KitCode

OneClick Form Lite adds a lightweight contact form to your WordPress site via shortcode:
<ul>
<li>Shortcode: [oneclickform]</li>
<li>Fields: Name, Email, Subject, Message + GDPR consent checkbox</li>
<li>Anti-spam: honeypot + server-side rate limiting</li>
<li>Delivery modes:
<ul>
<li>WordPress wp_mail()</li>
<li>Built-in SMTP</li>
<li>File mode (writes messages to your uploads directory)</li>
</ul>
</li>
<li>Optional Google reCAPTCHA v3 (score-based)</li>
<li>Translations: EN (default) + FR, ES, PT-BR (via included .mo files)</li>
</ul>
Important notes: 
* This plugin does NOT store submitted messages in the WordPress database. 
* Messages are delivered by email (wp_mail/SMTP) or written to files (File mode). 
* Your host/mail provider may store emails in logs and mailboxes. 
* No minified/compiled assets are shipped with this plugin. All distributed CSS/JS is human-readable.
Documentation is included in the plugin: 
docs/oneclick-form-lite-user-guide.html
<h3>Source code</h3>
The plugin ships unminified, human-readable JS/CSS source files. No build process is used.
<h3>External services</h3>
1) This plugin can optionally integrate Google reCAPTCHA v3 to help prevent spam form submissions.
When enabled: 
– The visitor’s browser loads Google’s reCAPTCHA script: 
 https://www.google.com/recaptcha/api.js?render=YOUR_SITE_KEY 
– The browser communicates with Google to obtain a reCAPTCHA token.
On form submission: 
– The plugin sends the reCAPTCHA token to Google for verification: 
 https://www.google.com/recaptcha/api/siteverify 
– The verification request includes the token and the submitter’s IP address (remoteip) when available.
Service provider: Google LLC 
Terms of service: https://policies.google.com/terms 
Privacy policy: https://policies.google.com/privacy
2) This plugin can also send emails via an SMTP server configured by the site administrator (optional).
When SMTP is enabled and an email is sent: 
– The plugin connects to the configured SMTP host and port. 
– Email data is transmitted to the SMTP server in order to deliver the message.
Data sent to the SMTP server may include: 
– Sender and recipient addresses, subject, message content 
– Technical email headers 
– Authentication data (username/password) if configured by the site administrator
Service provider: The SMTP provider selected by the site administrator (e.g., hosting provider, Google Workspace, Microsoft 365, etc.) 
Terms of service: See the selected SMTP provider’s terms 
Privacy policy: See the selected SMTP provider’s privacy policy

OneClick Form Lite

Lightweight contact form with built-in SMTP, optional file delivery, and Google reCAPTCHA v3.

Jeff Sterup

This plugin allows you to automatically insert your Project Honeypot links into all of your pages and block IP addresses that are listed on the Http:BL list from Project Honeypot. There is an option to block IP addresses that have been blocked by Spamcop using their blacklist and the SANS Internet Storm Center API as well. 
To prevent bots from using brute force attacks and scanning your site there is an option to block users that fail to login a set number of times or use blocked user names. You can also block IP addresses that generate a large number of 404 errors. This plugin will also prevent WordPress User Enumeration and automatically block anyone attempting it.

Honeypot Toolkit


This plugin does the job very well. Besides using Project Honyepot and Spamcop, I really love the additional Login and 404 handling that protects from brute force attacks. In combination with a 2FA login plugin this makes me finally feel a lot safer using Wordpress. Thanks a lot!


Amazing! A must have for every site!

Automatically insert Project Honeypot links into your pages and block IP addresses that are listed on various block lists you can choose from.

OneClick Form Lite vs Honeypot Toolkit