OptionWeb

<p>OW Forms is a modern WordPress form builder for sites that prioritize performance, accessibility, and GDPR compliance. Built by OptionWeb for production use on client sites, it ships with a JSON-driven schema engine, a REST-based submission pipeline, and a curated set of 16 field types — text, email, tel, URL, number, textarea, select, radio, checkbox, checkbox-group, date, time, datetime, file upload, hidden, and rating — plus auto-injected GDPR consent and anti-spam fields.</p>
<p>The anti-spam stack runs four layers in parallel: a visually-hidden honeypot input that bots fill but humans never see, a time-trap that rejects submissions completed faster than a configurable threshold, a multi-provider CAPTCHA layer (Cloudflare Turnstile, Google reCAPTCHA v3, hCaptcha, or Friendly Captcha), and optional OW Shield IP reputation scoring with a disposable-email blocklist. Every signal is logged so you can tune thresholds without flying blind. Submissions that score above 80 are silently rejected — no error message, no honeypot leak.</p>
<p>GDPR compliance is native, not bolted on. Every form gets a consent checkbox linked to your privacy policy, IP addresses can be stored pseudonymized or not at all, user agents are SHA-256 hashed by default, and a daily cron purges submissions older than your retention window (CNIL default: 1095 days). When OW Consent is active, OW Forms wires into its DSAR endpoint — erasure requests automatically delete matching submissions by email hash, with full audit trail. Submission emails are SHA-256 hashed with a plugin-owned salt (option <code>owfo_dsar_salt</code>, generated once at activation) so the database never holds plaintext PII linkable across systems, and DSAR erasure keeps working even after <code>wp config shuffle-salts</code>.</p>
<p>The one-click Contact Form 7 importer parses every CF7 form in your database, builds the equivalent OW Forms schema (preserving recipient, subject, and field types), and rewrites every <code>[contact-form-7 id="..."]</code> shortcode in your posts to <code>[owfo_form id="..."]</code>. Email notifications support HTML or plain text with <code>{{token}}</code> interpolation, optional auto-reply, signed outbound webhooks (HMAC-SHA256), and a Gutenberg block in addition to the shortcode and REST API.</p>
<h3>External services</h3>
<p>OW Forms relies on optional third-party CAPTCHA services to protect form submissions<br />
from spam. <strong>None of these services are contacted unless you explicitly enable a<br />
CAPTCHA provider in OW Forms <span aria-hidden="true" class="wp-exclude-emoji">→</span> Settings <span aria-hidden="true" class="wp-exclude-emoji">→</span> Anti-spam.</strong></p>
<p>The OW Shield integration is fully local — when the OW Shield plugin is installed<br />
and active on the same site, OW Forms reads its IP reputation score from the local<br />
database/cache. No request leaves your server for this lookup; OW Shield itself<br />
may contact its own reputation service, which is disclosed in the OW Shield readme.</p>
<p>The Friendly Captcha widget JavaScript is bundled with OW Forms under<br />
    assets/js/vendor/ (no external CDN is hit at page render). Source: the upstream<br />
MIT-licensed package at https://github.com/FriendlyCaptcha/friendly-challenge —<br />
the files shipped here are the official npm <code>friendly-challenge@0.9.18</code> build<br />
outputs (<code>widget.module.js</code> and <code>widget.module.min.js</code>, unmodified, renamed to<br />
    friendly-challenge-0.9.18.module.js / <code>friendly-challenge-0.9.18.module.min.js</code><br />
to make the version explicit in the filename). Both the minified and the<br />
human-readable non-minified source are shipped per WordPress.org Plugin Check<br />
requirements.</p>
<p>When a CAPTCHA provider is enabled, OW Forms loads the vendor’s JavaScript widget<br />
on pages that render a form, and posts the challenge solution back to the vendor’s<br />
verification API when a visitor submits the form. The data sent to the vendor is<br />
limited to: (a) the challenge token generated client-side by the vendor’s widget,<br />
(b) the visitor’s IP address (passed through to the vendor for fraud scoring), and<br />
(c) the site’s API secret key configured in the settings.</p>
<h4>Cloudflare Turnstile</h4>
<ul>
<li>What it is: a CAPTCHA / bot-mitigation service by Cloudflare, Inc.</li>
<li>When data is sent: only when <code>spam_captcha_provider</code> is set to <code>turnstile</code>, and<br />
only on form submission. The widget JS is also loaded on every page that renders<br />
a form.</li>
<li>Data sent: Turnstile challenge token, visitor IP, your Turnstile secret key.</li>
<li>Terms of service: https://www.cloudflare.com/website-terms/</li>
<li>Privacy policy: https://www.cloudflare.com/privacypolicy/</li>
</ul>
<h4>Google reCAPTCHA v3</h4>
<ul>
<li>What it is: an invisible CAPTCHA / risk-scoring service by Google LLC.</li>
<li>When data is sent: only when <code>spam_captcha_provider</code> is set to <code>recaptcha_v3</code>, and<br />
only on form submission. The widget JS is also loaded on every page that renders<br />
a form (this is how reCAPTCHA v3 builds its risk score).</li>
<li>Data sent: reCAPTCHA token, visitor IP, your reCAPTCHA secret key. Google may<br />
also collect additional telemetry as described in their privacy policy.</li>
<li>Terms of service: https://policies.google.com/terms</li>
<li>Privacy policy: https://policies.google.com/privacy</li>
</ul>
<h4>hCaptcha</h4>
<ul>
<li>What it is: a privacy-focused CAPTCHA service by Intuition Machines, Inc.</li>
<li>When data is sent: only when <code>spam_captcha_provider</code> is set to <code>hcaptcha</code>, and<br />
only on form submission. The widget JS is also loaded on every page that renders<br />
a form.</li>
<li>Data sent: hCaptcha token, visitor IP, your hCaptcha secret key.</li>
<li>Terms of service: https://www.hcaptcha.com/terms</li>
<li>Privacy policy: https://www.hcaptcha.com/privacy</li>
</ul>
<h4>Friendly Captcha</h4>
<ul>
<li>What it is: a privacy-first, proof-of-work CAPTCHA service by Friendly Captcha GmbH<br />
(Germany). No user puzzle, no tracking cookies.</li>
<li>When data is sent: only when <code>spam_captcha_provider</code> is set to <code>friendly_captcha</code>,<br />
and only on form submission. The widget JS itself is bundled with OW Forms (not<br />
loaded from an external CDN); only the verification request reaches the vendor.</li>
<li>Data sent: Friendly Captcha challenge token, visitor IP, your Friendly Captcha<br />
secret key.</li>
<li>Terms of service: https://friendlycaptcha.com/legal/terms/</li>
<li>Privacy policy: https://friendlycaptcha.com/legal/privacy-end-users/</li>
</ul>
<h4>Outgoing webhook (admin-configured)</h4>
<ul>
<li>What it is: a URL of your choosing that OW Forms POSTs to after each submission.<br />
No data leaves your site until you fill the <code>webhook_url</code> setting in OW Forms <span aria-hidden="true" class="wp-exclude-emoji">→</span><br />
Settings <span aria-hidden="true" class="wp-exclude-emoji">→</span> Notifications.</li>
<li>When data is sent: on every form submission, immediately after the admin<br />
notification email is dispatched. Non-blocking — your visitor’s submission<br />
response is not delayed by the webhook endpoint’s latency.</li>
<li>Data sent: form id, submission id, sanitized field payload (the same data<br />
stored in your <code>wp_owfo_submissions</code> table), site URL, ISO 8601 timestamp.<br />
If a webhook secret is configured, an <code>X-OWFO-Signature</code> HMAC-SHA256 header<br />
is added so the receiver can verify the payload origin.</li>
<li>Vendor: whoever owns the URL you configured. OW Forms has no built-in vendor<br />
for this — it is your responsibility to ensure the receiving endpoint complies<br />
with applicable privacy regulations for your submissions.</li>
</ul>


OW Forms

Modern, lightweight WordPress form builder with native GDPR compliance, anti-spam stack, and Contact Form 7 importer.

yonifre

WpMaspik

<p>Maspik is an advanced WordPress anti-spam plugin that blocks bots, fake leads, and unwanted submissions across your entire site — without hurting real users.</p>
<p>Trusted by thousands of websites worldwide. Works automatically on activation.</p>
<p>👉 Works with all major form plugins. No CAPTCHA. No coding. Immediate results.</p>
<h3>Why block spam with Maspik?</h3>
<ul>
<li>🚀 <strong>Instant protection</strong> – Works as soon as you activate the plugin.</li>
<li>🎯 <strong>High success rate</strong> – Better protection than traditional CAPTCHA.</li>
<li>🔍 <strong>Smart detection</strong> – Identifies spam patterns automatically with advanced rules and optional AI spam detection.</li>
<li>🌐 <strong>Wide compatibility</strong> – Supports all major form plugins and WordPress core forms (comments, registration).</li>
<li>🛠️ <strong>Fully customizable</strong> – Blacklists, IP blocking, character limits, link limits, countries, languages, and more.</li>
<li>👥 <strong>Spam Block Guarantee</strong> – We are committed to helping you block spam. See the <a href="#-spam-block-guarantee---for-all-users" rel="nofollow ugc">Spam Block Guarantee</a> section.</li>
</ul>
<h3>Key Features</h3>
<p>✅ Works instantly with popular form plugins and core WordPress forms<br />
✅ No CAPTCHA required – silent protection for your visitors<br />
✅ Forbidden keywords list system (Blacklist/Blocklist) – block any word, phrase, or pattern you want per field type<br />
✅ IP blacklist & API integrations<br />
✅ Phone number validation<br />
✅ Multiple honeypot methods and advanced key checks<br />
✅ Multi-language support<br />
✅ Maspik Matrix – Cloud-based Multi-layer spam protection engine</p>
<h3>Detailed Features – Advanced Spam Protection & Filtering</h3>
<h3>Maspik Matrix – Advanced Multi-Layer Spam Protection</h3>
<p>Maspik Matrix is a powerful layered spam filter that combines multiple detection methods into one unified protection system.</p>
<p>This engine performs several checks in parallel to increase accuracy and reduce false positives, including:</p>
<ul>
<li>IP reputation and risk scoring  </li>
<li>Pattern matching and keyword analysis  </li>
<li>Heuristic behavior checks  </li>
<li>Structural and content-based evaluation  </li>
<li>AI Spam Check scoring mechanisms  </li>
<li>Learn from spam submissions and improve over time</li>
</ul>
<p>Maspik Matrix provides stronger, faster, and more reliable spam detection by evaluating each submission through multiple layers of protection simultaneously.</p>
<p>Maspik includes <strong>100 free Matrix checks</strong> so you can start protecting forms immediately.<br />
<strong>Pro users get unlimited Matrix checks</strong>.</p>
<p>Note – Local checks are not counted towards the monthly limit, only API calls are counted.</p>
<h3>Blacklisting by Field Type</h3>
<ul>
<li><strong>Text fields/Text area fields</strong> (e.g. name, subject, message)</li>
<li><strong>Email fields</strong> (supports regex/wildcard patterns)</li>
<li><strong>URL fields</strong></li>
<li><strong>Phone number fields</strong> (regex/wildcard support)</li>
</ul>
<h3>Blocking Capabilities</h3>
<ul>
<li>Specific IP addresses</li>
<li>Spam submissions in:
<ul>
<li>WordPress comments</li>
<li>WordPress registration forms</li>
<li>Contact forms from supported plugins (see list below)</li>
</ul>
</li>
<li>Option to block submissions containing emojis in textarea fields</li>
<li>Blocking bot-generated submissions</li>
<li>Advanced key checks to detect automated submissions</li>
</ul>
<h3>Advanced Blocking</h3>
<ul>
<li>Honeypot fields (multiple strategies)</li>
<li>IP verification (100 checks/month in free version)</li>
<li>Advanced key check engine</li>
</ul>
<h3>Character Control</h3>
<ul>
<li>Maximum characters in text fields</li>
<li>Maximum characters in textarea fields</li>
</ul>
<h3>Link Limitation</h3>
<ul>
<li>Limit the number of links allowed in textarea fields (for example, 0–1 links)</li>
</ul>
<h3>API Integrations</h3>
<ul>
<li><strong>Proxycheck.io</strong> – Check IP addresses against proxy/VPN/TOR</li>
<li><strong>AbuseIPDB.com</strong> – Check IP addresses against abuse/spam/malicious/proxy/VPN/TOR</li>
<li><strong>Numverify.com</strong> – Validate phone numbers to block spam phone numbers</li>
</ul>
<h3>Spam Log</h3>
<ul>
<li>Review blocked submissions</li>
<li>Understand why and how spam was blocked</li>
<li>Use logs to fine-tune your spam protection</li>
</ul>
<h3>Detailed Statistics</h3>
<ul>
<li>Track how many spam submissions were blocked</li>
<li>Analyze patterns</li>
<li>Monitor protection over time</li>
<li>Advanced spam statistics dashboard in the admin</li>
</ul>
<h3>Supported Forms</h3>
<p>Maspik integrates seamlessly with a wide range of popular form plugins and WordPress core forms:</p>
<ul>
<li>Elementor Forms</li>
<li>Elementor Atomic Forms</li>
<li>Contact Form 7</li>
<li>Hello Plus</li>
<li>Ninja Forms</li>
<li>Everest Forms</li>
<li>Formidable Forms</li>
<li>JetFormBuilder</li>
<li>Forminator Forms</li>
<li>Fluent Forms</li>
<li>Bricks Builder Forms</li>
<li>Breakdance Builder Forms</li>
<li>Divi Contact Form (Divi theme or Divi Builder plugin)</li>
<li>BuddyPress</li>
<li>Bitforms</li>
<li>Metform</li>
<li>WordPress comments</li>
<li>WordPress registration form</li>
<li>Custom PHP forms</li>
<li>WPForms*  </li>
<li>Gravity Forms*  </li>
<li>WooCommerce registration form*  </li>
<li>WooCommerce review*</li>
<li>WooCommerce checkout*</li>
</ul>
<p>(*) Pro license required.</p>
<h3>Pro Version Features 🌟</h3>
<p>Upgrade to Maspik Pro to unlock powerful additional features:</p>
<ul>
<li>⭐ Maspik Matrix – Unlimited checks</li>
<li>⭐ Custom spam dashboard for multiple sites – manage all spam settings from one place</li>
<li>⭐ Country-based filtering – block spam by country or allow only specific countries</li>
<li>⭐ Language-based filtering – block spam by language or allow only specific languages</li>
<li>⭐ Settings import/export</li>
<li>⭐ Premium support</li>
</ul>
<p>Learn more and get Maspik Pro at:<br />
https://wpmaspik.com/?readme-file</p>
<h3>Important Note</h3>
<p>Be cautious when selecting words to blacklist, as every website has different needs.<br />
For example, if you are a digital marketing agency and blacklist the word “SEO”, you may lose some valid leads.</p>
<p>The plugin is provided “as is” and the user assumes full responsibility for configuring and using it appropriately for their specific needs.</p>
<p>Maspik is GDPR compliant.</p>
<h3>Support & Community</h3>
<ul>
<li>🚀 <a href="https://wpmaspik.com/documentation/getting-started/?readme-file" rel="nofollow ugc">Get Started guide</a></li>
<li>📚 <a href="https://wpmaspik.com/documentation/?readme-file" rel="nofollow ugc">Documentation</a></li>
<li>💬 <a href="https://www.facebook.com/groups/maspik" rel="nofollow ugc">Community Forum</a></li>
<li>🐛 <a href="https://wpmaspik.com/#support?readme-file" rel="nofollow ugc">Report Issues</a></li>
<li>💡 <a href="https://wpmaspik.com/#support?readme-file" rel="nofollow ugc">Feature Requests</a></li>
<li>💰 <a href="https://wpmaspik.com/get-maspik-pro-for-free-share-your-expertise/?readme-file" rel="nofollow ugc">Receive Maspik Pro for free</a></li>
<li>💖 <a href="https://wordpress.org/support/plugin/contact-forms-anti-spam/reviews/#new-post" rel="ugc">Support us with a 5-star review</a></li>
<li>✨ <a href="https://wpmaspik.com/?readme-file" rel="nofollow ugc">WP Maspik Website</a></li>
</ul>
<h3>🛡️ Spam Block Guarantee – for all users</h3>
<p>We stand behind our protection. If spam is still getting through your forms, our team is here to help and guide you to block it.</p>
<h3>Getting Help is Easy</h3>
<ol>
<li>Join our <a href="https://www.facebook.com/groups/maspik" rel="nofollow ugc">Community Forum</a></li>
<li>Create a new post with:
<ul>
<li>Your website URL and form page URL (optional)</li>
<li>Description of the spam you are receiving</li>
<li>Screenshot or text of sample spam submissions</li>
<li>Your Maspik version</li>
<li>Screenshot or export of your current Maspik settings</li>
</ul>
</li>
</ol>
<p>Our team will guide you step-by-step to block the spam effectively.</p>


Maspik – Ultimate Spam Protection


Easily the best solution for fighting spam. Their support is top notch as well.


Excellent solution

No more fake leads or unwanted submissions — Maspik blocks spam instantly across all forms without using CAPTCHA.

OW Forms vs Maspik – Ultimate Spam Protection