Joris Le Blansch

<p>I like to use Contact Form 7 on most of my WordPress sites. It’s a powerful form manager that suits all my needs. I don’t like to use external calls to protect the forms from spam submissions though (like reCaptcha or hCaptcha) and don’t want to present a manual captcha to a user (math or other puzzle). Since I couldn’t find a really basic honeypot script that works on most entries, I created one here. Hopefully it’s useful to someone else also.</p>
<h3>Setup</h3>
<ul>
<li>Install the plugin using the regular plugin setup routine or upload the entire apiosys-honeypot-cf7 folder to the /wp-content/plugins/ directory.</li>
<li>Activate the plugin through the “Plugins” menu in WordPress, you MUST have Contact Form 7 AND Flamingo installed and enabled.</li>
<li>Add the following shortcodes to your Contact Form 7 forms:</li>
</ul>
<p>[honeypot] – Adds the hidden honeypot field<br />
[timestamp] – Adds time-based validation</p>
<ul>
<li>Complete the rest of the options which you can find in Admin > Contact > Honeypot. A generally good working set of values is enabled by default there.</li>
</ul>
<h3>What tests are used?</h3>
<ul>
<li>A Honeypot Field</li>
<li>A Checkbox Trap</li>
<li>Time-Based Validation</li>
<li>Email domain Check</li>
<li>Basic Content Analysis</li>
</ul>
<h3>Does it really work?</h3>
<p>It has been tested on several high-traffic WP sites. I see a return of ~ 1 ‰ (i.e. 1 in a thousand) of spam going through. That usually corresponds to humans paid to fill forms or sophisticated bots. Please feel free to contribute to make it even better. You can contribute directly <a href="https://github.com/apio-sys/apiosys-honeypot-cf7" rel="nofollow ugc">here</a>.</p>


Apio systems – Honeypot for Contact Form 7

Basic Honeypot plugin for Contact Form 7 to drastically reduce spam on form submissions without user interaction.

Jeff Sterup

<p>This plugin allows you to automatically insert your Project Honeypot links into all of your pages and block IP addresses that are listed on the Http:BL list from Project Honeypot. There is an option to block IP addresses that have been blocked by Spamcop using their blacklist and the SANS Internet Storm Center API as well.<br />
To prevent bots from using brute force attacks and scanning your site there is an option to block users that fail to login a set number of times or use blocked user names. You can also block IP addresses that generate a large number of 404 errors. This plugin will also prevent WordPress User Enumeration and automatically block anyone attempting it.</p>


Honeypot Toolkit


This plugin does the job very well. Besides using Project Honyepot and Spamcop, I really love the additional Login and 404 handling that protects from brute force attacks. In combination with a 2FA login plugin this makes me finally feel a lot safer using Wordpress. Thanks a lot!


Amazing! A must have for every site!

Automatically insert Project Honeypot links into your pages and block IP addresses that are listed on various block lists you can choose from.

Apio systems – Honeypot for Contact Form 7 vs Honeypot Toolkit