Contact Form 7 & WPForms Anti-Spam Plugin

Samurai Honeypot for Forms

Invisible defense. Silent kill.

15 layers of spam protection your users never see.
No CAPTCHA. No friction. No configuration.

GPL-2.0 · Free · No account required

Your spam defenses
were built for a different era.

🧩

CAPTCHA punishes users

Image puzzles increase form abandonment. Your real customers leave. Bots with vision AI stay.

🍯

Basic honeypots are solved

Static hidden fields with predictable names are on every bot's blocklist. They skip them instantly.

📨

Akismet filters after the fact

Spam emails still reach your server and your inbox. Classification happens after the damage is done.

🤖

Headless browsers bypass everything

Puppeteer and Playwright execute JavaScript, fill fields, and solve challenges — just like humans.

15 layers of invisible defense.

Each layer scores the submission independently. The combined score triggers our 3-Tier Triage System to handle spam without affecting legitimate users or bloating your database.

01

JS Injection Gate

Blocks non-JS bots instantly. Tokens are fetched via REST API.

02

Polymorphic Honeypot

Decoy fields with cryptographically derived names that change per session.

03

Token Signature

HMAC-SHA256 signed tokens that detect tampering, forgery, and reuse.

04

Time Trap

Detects inhuman submission speed while exempting legitimate browser autofill.

05

Proof of Work

SHA-256 cryptographic puzzle that forces CPU cost on bots via Web Crypto API.

06

Behavioral Entropy

Measures real interaction patterns — movement, keystrokes, scrolling — with integrity verification.

07

UA Age Detection

Scores submissions based on Chrome version age. Bots often use hardcoded, outdated User-Agent strings.

08

Headless UA Block

Server-side check instantly blocks known headless browsers (Puppeteer, Selenium, etc.).

09

Headless Detection

Client-side detection of automated browser environments (webdriver, plugin count).

10

Rate Limiting

Per-source submission throttling with IPv6 /64 normalization.

11

Replay Protection

Atomic token consumption (INSERT IGNORE). Every token works exactly once.

12

IP Blocklist

Block known spam sources by IP or CIDR range directly from the admin panel.

13

Content: URL Limit

Flags messages stuffed with links — a hallmark of SEO spam campaigns.

14

Content: BBCode

Catches forum-style spam syntax ([url=...]) that bots inject into form fields.

15

Content: Denylist

Syncs with WordPress's built-in Disallowed Comment Keys for site-specific rules.

3-Tier Triage System

  • Tier 1 (Pass): Score < Threshold. Email sends normally.
  • Tier 2 (Quarantine): Score ≥ Threshold. Silent Kill — Email is blocked, but saved to local Quarantine Log for review.
  • Tier 3 (Drop): Score ≥ 100. Silent Kill — Email is blocked and permanently dropped. Zero database writes to survive DDoS attacks.

Built for the real world.

Zero Configuration

Activate the plugin. Done. All Contact Form 7 and WPForms forms are protected automatically. No shortcodes, no form editing.

Built-in Quarantine Log

Blocked Tier 2 submissions are saved to a lightweight local table (max 1,000 records, FIFO). Review false positives easily from the admin panel.

Flamingo DB Protection

Unlike other plugins, Samurai Honeypot prevents Silent-Killed spam from bloating Flamingo's database, letting you safely use Flamingo as a CRM.

DDoS-Resilient Drop

Tier 3 bots (score 100+) are immediately dropped from memory. Zero database writes. Protects your server during mass bot attacks.

GDPR Compliant

Zero cookies. Zero external requests. No PII stored. IP addresses are one-way hashed before storage. No cookie consent banner needed.

Cache Compatible

Tokens are fetched via REST API — not embedded in HTML. Works perfectly with WP Super Cache, W3 Total Cache, and Cloudflare.

How it stacks up.

Samurai Honeypot reCAPTCHA Akismet Basic Honeypot
No user interaction
Proof of Work & Behavior
3-Tier Triage (Pass/Log/Drop)
DDoS DB Protection (Drop)
Quarantine Log Included Partial
Flamingo DB Protection
Silent Kill (No Errors)
Full-page cache safe Partial
No cookies / No external APIs

Two steps. That's it.

1

Install & Activate

Upload the plugin or install from WordPress.org. Click "Activate."

2

Done

Every Contact Form 7 and WPForms form on your site is now protected by 15 layers of invisible defense.

Fine-tuning available under Settings → Samurai Honeypot if you want it. You probably won't need it.

Plays well with others.

Samurai Honeypot blocks bots before the email sends. It works alongside your existing security stack — not against it.

Layer 1 — Before submission
Samurai Honeypot

15-layer behavioral & cryptographic scoring. Blocks the majority of bots silently at the form level.

+
Layer 2 — Page-level risk (optional)
reCAPTCHA v3

Google's invisible page-level risk scoring. Adds an independent signal without conflicting with our logic.

+
Layer 3 — After submission (optional)
Akismet

Cloud-based content filter. Catches anything that slips through with pattern matching and ML classification.

WordPress
5.9+
PHP
7.4+
Supported Plugins
Contact Form 7 / WPForms
License
GPL-2.0-or-later

Common questions.

Does it work with page caching plugins?

Yes. Tokens are fetched dynamically via the REST API, not embedded in cached HTML. It's fully compatible with WP Super Cache, W3 Total Cache, Cloudflare, and any other full-page caching solution.

Can I disable protection for a specific form?

Yes. For Contact Form 7, add skip_samhp: on to the form's Additional Settings tab. For WPForms, go to Settings > Samurai Honeypot > Rules & Access, and enter the form IDs you want to skip.

How does Samurai Honeypot work with Flamingo?

We actively protect Flamingo! Samurai Honeypot prevents blocked spam (Tier 2 and Tier 3) from being saved to Flamingo's database. Legitimate messages are saved normally, meaning your Flamingo Inbox stays clean and your database won't bloat.

Where can I see the blocked spam?

Submissions flagged as Tier 2 are saved in our built-in Quarantine Log (Settings > Quarantine Log). You can review the score, reasons, and full form data here. (Note: Tier 3 bots are completely dropped to protect your server).

Does it store personal data?

No. The plugin does not store any PII. IP addresses are one-way hashed with a site-specific salt before being used internally. Raw IPs are never written to the database. No cookies are set. No data is sent to external services.

Can I whitelist logged-in users?

Yes. Enable "Whitelist logged-in users" in the settings, and all scoring is skipped for authenticated users.

What should I do if advanced bots (like headless browsers on AWS/GCP) slip through?

Follow these steps to identify and block datacenter-based bots:

  1. Monitor the source: Add [_remote_ip] and [_user_agent] to your CF7 mail template to log the IP address and User-Agent of every submission.
  2. Block by CIDR range: If submissions are coming from AWS, GCP, or other datacenter IPs, use the IP Blacklist feature to register entire CIDR ranges (e.g. 35.72.0.0/13) for a bulk block (Tier 3 Drop).
  3. ⚠️ Disclaimer: Be cautious — blocking datacenter IP ranges may also block legitimate human users who access your site through corporate VPNs or cloud-based virtual desktops (e.g. Amazon WorkSpaces). Always test and monitor after applying CIDR blocks.

For advanced administrators: If possible, blocking datacenter IPs at the WAF (e.g. Cloudflare, Sucuri) or .htaccess level is even more effective. These blocks are applied before WordPress and PHP are loaded, meaning zero server resources are consumed by blocked requests — unlike plugin-level blocking, which still requires a full WordPress bootstrap for every request.

Stop spam.
Not your users.

Free, open source, and ready in 30 seconds.

Download on WordPress.org