Overview
The Contact Form in WPiko AI Chatbot Pro has five layers of spam protection. They work together, so a bot that slips past one layer is usually stopped by another, while real visitors don’t notice any of them.
| Layer | What it stops | Setting |
|---|---|---|
| 1. Google reCAPTCHA v3 | Bots and automation tools, based on browser behavior | Optional, recommended |
| 2. Score threshold | Lets you decide how strict reCAPTCHA is | Default 0.5 |
| 3. Honeypot field | Simple bots that fill in every field | Always on |
| 4. Rate limiting | Floods of messages from the same email address | Always on: 3 per hour |
| 5. Timestamp check | Instant, scripted submissions | Always on: at least 3 seconds |
Layers 1 and 2: reCAPTCHA v3 and the Score Threshold
Google reCAPTCHA v3 runs invisibly and gives every submission a score from 0.0 (almost certainly a bot) to 1.0 (almost certainly a person). Submissions below your threshold are rejected.
Setting Up reCAPTCHA
- In the Google reCAPTCHA admin console, create a site, choose reCAPTCHA v3 and add your domain(s).
- Copy the Site Key and Secret Key.
- Go to WPiko AI Chatbot → Leads & Sales → Contact Form and open Google reCAPTCHA.
- Turn on Enable Google reCAPTCHA for contact form, paste both keys, and set the reCAPTCHA Score Threshold.
- Click Save Changes.
You must use reCAPTCHA v3: v2 keys don’t work with this integration.
Choosing a Threshold
The Score guide on the settings screen shows what each range means:
| Threshold | Meaning |
|---|---|
| 0.9–1.0 | Very strict: may block some legitimate users |
| 0.7–0.8 | Strict: good balance for high-security needs |
| 0.5 | Balanced: recommended for most sites (default) |
| 0.3–0.4 | Lenient: more spam may pass through |
| 0.0–0.2 | Very lenient: not recommended |
- Getting spam? Raise the threshold to 0.6–0.7.
- Real visitors blocked (for example people on VPNs or with strict privacy settings)? Lower it to 0.3–0.4.
Hiding the Badge
Turn on Hide the reCAPTCHA badge to remove Google’s floating badge. A short reCAPTCHA notice is then shown on the contact form instead, as Google’s terms require. Mention reCAPTCHA in your privacy policy either way.
Layer 3: Honeypot Field
The form contains a hidden field (website_url) that people never see or reach with the keyboard, but simple bots fill in. When it contains anything, the submission is silently rejected and logged in the Debug Log. Nothing to configure.
Layer 4: Rate Limiting
Each email address can send up to 3 messages per hour. Further attempts within the hour are rejected with “You have submitted too many contact forms. Please try again later.” The counter resets automatically after an hour. The limit isn’t configurable.
Layer 5: Timestamp Check
A form sent less than 3 seconds after it opened is rejected with “Please take your time filling out the form.” Real visitors almost never fill in a form that fast, but scripts do. Attempts are logged in the Debug Log.
Monitoring Blocked Submissions
Blocked submissions are recorded in WPiko AI Chatbot → Advanced → Debug Log with the reason, email, name and IP address, for example “Contact form submitted too fast (1 seconds)” or “Contact form honeypot triggered”. Turn logging on while you’re checking. See Using the Debug Log.
Troubleshooting
- “Suspicious activity detected”: the reCAPTCHA score was below your threshold. Lower the threshold (try 0.4), and test the form yourself, also with a VPN.
- “reCAPTCHA is enabled but not properly configured”: the Secret Key is missing. Paste both keys and save.
- “reCAPTCHA verification failed”: check that the keys are v3 keys and that your domain is registered for them in Google’s console.
- “Please take your time filling out the form”: the form was sent within 3 seconds. Wait a moment and send again.
- “You have submitted too many contact forms”: the same email sent 3 messages within an hour. Wait for the hour to pass.
- Badge still shows after hiding it: clear your caching plugin and browser cache.
- No emails arrive: check the site admin email in Settings → General, your spam folder, and whether your server can send email (an SMTP plugin often helps).
