چۈشەندۈرۈش

I like to use Contact Form 7 on most of my WordPress sites. It’s a powerful form manager that suits all my needs. I don’t like to use external calls to protect the forms from spam submissions though (like reCaptcha or hCaptcha) and don’t want to present a manual captcha to a user (math or other puzzle). Since I couldn’t find a really basic honeypot script that works on most entries, I created one here. Hopefully it’s useful to someone else also.

Setup

Install the plugin using the regular plugin setup routine or upload the entire apiosys-honeypot-cf7 folder to the /wp-content/plugins/ directory.
Activate the plugin through the «Plugins» menu in WordPress, you MUST have Contact Form 7 AND Flamingo installed and enabled.
Add the following shortcodes to your Contact Form 7 forms:

[honeypot] – Adds the hidden honeypot field
[timestamp] – Adds time-based validation

Complete the rest of the options which you can find in Admin > Contact > Honeypot. A generally good working set of values is enabled by default there.

What tests are used?

A Honeypot Field
A Checkbox Trap
Time-Based Validation
Email domain Check
Content Analysis (across all form fields, not just the message)
Weak-Signal Scoring (combines many small clues to catch «human-looking» spam)

Does it really work?

It has been tested on several high-traffic WP sites. I see a return of ~ 1 ‰ (i.e. 1 in a thousand) of spam going through. That usually corresponds to humans paid to fill forms or sophisticated bots. Please feel free to contribute to make it even better. You can contribute directly here.

ئېكران كەسمىسى

Spam caught when Honeypot field was filled.

Spam caught when the form was submitted too quickly. — Spam caught when Honeypot field was filled.

ئورنىتىش

Install the plugin using the regular plugin setup routine or upload the entire apiosys-honeypot-cf7 folder to the /wp-content/plugins/ directory.
Activate the plugin through the «Plugins» menu in WordPress, you MUST have Contact Form 7 AND Flamingo installed and enabled.
Add the following shortcodes to your Contact Form 7 forms:

[honeypot] – Adds the hidden honeypot field [timestamp] – Adds time-based validation

Complete the rest of the options which you can find in Admin > Contact > Honeypot. A generally good working set of values is enabled by default there.

باھالاشلار

بۇ قىستۇرمىغا تېخى باھا يېزىلمىدى.

تۆھپىكار ۋە ئىجادكار

«Apio systems – Honeypot for Contact Form 7» كودى ئوچۇق يۇمشاق دېتال. تۆۋەندىكى كىشىلەر بۇ قىستۇرمىغا تۆھپە قوشقان.

Joris Le Blansch

«Apio systems – Honeypot for Contact Form 7» نى تىلىڭىزغا تەرجىمە قىلىڭ

ئىجادىيەتكە قىزىقامسىز؟

كودقا كۆز يۈگۈرتۈپ، SVN خەزىنە تەكشۈرۈپ ياكى RSSئارقىلىق ئىجادىيەت خاتىرىسىگە مۇشتەرى بولغىلى بولىدۇ.

ئۆزگىرىش خاتىرىسى

1.0.4 – 2026-07-28

FIX: The URL limit counted every link occurrence, so a normal business enquiry that named the sender’s own website once in the body and again in a signature was counted as two links and marked as spam. Distinct link domains are now counted instead, so the same site repeated in one message counts once. This resolves a confirmed false positive.
NEW: «Allow Links to the Sender’s Own Domain» (on by default). Links whose domain matches the sender’s email domain no longer count towards the URL limit, so someone writing from jane@example.com may link to example.com freely. The match is exact or a subdomain, so a sender at example.com does not unlock example-deals.com.
NEW: «Ask the Visitor to Remove Extra Links» (off by default). When enabled, a message over the link limit fails Contact Form 7 validation with a friendly, editable message shown beside the message field, instead of Contact Form 7’s generic «an error occurred» spam response. The visitor can remove a link and send again. Note that submissions stopped this way are not stored in Flamingo at all, unlike submissions caught by the spam checks.
NEW: «Link Limit Message» setting to customize the text of that notice; leave it blank to use the built-in default, which names your configured limit.
FIX: Resolved a Plugin Check / WPCS ValidatedSanitizedInput.InputNotSanitized warning left over from 1.0.2’s work-email validation. The POST value was sanitized, but through a wrapper function that the sniff cannot follow. Sanitizing is now applied directly to the input via map_deep(), which also sanitizes each element of multi-value fields individually rather than after flattening. No behavior change for ordinary text fields.

1.0.3 – 2026-07-20

FIX: Removed a redundant @version docblock tag from the main plugin file that had drifted out of sync with the Version: header. The mismatch could stop some WordPress installs from recognizing the update; the Version: header is now the single source of truth.
FIX: Sanitize the company-name POST value before comparison so no non-sanitized input is read (resolves a Plugin Check / WPCS ValidatedSanitizedInput warning). No behavior change.

1.0.2 – 2026-07-20

FEAT: New «Company Name + Free Email» scoring signal – adds a point when a company/organization name is filled in but a free/personal email (gmail, hotmail…) is used. Catches human-looking spam that claims a corporate identity while writing from a throwaway mailbox. Off by default; recommended for business (B2B) forms.
FEAT: New opt-in «Work Email Requirement» – a friendly Contact Form 7 validation message that asks the visitor for a work address when they provide a company name but a free/personal email, instead of silently accepting the submission. Message is customizable.
FEAT: Company/organization field names are now configurable (used by both features above).

1.0.1 – 2026-07-14

CHANGE: Widened the «short message» scoring signal from under 6 words to under 15 words (still a single weak point). Catches content-free one-liners («I agree», «write about your prices») from JS-executing bots that leave the honeypot empty, while staying well clear of genuine inquiries, which run to dozens of words.

1.0.0 – 2026-07-12

FEAT: Weak-signal spam scoring – combines many small clues (links, free/disposable email, gmail alias tricks, random digits in email, very short messages, «Name & Name» company patterns, missing JavaScript) with a configurable threshold to catch human-looking spam that passes every individual check.
FEAT: Content analysis now scans additional fields (name, company, job title, subject…), not only the message.
FEAT: Keyword matching normalizes hyphens, punctuation and accents, so «no-obligation» matches «no obligation».
FEAT: Detects whitespace / blank-line flooding used to hide spam.
FEAT: URL detection now also counts www. and bare-domain links; optional «disallow any link in message» toggle.
CHANGE: Merged the separate «spam keywords» and «spam phrases» lists into a single list (existing settings are migrated automatically).
First mature release after months of testing on live data.

0.9.4 – 2025-12-04

FEAT: Added checkbox trap.
FEAT: Improved field hiding.
FEAT: Email domain TLD check.
FEAT: Updated default spam keywords list.
FEAT: Separate list with spam phrases.
FEAT: Obfuscated timestamp.

0.9.3 – 2025-11-16

FIX: CSS resource version.

0.9.2 – 2025-11-14

First production release.