, CookieBot, Moove GDPR, and Borlabs Cookie

2.4.0

Fixed Turnstile blocked by Seraphinite Accelerator lazy-loading — inline script now marked seraph-accel-crit to prevent deferred execution behind cookie consent modals
Added cookie consent plugin compatibility — Turnstile registered as strictly necessary/functional with CACSP, Complianz, CookieYes, and CookieBot (security feature, not tracking — GDPR Recital 49)
Added CSP header support — challenges.cloudflare.com automatically appended to existing Content-Security-Policy script-src, connect-src, and frame-src directives when Turnstile is enabled

2.3.9

Fixed mu-plugin dropper not firing for multisite-only migrations (migration state was checked after mutation instead of before)
Simplified multisite migration block to correctly set $migrated flag before modifying active_sitewide_plugins

2.3.8

Fixed directory slug migration for WordPress Multisite — network-activated plugins now correctly migrated
Fixed potential fatal error when both old and new plugin paths existed in active_plugins simultaneously

2.3.7

CRITICAL FIX: Plugin silently deactivated after update due to directory slug mismatch — added automatic migration that repairs active_plugins path
Added self-deleting mu-plugin dropper to heal already-broken installs on next page load
Fixed dist ZIP folder name to match WP.org slug (honeypot-guard-silent-anti-spam)

2.3.6

Fixed Turnstile widget not rendering inside popup/modal forms — widget now attaches to document.body instead of inside the form, preventing display:none from blocking the iframe

2.3.5

Security: CF-Connecting-IP header now verified against Cloudflare’s published IP ranges before trusting — prevents IP spoofing on non-Cloudflare sites
Added “Cloudflare IP Detection” setting (auto/on/off) in Security section for manual override
Auto-detect mode fetches live Cloudflare IP ranges (cached weekly) with hardcoded fallback

2.3.4

Security: Fixed REST API validate endpoint — no longer performs stateful mutations (rate limiting, auto-blacklisting) from unauthenticated REST calls
Security: Hardened IP detection — removed trust of spoofable X-Forwarded-For/X-Real-IP headers, now uses REMOTE_ADDR (or Cloudflare CF-Connecting-IP when behind Cloudflare)
Security: Removed public form nonce fallback from REST permission callback

2.3.3

Fixed Turnstile widget visibility — container now uses opacity:0.01 instead of visibility:hidden so Cloudflare’s iframe can render and generate tokens

2.3.2

Fixed Turnstile race condition — forms submitted before Turnstile API loads now wait for the token with a 3-second fail-open timeout
Added form queue (pendingTsForms) for forms protected before Turnstile is ready
Submit interceptor retries up to 6 times (3s) then submits without token to never block real users
Works with all form builders: CF7, WPForms, Gravity Forms, Ninja Forms, Divi, Elementor, etc.

2.3.1

Bumped WordPress compatibility to 7.0

2.3.0

NEW: Dotted Email Detection — catches spammers using excessive dots in email addresses (e.g. k..a.ir.vi.n@gmail.com) to generate infinite unique addresses. Configurable threshold and score penalty. Enabled by default.
NEW: Cloudflare Turnstile Integration — optional invisible CAPTCHA that catches headless browsers, Tor/VPN bots, and bot farms that bypass honeypot fields. Free tier (1M validations/month). Fail-open design — never blocks real users if Cloudflare is unreachable. Server-side token verification (secret key never exposed to browsers).
Both features available in WordPress and Shopify versions

2.2.3

Fixed spacing above activation modal title

2.2.2

Fixed activation modal positioning — now displays as full-screen centered overlay
Blocking modal with dark transparent background on all plugin admin pages
Standalone API endpoint for reliable key activation
Smart review prompts with usage-based timing
Review request email on Day 6 with platform-specific links

2.2.0

Added API key activation system — plugin requires a free API key to enable spam protection
API keys generated at mantasdigital.com/honeypot-guard/ and sent via email
Admin notice prompts activation with link to get a free key
New API Key Activation card at top of settings page
Domain-bound keys for basic abuse prevention
All 9 admin languages updated with activation UI translations
Shopify app: activation banner, settings card, proxy gating

2.1.0

Rebranded from Open Honeypot to Honeypot Guard – Silent Anti-Spam
Improved input sanitization for enhanced security
Consolidated inline scripts into enqueued JavaScript file
Moved inline styles to CSS file for better performance
Fixed output buffering to ensure proper buffer closure
Added additional translated strings for better localization
Updated plugin URLs and documentation

2.0.2

Fixed all WordPress Plugin Check errors for WordPress.org compliance
Added proper output escaping throughout the plugin
Replaced date() with gmdate() for timezone consistency
Replaced parse_url() with wp_parse_url() for WordPress compatibility
Added prefixed helper functions (open_honeypot_t, open_honeypot_e, open_honeypot_url)
Improved SQL query security with proper escaping
Fixed plugin header for WordPress.org submission

2.0.1

Added cookie verification option for JavaScript execution proof
Added blocked entries management for viewing spam patterns
Improved gibberish detection with multiple algorithms
Added South Asian script blocking option
Multi-language sidebar menu items
Updated translations for all 9 languages

2.0.0

Complete rewrite with modern architecture
Added AI-powered gibberish detection (OpenAI/Anthropic)
Added granular blacklisting (email, domain, IP, keywords)
Added rate limiting
Added multi-language support (9 languages)
Added spam log dashboard with one-click IP blocking
Added Contact Form 7 rate limiting fix
Improved heuristic analysis
Added WPML compatibility

1.0.0

Initial release
Basic honeypot protection
Timestamp validation
Simple blacklisting