Contact Form Anti-Spam Protection

Overview

WPiko Chatbot Pro implements a comprehensive 5-layer anti-spam protection system for the contact form feature. This multi-layered approach ensures your contact form receives only legitimate submissions while blocking automated spam attacks effectively.

Why Anti-Spam Protection Matters

Without proper spam protection, contact forms become targets for:

Our 5-layer system works together to catch spam at different stages, ensuring legitimate users can always submit forms while bots are blocked.

Layer 1: reCAPTCHA v3 Score Validation

What It Does

Google reCAPTCHA v3 analyzes user behavior and assigns a score from 0.0 to 1.0 indicating how likely a submission is from a bot:

The plugin rejects submissions below the configured threshold, preventing bot submissions from ever reaching your inbox.

What It Catches

Configuration

Enable reCAPTCHA

Setting Up reCAPTCHA Keys

– Label: Your website name
– reCAPTCHA type: Select reCAPTCHA v3
– Domains: Add your website domain(s)

– reCAPTCHA Site Key: Paste in the designated field
– reCAPTCHA Secret Key: Paste in the designated field

Score Threshold Configuration

The score threshold determines what minimum reCAPTCHA score will be accepted. Adjust based on your needs:

| Score Range | Setting | Use Case |
|————-|———|———-|
| 0.9-1.0 | Very Strict | Highest security, may block some legitimate users |
| 0.7-0.8 | Strict | High security with balanced user experience |
| 0.5 | Balanced (Recommended) | Best for most websites |
| 0.3-0.4 | Lenient | Lower security, allows more submissions |
| 0.0-0.2 | Very Lenient | Not recommended – almost no protection |

Default: 0.5 (recommended for most sites)

Adjusting Your Threshold

Troubleshooting Your Threshold:

Monitoring Blocked Submissions

All submissions blocked by reCAPTCHA score are logged with:

Privacy Considerations

Layer 2: Configurable Score Threshold

What It Does

Instead of using Google’s default settings, this layer lets you customize exactly what score level you’ll accept. This gives you control over the spam vs. user experience balance.

Why This Matters

Different websites have different needs:

How to Use

Accessing Settings

Score Guide Reference

The plugin displays a helpful guide:

0.9-1.0: Very strict - may block some legitimate users
0.7-0.8: Strict - good balance for high-security needs
0.5:     Balanced - recommended for most sites
0.3-0.4: Lenient - more spam may pass through
0.0-0.2: Very lenient - not recommended

Real-World Examples

Example 1: B2B Services

Example 2: Content Blog

Example 3: News Website

Testing Your Settings

Layer 3: Honeypot Field

What It Does

A hidden field (website_url) that’s invisible to humans but visible to bots. When a submission includes a filled honeypot field, it’s automatically rejected.

How It Works

What It Catches

What It Doesn’t Catch

Technical Details

The honeypot field uses:

User Experience

Layer 4: Rate Limiting

What It Does

Limits each email address to a maximum of 3 submissions per hour. This prevents spam flooding attacks where bots send hundreds of identical or similar messages.

How It Works

What It Catches

What It Doesn’t Catch

Configuration

Rate limiting is automatically enabled with these settings:

Note: These settings are not user-configurable. The 3/hour limit is optimal for preventing abuse while allowing legitimate multiple submissions.

Technical Implementation

Uses WordPress transients for efficient tracking:

Transient Key: wpiko_contact_rate_{MD5_OF_EMAIL}
Value: Submission count
Expiration: 1 hour (automatically)

Benefits:

Monitoring Rate Limits

Blocked rate limit attempts are logged:

Contact form rate limit exceeded - Email: user@example.com, 
Count: 3, IP: 192.168.1.1

Example Scenarios

Scenario 1: Legitimate User Submits 3 Times in 1 Hour

Scenario 2: Bot Attack

Layer 5: Timestamp Validation

What It Does

Validates that the form submission took at least 3 seconds from when the form was loaded. This prevents instant bot submissions while allowing legitimate users enough time to fill out the form.

How It Works

What It Catches

What It Doesn’t Catch

Configuration

Timestamp validation is automatically enabled with:

Note: The 3-second minimum is optimal – long enough to catch instant bots, short enough for real users.

Technical Details

Server Validation:

current_time = 1635890403
form_timestamp = 1635890400
time_taken = 3 seconds
minimum_time = 3 seconds
Result: ✅ Submission accepted

If Too Fast:

current_time = 1635890401
form_timestamp = 1635890400
time_taken = 1 second
minimum_time = 3 seconds
Result: ❌ Submission blocked

Real-World Examples

Example 1: Legitimate User

Example 2: Fast User

Example 3: Instant Bot

Example 4: User Clicking Back/Forward

Monitoring Timestamp Validation

Blocked timestamp validation attempts are logged:

Contact form submitted too fast (1 seconds) - Email: user@example.com, 
Name: John Doe, IP: 192.168.1.1

How All 5 Layers Work Together

Typical Bot Attack Scenario

Attack: Bot sends 100 spam messages in 1 minute
reCAPTCHA Score Validation

   Result: Bot behavior detected, score 0.15
   Threshold: 0.5
   Action: ❌ BLOCKED (too low score)
   
   → If bot bypasses Layer 1 (unlikely):
Timestamp Validation

   Result: Form submitted in 0.5 seconds
   Minimum: 3 seconds
   Action: ❌ BLOCKED (too fast)
   
   → If bot adds delay (harder to do):
Honeypot Field

   Result: Hidden field is filled
   Expected: Empty
   Action: ❌ BLOCKED (bot filled hidden field)
   
   → If bot checks CSS visibility:
Rate Limiting

   Result: 4th submission from same email
   Limit: 3 per hour
   Action: ❌ BLOCKED (rate limit exceeded)
   
   → If attacker uses different emails:
reCAPTCHA Score Validation (again)

   Result: Still shows bot behavior
   Action: ❌ BLOCKED
RESULT: Out of 100 spam attempts:
  - Layer 1: Blocks ~99 submissions
  - Layer 2: Catches config misuse
  - Layer 3: Blocks simple bots
  - Layer 4: Limits damage per email
  - Layer 5: Catches instant submissions
Final: 0-1 spam reaches admin (vs 100 attempted)

Legitimate User Scenario

Legitimate user submitting contact form
reCAPTCHA Score Validation

   Result: Normal user behavior, score 0.92
   Threshold: 0.5
   Action: ✅ PASSED (0.92 > 0.5)
Timestamp Validation

   Result: Form submitted after 8 seconds
   Minimum: 3 seconds
   Action: ✅ PASSED (8 > 3 seconds)
Honeypot Field

   Result: Hidden field remains empty
   Expected: Empty
   Action: ✅ PASSED (field untouched)
Rate Limiting

   Result: First submission from this email
   Limit: 3 per hour
   Action: ✅ PASSED (1/3 submissions used)
Field Validation

   Result: All required fields filled correctly
   Expected: Complete form data
   Action: ✅ PASSED
RESULT: Submission accepted and delivered to admin

Best Practices

1. reCAPTCHA Configuration

2. Privacy Compliance

3. User Experience

4. Security Maintenance

5. Performance Optimization

Troubleshooting

Common Issues

Issue 1: “Suspicious Activity Detected” Error

Symptom: Users see message even after filling form correctly

Causes:

Solutions:

Issue 2: “Submitted Too Fast” Error

Symptom: Forms rejected even when user filled them carefully

Causes:

Solutions:

Issue 3: “Too Many Submissions” Error

Symptom: User blocked after 3 legitimate submissions

Causes:

Solutions:

Issue 4: reCAPTCHA Badge Not Hiding

Symptom: Badge still visible when “Hide Badge” option enabled

Causes:

Solutions:

Issue 5: Forms Never Reach Inbox

Symptom: No emails received from form submissions

Causes:

Solutions:

Verification Steps

Test 1: reCAPTCHA Verification

Test 2: Timestamp Validation

Test 3: Rate Limiting

Test 4: Honeypot

Summary

5-layer anti-spam protection: The layers work together to catch ~99% of spam while maintaining excellent user experience for legitimate contacts.

Key Benefits:

For questions or issues, refer to the troubleshooting section or contact support.