Joris Le Blansch

I like to use Contact Form 7 on most of my WordPress sites. It’s a powerful form manager that suits all my needs. I don’t like to use external calls to protect the forms from spam submissions though (like reCaptcha or hCaptcha) and don’t want to present a manual captcha to a user (math or other puzzle). Since I couldn’t find a really basic honeypot script that works on most entries, I created one here. Hopefully it’s useful to someone else also.
<h3>Setup</h3>
<ul>
<li>Install the plugin using the regular plugin setup routine or upload the entire apiosys-honeypot-cf7 folder to the /wp-content/plugins/ directory.</li>
<li>Activate the plugin through the “Plugins” menu in WordPress, you MUST have Contact Form 7 AND Flamingo installed and enabled.</li>
<li>Add the following shortcodes to your Contact Form 7 forms:</li>
</ul>
[honeypot] – Adds the hidden honeypot field 
[timestamp] – Adds time-based validation
<ul>
<li>Complete the rest of the options which you can find in Admin > Contact > Honeypot. A generally good working set of values is enabled by default there.</li>
</ul>
<h3>What tests are used?</h3>
<ul>
<li>A Honeypot Field</li>
<li>A Checkbox Trap</li>
<li>Time-Based Validation</li>
<li>Email domain Check</li>
<li>Basic Content Analysis</li>
</ul>
<h3>Does it really work?</h3>
It has been tested on several high-traffic WP sites. I see a return of ~ 1 ‰ (i.e. 1 in a thousand) of spam going through. That usually corresponds to humans paid to fill forms or sophisticated bots. Please feel free to contribute to make it even better. You can contribute directly <a href="https://github.com/apio-sys/apiosys-honeypot-cf7" rel="nofollow ugc">here</a>.

Apio systems – Honeypot for Contact Form 7

Basic Honeypot plugin for Contact Form 7 to drastically reduce spam on form submissions without user interaction.

Freemius

Matt Biscay

Tired of deleting spam comments every day? SpamJam is a lightweight, invisible anti-spam solution that blocks automated spam before it hits your database—without annoying your legitimate users with captchas or verification steps.
<h4>Why SpamJam?</h4>
Unlike traditional anti-spam plugins that rely on third-party services or frustrating captchas, SpamJam uses intelligent honeypot techniques and behavioral analysis to silently eliminate spam bots. Your real visitors won’t see any difference, but spam bots will be stopped cold.
<h4>Free Features</h4>
✅ Honeypot Protection – Invisible fields that trap spam bots 
✅ Referrer Validation – Blocks direct form submissions 
✅ Nonce Security – CSRF protection for all comment forms 
✅ Smart Blocklist – Filters common spam keywords 
✅ Zero Configuration – Works immediately after activation 
✅ No Captchas – Never annoy your real users 
✅ Lightweight – Minimal impact on site performance 
✅ WooCommerce Compatible – Works with HPOS
<h4>Pro Features (Premium)</h4>
🚀 Registration Spam Protection – Protect user registration forms with email verification 
🚀 Premium Blocklist – Auto-updating list of 15,000+ spam terms 
🚀 Custom Blocklist – Add your own keywords and patterns to block 
🚀 Geographic Blocking – Block comments from specific countries 
🚀 IP Blocking – Block specific IP addresses or ranges 
🚀 Rate Limiting – Prevent spam floods with configurable limits 
🚀 Email Whitelist – Always allow trusted email addresses 
🚀 Spam Logging & Analytics – Track and analyze blocked spam attempts 
🚀 Content Validation – Set minimum comment length and maximum links 
🚀 Contact Form Protection – Protect Contact Form 7, WPForms, Gravity Forms 
🚀 User Enumeration Blocking – Enhanced security against attacks 
🚀 Priority Support – Get help when you need it
<a href="https://utopique.net/products/spamjam/" rel="nofollow ugc">Upgrade to SpamJam Pro →</a>
<h4>Perfect For</h4>
<ul>
<li>Blogs with active comment sections</li>
<li>Membership sites</li>
<li>WooCommerce stores</li>
<li>Community websites</li>
<li>Any WordPress site tired of spam</li>
</ul>
<h4>How It Works</h4>
SpamJam uses multiple layers of protection:
<ol>
<li>Honeypot Fields – Hidden form fields that only bots fill out</li>
<li>JavaScript Validation – Ensures forms are submitted by real browsers</li>
<li>Referrer Checking – Verifies submissions come from your site</li>
<li>Hash Validation – Cryptographic verification of form integrity</li>
<li>Keyword Filtering – Blocks known spam patterns</li>
</ol>
All of this happens invisibly in the background. Your legitimate users never see a captcha or verification step.
<h4>Privacy First</h4>
SpamJam doesn’t send your data to third-party services. Everything happens on your server, keeping your users’ information private and your site GDPR-compliant.

SpamJam

Stop 99% of spam comments and registrations automatically. Zero captchas, zero hassle. Your visitors won't even notice it's there.

Apio systems – Honeypot for Contact Form 7 vs SpamJam