Spam protection, captcha and spam folder

Forms attract spam. Funnelforms protects every form on the new renderer out of the box. What clearly comes from a bot is refused. What only looks suspicious goes into the spam folder: nothing is lost there, but no mail goes out either. In addition you can turn on a captcha and Akismet for the whole website, and keep your own blocklists in Pro.

Requirements

• Funnelforms Free 5.0 or Funnelforms Pro 5.0. Built-in protection, captcha, spam folder and Akismet are included in both editions. The Blocklists (Pro only) exist only in Funnelforms Pro.
• You have the right "Change settings".
• For the captcha you need an account with Cloudflare Turnstile, hCaptcha or Google reCAPTCHA and, from there, a site key and a secret key.
• For Akismet, the Akismet plugin is installed and connected with a key.
• You see the spam folder with the right "See entries".

Where to find it

• For the whole website: Funnelforms → Settings → Entries and spam, cards "Spam protection", "Spam folder" and "Blocklists" (Pro only)
• For one form: open the form → workspace Settings → section Spam protection
• The spam folder: Funnelforms → Entries, tab Spam

Features at a glance

• Built-in protection in every form on the new renderer: a hidden field, the time to fill it in and a limit of entries per visitor.
• Captcha for all forms: Cloudflare Turnstile, hCaptcha, Google reCAPTCHA v2 or Google reCAPTCHA v3.
• Save and test keys checks the keys with the provider.
• Spam folder: suspicious entries send nothing and are deleted after a number of days you set. Not spam takes them back.
• Check entries with Akismet when the Akismet plugin is active.
• Blocklists (Pro only): words and phrases, e-mail addresses and domains, IP addresses and ranges, and throwaway e-mail addresses.
• Per form: turn the captcha of the website on or off.
• At the top of the card "Spam protection", "Your forms are protected by:" lists everything that is active right now.

Step by step

Set up a captcha

1. At the provider, create a widget for your website and note the site key and the secret key. The link Get keys next to each service leads to the provider.
2. Open Funnelforms → Settings → Entries and spam.
3. In the card "Spam protection", choose the service under Captcha.
4. Enter the Site key and the Secret key.
5. For Google reCAPTCHA v3: change Lowest score of a person (reCAPTCHA v3) if needed. 0.5 suits most websites.
6. Click Save and test keys.
7. Open a page with a form and check that the captcha appears on the contact step.

To turn it off, choose None under Captcha and click Save.

Set up the spam folder

1. Open Funnelforms → Settings → Entries and spam, card "Spam folder".
2. Under Delete spam after (days), enter how long spam stays. 0 keeps spam until you delete it.
3. If needed, enter the Shortest time to fill in a form (seconds).
4. If needed, enter Most entries per visitor and hour.
5. Tick Check entries with Akismet if you want to use Akismet.
6. Click Save.

Create blocklists (Pro only)

1. Open Funnelforms → Settings → Entries and spam, card "Blocklists".
2. Enter one item per line in Words and phrases, E-mail addresses and domains or IP addresses and ranges, for example example.com or 203.0.113.0/24.
3. Turn on Throwaway e-mail addresses if needed.
4. For each list, choose what happens with matching entries: Put into the spam folder or Refuse with a neutral message.
5. Click Save.

Turn off the captcha for one form

1. Open the form and switch to the workspace Settings.
2. Open the section Spam protection.
3. Turn off Ask for … in the contact step.
4. Publish the form.

Take an entry back from the spam folder

1. Open Funnelforms → Entries and click the tab Spam.
2. Open the entry. The side panel says why it looks like spam.
3. Click Not spam. For several entries, tick them and click Not spam at the bottom.

How it works

What is refused, and what goes into the spam folder?

Funnelforms refuses what cannot be a person or goes over a fixed limit:

• a send within 3 seconds after the first click in the form,
• a captcha that was not confirmed,
• more than ten entries per visitor and form within ten minutes,
• more entries per hour than you set under Most entries per visitor and hour (across all forms).

What could also come from a person goes into the spam folder:

• a hidden field that was filled in ("A hidden field was filled in, as bots do"),
• a send faster than the Shortest time to fill in a form,
• a low score from reCAPTCHA v3,
• a hit at Akismet,
• a hit in a blocklist set to Put into the spam folder (Pro only).

For the limits, visitors are recognized by a hash of their IP address; the IP address itself is not stored for this.

What happens in the spam folder?

An entry in the spam folder sends no mail and runs no action, integration or conversion. It counts in no statistics. The visitor still sees the same confirmation as for every entry. Not spam takes an entry back and sends what was held back. Spam is deleted after the days set under Delete spam after (days), by default after 30 days.

Which captcha services are there?

The captcha appears on the contact step of every form that has no captcha of its own. The plugin checks every answer with the provider before it stores the entry. The secret key, the answer of the widget and the IP address of the visitor are sent to the provider for this.

What does "Save and test keys" say?

• "The keys work …": the provider knows the secret key, and the site key has the right form.
• "The site key does not look like a key of this service …": maybe you swapped the keys or picked another service.
• "The service does not know this secret key …": copy it again from the provider.
• "The service could not be reached to test the keys …": try again later.

What about forms that use reCAPTCHA from Funnelforms 3?

Forms with their own reCAPTCHA keys from Funnelforms 3 keep their reCAPTCHA. On the new renderer the plugin also checks this answer with the provider.

When does the provider's script load?

This depends on the privacy mode under Settings → General:

• EU (GDPR), the default: the script loads at once only if your cookie banner reports consent for marketing through the WP Consent API. Otherwise the contact step shows a button such as "Load spam protection from Cloudflare to send the form". Only after the click does the captcha load.
• Global (opt-out): the script loads at once unless the visitor refused or their browser sends Global Privacy Control.
• Unrestricted (at your own risk): the script always loads at once.

Without a confirmed captcha the visitor cannot send. Mention the provider in your privacy policy.

How is the secret key kept?

The field Secret key is empty after saving and shows "Saved; leave empty to keep it". If you leave it empty, the saved key stays the same as long as you do not change the service.

What does Akismet send to Automattic?

Akismet uses the key of your Akismet plugin. Name, e-mail address, typed text, page, language, browser and IP address of each entry go to Automattic (USA) for the check; in the EU privacy mode the IP address is shortened first. If Akismet cannot be reached, the entry is accepted as usual. If you take an entry back with Not spam, Funnelforms reports the mistake to Akismet. Mention Akismet in your privacy policy.

How do the blocklists work? (Pro only)

• Words and phrases: one per line. Funnelforms looks for them as a whole word in what visitors typed, ignoring upper and lower case. E-mail addresses and phone numbers are not included.
• E-mail addresses and domains: one per line, an address such as name@example.com or a domain such as example.com with its subdomains.
• IP addresses and ranges: one per line, an IPv4 or IPv6 address or a range such as 203.0.113.0/24.
• Throwaway e-mail addresses: a built-in list of known throwaway e-mail services such as Mailinator or Trashmail.

If several lists match, the stricter action wins. Refused visitors see the general error message of the form, which gives no reason. The default is Put into the spam folder.

What does the spam protection in the form show?

The section Spam protection in the form shows "This form is protected by:" with everything that applies to this form. You see the switch Ask for … in the contact step once a captcha is set up for the website. Turn it off only for forms that need no captcha, such as internal ones. Entries that look like spam still go into the spam folder.

Best Practices

• Keep the built-in protection on and add a captcha only if spam still arrives.
• Look into the spam folder regularly and take real requests back with Not spam.
• In Pro, use blocklists with Put into the spam folder as long as you are not sure that a rule hits only spam.
• Mention the captcha provider and Akismet in your privacy policy.

Troubleshooting

Tips

Tip: With Save and test keys you notice swapped keys at once, not only with the first visitor.

• The captcha of the website appears only on the contact step.
• In Site Health and in the diagnostics you see which captcha and which privacy mode are set.
• The tab Spam shows the number of entries in it.

FAQ

Which captcha services are there? Cloudflare Turnstile, hCaptcha, Google reCAPTCHA v2 and Google reCAPTCHA v3 for the whole website. Forms from Funnelforms 3 can keep their own reCAPTCHA.

Do I need a captcha? Not necessarily. Every form on the new renderer has built-in protection and the spam folder.

Does the visitor notice that their entry is in the spam folder? No. They see the same confirmation as for every entry.

How many entries may a visitor send? By default ten per form within ten minutes. With Most entries per visitor and hour you set a limit across all forms.

Are there blocklists in Free? No. Spam folder, captcha and Akismet exist in Free and Pro, the blocklists only in Pro.

Related articles

• Privacy mode (EU or global)
• Viewing, filtering, exporting and deleting entries
• Settings at a glance
• Privacy and personal data