To stop form spam in WordPress, start with checks that bots fail and people never see, then add more only on the forms that still get hit. Most spam comes from bots, and most bots are easy to catch. This guide is ideal for beginners and for busy teams drowning in junk entries. We explain the layers, the order to add them and what each one costs your real visitors.
The short version
- Start with a hidden field and a timer, which catch most bots in 0 clicks.
- Add a math question next, which takes a person about 2 seconds.
- Use reCAPTCHA or hCaptcha only on forms that real people are paid to spam.
- Mark what gets through as spam, so that sender is blocked from every form.
Why do forms get so much spam?
Because bots find forms automatically and fill them in by the thousand. Some post links to raise their own search rankings. Others test stolen card numbers on payment forms, or try to break into your site. A busy contact form can collect dozens of junk entries every day if nothing stops them.
Contact form spam is the most common kind, because contact forms are on almost every site. The good news is that bots are lazy. They fill in every box they find and send the form instantly, and those two habits give them away.
Which spam checks should you use, and in what order?
Stack the checks from lightest to heaviest. Each layer catches spam the one before missed, and each one asks a little more of real visitors:
| Layer | How it works | What it costs a real visitor |
|---|---|---|
| Hidden field | A box people never see; bots fill it in | Nothing |
| Timer | Drops a form sent within 3 seconds of loading | Nothing |
| Math question | What is 4 + 7?, new each time | About 2 seconds |
| CAPTCHA | reCAPTCHA or hCaptcha proves they are human | 5 to 10 seconds, sometimes more |
| Block list | Stops one IP or email from every form | Nothing, unless they are blocked |
In Echo Forms the first two are one setting, Block bots (no CAPTCHA), and it is on for every new form. A caught bot still sees the normal thank-you message, so it never learns it was stopped.
Is a CAPTCHA worth it?
Sometimes, but not by default. A CAPTCHA stops spam that people send by hand, which no trap can catch. It also costs you genuine entries, because some visitors give up on the puzzle. We suggest it only for a form that still gets spam after 7 days with the lighter checks on, because a real visitor may lose 10 seconds or more on a hard puzzle.
If you add one, Google reCAPTCHA and hCaptcha both have free tiers. Both set cookies, so if you turn on Echo’s Cookie-free forms setting, the CAPTCHA does not load at all, and the form warns you.
How to stop form spam in WordPress, step by step
- Open the form and go to Settings > Spam protection.
- Check that Block bots (no CAPTCHA) is on. Leave it on for every form.
- Wait 7 days and look at your entries.
- Still getting spam? Add a Math question field from the Layout group.
- Still getting spam after another 7 days? Tick Require a CAPTCHA and connect reCAPTCHA or hCaptcha.
- For anything that slips through, open the entry and press Mark as spam. Check new entries once every 24 hours while you tune it, which takes about 5 minutes.
The spam protection guide covers every setting with pictures.
What does “Mark as spam” do?
It moves the entry to the trash and blocks the sender. Their IP address, and their email address if they gave one, can no longer send any of your forms, whatever each form’s own spam settings say. That is your block list, built from real spam rather than a list someone else made, and the simplest way to block spam submissions from a repeat sender.
Can spam protection stop real people?
It can if you overdo it. The hidden field and the timer never do, because people do not see the field and nobody fills in a form in under 3 seconds. A math question rarely does. A CAPTCHA sometimes does, especially for people using screen readers or older phones. That is why we put it last, and why we never turn it on by default.
What about payment forms?
Payment forms attract a nastier kind of bot that tests stolen cards. Keep the hidden check on, and let your payment provider’s own fraud tools do their job: Stripe Radar is built in for Stripe accounts. The person still pays on the provider’s page, so card details never reach your site.
Form spam protection is about layers, not walls. Start light, watch your entries for a week, and add a heavier check only where the lighter ones fall short. Our contact form guide shows where the spam settings fit in a new form, and every Echo feature is listed in one place.
Spam protection that real people never notice
Every Echo Forms form starts with a hidden trap and a timer, free, with no CAPTCHA needed.
