Forms and spam
Hive stops scripted form submissions without a CAPTCHA: visitors see no puzzle, and no third-party service is loaded. The same check covers the comment form, the sign-up, the password reset and Contact Form 7 in the free plugin, and further form plugins with the Pro add-on. A scored comment filter, disposable mail blocking and registration rules complete it. Settings are on Protection → Forms.
The invisible form check
Each protected form carries a hidden decoy field and a second field that a small script adds in the browser, under a name that is random per installation. The page itself contains nothing request-specific, so page caches keep serving it. A submission gets one of four verdicts:
| Verdict | Meaning | Consequence |
|---|---|---|
| Proved | The browser ran the script, the decoy is empty. | Passes. |
| Decoy filled | Nobody can see that field, so filling it takes a machine. | Refused, the address is blocked and reported at the first attempt. |
| Failed | The form was ours, but the script never ran, typically a script posting straight at the address. | Refused with a sentence asking the sender to enable JavaScript. The address is not blocked. |
| Absent | The page came from a cache older than the check and carries no field at all. | Passes on the sign-up and reset forms and on a form plugin during the first 24 hours after its switch went on. A comment is left to the spam filter. |
No submission disappears without a message to the sender: every refusal is shown at the form. Defining
REPORTEDIP_HIVE_DISABLE_FORM_PROOF in wp-config.php switches the whole layer off. Your
own forms can use the same check through a small API, see
Hooks and developer API.
Form plugins
| Plugin | Plan | Notes |
|---|---|---|
| Contact Form 7 | Free | A refused submission gets the plugin's own spam message. |
| WPForms and WPForms Lite | Business, Pro add-on | Page load and background submission. |
| Gravity Forms | Business, Pro add-on | Refused as a validation error above the form, no entry written. A form with several pages is judged on its last page; submissions through the Gravity Forms API are not judged. |
| Forminator | Business, Pro add-on | Also forms loaded after the page. |
| Formidable Forms and Formidable Forms PRO | Business, Pro add-on | |
| Elementor Forms (Elementor Pro) | Business, Pro add-on | A refusal stops the form mail as well. |
| Ultimate Member | Business, Pro add-on | Sign-in, sign-up and password reset. A sign-up also runs through the registration rules. |
Each plugin has its own switch, which appears once the plugin is active. For 24 hours after a switch goes on, a submission without the field still passes, so a page from an older cache locks nobody out. A refused submission is never moved to a spam folder in silence. The guides for Gravity Forms and for WPForms and Forminator go through the details.
Computation check
Part of the Pro add-on from the Professional plan. A script that loads a form once could copy the proof field back. With the computation check the browser fetches a small task from your own site in the background and solves it before the form is sent. The task is signed with your site's salt, expires after ten minutes, counts once, and gets harder the faster one network asks for tasks, so a script that fetches hundreds pays for every one. The page carries only the address of that endpoint, the same for every visitor, so full-page caches, LiteSpeed, WP Rocket and CDNs keep working; the task travels in a request no cache stores. Without HTTPS the task has no arithmetic but keeps signature, expiry and single use. The difficulty rises during the hardening mode.
Comment spam filter
Every comment is scored on about twenty signals; the list is on Sensors and blocking. A link counts wherever it sits, in the website field or in the text. Measured against 27,796 real comments of a site collecting them since 2014, the filter catches 95 per cent of the spam without a false positive. The default files a scored comment as spam for review; refusing it outright is a choice, and the filter can be switched off. A comment form that never ran the check is refused like every other protected form, and the comment honeypot (the decoy field) works on its own switch.
Disposable mail addresses
Addresses from throwaway mail providers are refused at sign-up (WordPress, WooCommerce, multisite) and, through a setting of its own, on comments and the protected forms, where the sender is asked for a permanent address. Three modes: off, monitor, block. Privacy relays such as Apple Hide My Email and Firefox Relay are a category of their own and pass by default. The bundled list is free; the live list of thousands of domains arrives with Priority Sync from the Professional plan.
Registration rules
Every sign-up path runs through one rule set: the WordPress registration, WooCommerce, multisite sign-ups and accounts created by code. The rules are checked in a fixed order, the first hit wins: IP allowlist, rate limit, prohibited user name, e-mail rules, disposable mail.
- Prohibited user names: one per line on top of a baseline of ten names (
admin,administrator,root,sysadmin,superadmin,webmaster,hostmaster,postmaster,support,moderator), which can be switched off. - E-mail rules: off, block the listed addresses, or allow only them. A bare host name means
*@host. An empty list in allow mode acts as off, so nobody locks themselves out. - Rate limit: three sign-ups per address in 60 minutes by default. It only refuses the sign-up, without a block or a report, so an office behind one address is not punished.
- Unknown user names: optional and off by default. A sign-in attempt for a user name that does not exist blocks the address at once. The block tells an attacker which names exist, which is why the switch is off and the event is never reported.
A plain entry matches exactly, * is a wildcard. The free plugin takes ten entries per list. The Pro
add-on on the Professional plan removes the limit, accepts regular expressions in slashes
(/^shop[0-9]+$/) and adds sign-up restricted to allowlisted address ranges. Refusals are logged as
prohibited_username, registration_denied and registration_limit.
Last updated: · Maintained by the ReportedIP team