Why Is Gravity Forms Still Getting Spam Even With reCAPTCHA
Technical Content Marketer
Reviewed by Onar Alili
Anti-Abuse Engineer & Co-founder
Published 6 min read
Even with reCAPTCHA and multiple anti-spam layers in place, Gravity Forms can still be exploited—especially in targeted attacks. If you’re here, it’s likely because bots and spam submissions are still slipping through, draining your time and, worse, your ad budget. Let’s break down why it’s happening—and what you can actually do about it.
Why reCAPTCHA alone isn’t enough
Google’s reCAPTCHA is often the first line of defense for WordPress forms. It’s designed to block bots from submitting forms by evaluating user behavior or presenting challenges. However, it’s not a silver bullet. Here’s why it falls short:
1. reCAPTCHA v3 is score-based, not absolute
reCAPTCHA v3 assigns a score between 0.0 and 1.0 to each interaction. A higher score means more confidence the interaction is human. But it doesn’t block spam by itself. You need to decide what score is acceptable.
Problem: Many site owners leave the threshold at default (0.5), which lets sophisticated bots or low-effort human spammers through.
2. Spammers use human-like behavior
Advanced bots and semi-automated spam tools can:
- Solve CAPTCHAs using third-party services
- Mimic mouse movements and keystrokes
- Use clean US-based IP addresses
This makes them hard to detect using conventional filters.
3. Manual spam bypasses reCAPTCHA entirely
In some cases, spam is submitted manually by low-cost labor. These submissions can:
- Click through Google Ads
- Fill out your Gravity Forms accurately
- Slip past reCAPTCHA without any red flags
Impact: You pay for every click—whether it’s a lead or spam.
Other Anti-Spam Tools Have Limitations Too
Most users add extra plugins or services to reinforce their forms:
Akismet
Akismet, while widely used, was originally built for comment spam on blogs. It doesn’t inspect form behavior or real-time submission patterns, so it often misses nuanced or targeted form-based attacks.
Gravity Forms Zero Spam
Gravity Forms Zero Spam does a good job with bots but not with semi-automated or human-submitted spam. It lacks context-based filtering, IP tracking, and deeper content analysis, which are key when the attacker adapts to your form setup.
Cloudflare
Cloudflare adds another protective layer by allowing you to block traffic from specific countries or IPs. However, if the spam is coming from clean, US-based IPs or rotating VPNs, Cloudflare might not catch all of it.
Even when all of these are stacked together, targeted attacks can still break through.
Using oopspam to Protect Gravity Forms from Spam
oopspam (that’s us 👋) is a privacy-first spam filtering tool that integrates directly with Gravity Forms via its WordPress plugin. It’s designed to catch exactly the kind of nuanced spam reCAPTCHA misses.
Key Benefits of oopspam:
- Content Analysis: Flags low-quality, repetitive, or suspicious form text
- IP Reputation Checks: Evaluates the origin of submissions for known abuse
- Country and Language Filtering: Blocks submissions based on country, region, or unsupported language
- IP Filtering: Blocks known spam IPs or ranges
- No Extra Friction: Doesn’t add visual challenges or puzzles for users
How To Set Up oopspam with Gravity Forms
Setting up oopspam to protect your Gravity Forms takes only a few steps:
Step 1: Install the oopspam WordPress Plugin
Download and activate the oopspam WordPress plugin from your dashboard.
Visit oopspam and create an account. Once signed in, copy your API key.
Step 2: Paste Your API Key
In your WordPress dashboard:
- Go to oopspam settings
- Paste your API key
Step 3: Enable oopspam on Gravity Forms
If Gravity Forms is active, you’ll see a spam protection section ready to configure. Switch ON “Activate Spam Protection” to start blocking spam entries.
You’re done! All submissions will now be scanned using oopspam’s filtering engine before they hit your inbox or CRM.
Advanced Configuration Options
oopspam includes a range of settings that allow for deeper control over how form spam is filtered.
- Sensitivity Level: Controls how aggressive the filter is. The default setting is recommended for most users.
- Rate Limiting: Limit the number of submissions per IP or email address to prevent abuse. You can also cap leads from Google Ads.
- IP Filtering: Block traffic from VPNs or cloud providers like AWS and Azure. We recommend enabling this setting to reduce spam from automated services. However, be cautious with blocking VPNs—some legitimate users and businesses rely on them for secure access.
- Manual Moderation: Manually allow or block emails, IPs, or specific keywords based on your needs. This is useful for creating custom allow lists or blocking repeated spam patterns.
- Country and Domain Filtering: Block specific countries and disposable email domains to stop unwanted traffic at the source.
What about performance or privacy?
oopspam is lightweight and privacy-focused:
- No user tracking
- GDPR-compliant by default
- Minimal impact on form performance
It processes data server-side, and only relevant context (e.g., IP, text content, user-agent) is checked—no personal data is stored.
Final thoughts
If you’re still getting spam through Gravity Forms—even with reCAPTCHA—you’re likely dealing with targeted, semi-automated attacks. Traditional filters can’t keep up with evolving spam behaviors.
By switching to a layered, context-aware system like oopspam, you significantly reduce spam without affecting real users. The setup is simple, the filtering is accurate, and your paid traffic will no longer be a spammer’s playground.
Ready to stop form spam at the source? You can install oopspam directly from the official WordPress plugin repository. It’s a simple setup that adds reliable spam filtering to your Gravity Forms—no API configuration needed.
