Gravity Forms spam filter

Stop Gravity Forms spam without a CAPTCHA

The oopspam Anti-Spam plugin checks every Gravity Forms entry in the background. It blocks spam from bots and real people, including the targeted spam that gets past reCAPTCHA.

Install the free plugin → See how it works

4.9 on WordPress.org
6,000+ active installs
3.5M+ websites protected

A form crossed out with a no sign, next to skull icons and a gem, showing spam blocked without a CAPTCHA

The problem

Why Gravity Forms still gets spam, even with reCAPTCHA

Gravity Forms has a honeypot you can turn on, supports reCAPTCHA and works with Akismet. Those help with simple bots.

Targeted spam keeps coming anyway: people paid to fill in forms, and bots that use clean IP addresses and act like humans. reCAPTCHA v3 only returns a score, and the default threshold lets a lot through.

If you run ads, each of those fake leads can cost you a paid click.

Honeypot	Off until you enable it in each form's settings. Catches only simple bots.
reCAPTCHA	v2 is built in and asks visitors to solve puzzles. v3 needs a separate add-on and only returns a score.
Akismet	Built for blog comments rather than forms, and needs a paid plan on commercial sites.

How it works

Set up in about five minutes

No changes to your forms, and nothing for your visitors to solve.

Install the plugin
In WordPress, go to Plugins → Add New, search for “oopspam Anti-Spam”, then install and activate it.
Add your API key
Create a free account, copy your API key and paste it under Settings → oopspam Anti-Spam.
Turn on Gravity Forms
In the Gravity Forms section of the settings, switch on Activate Spam Protection and write the message spammers will see. That's it.

The Gravity Forms section of the oopspam Anti-Spam settings: Activate Spam Protection switched on, the spam message, form and field ID mapping and the list of forms not to protect — The Gravity Forms section in the oopspam Anti-Spam settings.

What happens to a blocked submission? The visitor sees the message you wrote at the bottom of the form, and the entry doesn't reach you. It is saved in the plugin's Spam Entries log with its score and the reason it was blocked.

Features

Everything you need to keep Gravity Forms clean

99.9% accurate detection

Machine learning reads each message and checks the sender's IP and email against a blocklist of 350M+ known spammers. It catches bots and people paid to spam.

Context-aware checks

oopspam can judge a message against what your website is for, so off-topic pitches that look human get caught too.

Country and language filters

Accept submissions only from the countries and languages you serve, and always trust the ones you choose.

VPN, proxy and disposable email blocking

Block submissions from VPNs and cloud providers, and from throwaway email addresses that spammers use once.

Rate limiting

Cap how many times one IP address or email can submit per hour, so floods stop before they reach you.

Logs that explain every decision

Spam and valid entries are kept in your own WordPress database, with the reason each one was blocked. Get email alerts and a spam summary report.

Block and allow lists

Block specific keywords, phrases, emails and IP addresses, and always let trusted emails and IPs through.

One API key, unlimited websites

You pay for spam checks, not per site. Use the same key on every WordPress site you manage.

Private by default

Nothing is stored on our servers unless you turn on remote logging. You can switch off checks that use personal data, and we're GDPR compliant.

Inside the plugin

oopspam Anti-Spam general settings in WordPress, showing usage, the API key field and the sensitivity level slider — Choose how strict the filter is with the sensitivity level slider.

IP Filtering settings with switches to block VPNs and to block over 1,500 known cloud provider IP ranges such as AWS, Google Cloud and Azure — Block submissions from VPNs and from 1,500+ known cloud provider IPs.

Manual Moderation settings with lists of blocked emails, blocked IPs, blocked keywords and phrases, allowed emails and allowed IPs — Keep your own lists of blocked and allowed emails, IPs, keywords and phrases.

Privacy settings with switches to stop analyzing IP addresses, stop analyzing email addresses and remove sensitive information from messages — Choose what data is checked, and strip emails, addresses and phone numbers before a message is sent.

Compare

oopspam vs the usual Gravity Forms fixes

What you get	oopspam	reCAPTCHA	Honeypot	Akismet
Stops automated bots	Yes	Yes	Simple bots only	Yes
Stops spam typed by real people	Yes	No	No	Partly
No challenge for visitors	Yes	v3 only	Yes	Yes
No third-party script on your pages	Yes	No	Yes	Yes
Country, language and VPN filters	Yes	No	No	No
Shows why a submission was blocked	Yes	No	No	No

You don't have to choose: oopspam works alongside reCAPTCHA or a honeypot if you want to keep them.

Reviews

What site owners say

4.9 out of 5 from 51 reviews on WordPress.org

“I'm very happy with the usable data and tools provided to me. It's eliminated all spam, and even the need for Captcha.”
@gotmick on WordPress.org

“We tried various methods including but not limited to Captcha, Honeypot… We strongly recommend oopspam for anyone who values their time and resources.”
Vu Nguyen, Nilead.com

“Pricing is perfect for agencies as they do tiers by actual # of API calls and no limit on the number of sites you can install this on.”
@squarecandy on WordPress.org

Simple, transparent pricing.

1 API call = 1 spam check.
Start with 40 free checks a month, no credit card required.

How many spam checks a month?

Starter $19.17 /mo

$230 billed once a year. You save $46.

Start with Starter →

Compare all plans

Guides

Gravity Forms spam guides

Why Is Gravity Forms Still Getting Spam Even With reCAPTCHA

5 Ways to Protect Your Gravity Forms from Spam

How to Block Countries in Gravity Forms

How to Block VPN and Data Center IP Submissions in Gravity Forms

FAQ

Gravity Forms spam: common questions

Does oopspam work with Gravity Forms' honeypot and reCAPTCHA?

Yes. oopspam runs alongside them, so you can keep them or remove them.

Will it stop spam from people clicking my ads?

It catches entries typed by real people when the content, IP address or email looks like spam, and context-aware detection flags off-topic pitches that look human. That means fewer fake leads from paid traffic.

Do I need to change my forms?

No. Switch on protection once in the plugin settings and it covers every Gravity Forms form on your site.

Can I leave some forms unprotected?

Yes. In the Gravity Forms section of the settings, enter their form IDs under Don't protect these forms, for example 1,5,2.

Which field does oopspam check?

It finds the message field automatically. If your form has several, use Content field mapping to pair a form ID with the field IDs to check, and their values are joined together.

Will it slow down my site?

No. The check happens on your server when the form is submitted. Nothing extra loads in your visitors' browsers.

What if a real message gets blocked?

Find it in the plugin's Spam Entries log, which shows why it was blocked. To make sure it doesn't happen again, add the sender's email or IP address to your allowed list, or lower the sensitivity level.

Is oopspam GDPR compliant?

Yes. Logs stay in your own WordPress database, and nothing is stored on our servers unless you turn on remote logging. You can also switch off checks that use personal data. See our GDPR notice and Data Processing Agreement.

How much does it cost?

Every account includes 40 free spam checks a month. Paid plans are priced by the number of checks, not the number of sites, so one API key covers every website you manage. See the pricing above.