WPForms and Forminator Spam Protection Without a Captcha
WPForms and Forminator spam protection without a captcha works by checking that a real browser loaded and sent the form, not by asking the visitor to solve anything. ReportedIP Hive does that for both plugins with one switch each: a bot is refused with a visible error at the form, no entry is saved and no mail goes out.
The honeypot and the execution proof behind it are explained in the guide to the form honeypot. This page covers what is specific to WPForms and Forminator.
Why WPForms and Forminator need more than their own spam tools
Both plugins bring their own protection: WPForms has an anti-spam token, Forminator a honeypot field. These catch many bots, but a script that copies a real submission and replays it, or one that fills every field in a pattern the plugin does not expect, can slip through. A captcha would stop it, at the cost of every real sender who has to solve a puzzle.
Hive adds a check that asks nothing of the sender. Every form carries an invisible field that people never touch, and a small script adds a proof that only a browser which really rendered the form can deliver. A bot that fills the invisible field or a script without the proof is refused before an entry exists.
What happens to a submission
| Submission from | Result |
|---|---|
| A visitor in a normal browser | The entry is saved, nothing changes for the sender. |
| A bot that fills the invisible field | Refused. The address is blocked on the first attempt and, in Community Network mode, reported. |
| A script that posts directly to the site | Refused at the form. The address is logged but not counted towards a block. |
| A browser with JavaScript switched off | Refused with a message asking to switch it on. |
The block after a filled invisible field needs automatic blocking to be switched on, and whitelisted addresses are never blocked. The report to the community names the form plugin, so the community sees that the address attacked a contact form, not a login. In the Event Log under ReportedIP Hive > Activity, a refused bot appears as “Form Spam (threshold reached)” with the surface wpforms or forminator.
How Hive works with WPForms
Hive places its invisible field just before the submit button, both in forms that reload the page and in forms sent in the background. It stays away from the confirmation text, so the thank-you message is never touched.
The check runs after WPForms has validated the fields, before it saves an entry or sends a notification. A form with a missing required field is therefore returned by WPForms first, without a check by Hive. A refused submission shows an error above the form, the same place WPForms uses for its own form-level messages. Hive’s own style keeps the invisible field off-screen even when a WPForms theme resets form styles.
How Hive works with Forminator
In Forminator, the invisible field sits in the submit area of the form. The check runs on Forminator’s own list of form errors, before an entry is saved, a file is stored or a mail goes out. The refusal appears at the form, like any other Forminator error, and uploads are not checked twice.
Forminator often loads forms after the page, for example in popups or tabs. Hive notices a form that appears later and prepares it again. If the proof is not ready when the visitor clicks send, the submission is held for a moment and then sent, so a fast visitor is never refused.
Why a refusal is an error and not a spam-folder entry
Both plugins have a spam folder, and Forminator’s spam filter can even show the sender a success message depending on the form settings. Hive uses neither on purpose. A message in the spam folder is one whose sender believes it arrived and whose recipient never reads it. If the verdict was ever wrong, nobody would know.
A refusal by Hive is a visible form error instead. The sender can read why and try again, no entry is saved, no notification goes out and no confirmation is shown.
How to switch it on
- Check the plan. The WPForms and Forminator adapters are part of the Business plan. On a lower plan the switches stay visible and locked, with the plan they need next to them.
- Switch them on. Open ReportedIP Hive > Protection, card Form Protection, and turn on Protect WPForms forms and Protect Forminator forms. Form execution proof must stay on. Hive clears the common page caches and, for a transition period, still accepts submissions from pages cached before the switch.
- Run the self-test. Tools > Diagnostics (visible in Expert mode) shows every form adapter and runs three test passes from your browser without sending a real form.
- Watch the log. Check the Event Log for refused submissions in the first days. To watch before you refuse, switch on Report-only mode in the card Blocking & Escalation first.
With the Professional plan and above, the Computation check on forms makes the browser work out a small signed task from your own site before sending, valid for ten minutes and accepted once. That also stops scripts that copy the field names out of the page. With Community threat check on forms in Community Network mode, Hive also refuses addresses the community has flagged. Both work the same way on every form and are covered in the form honeypot guide.
Questions about WPForms and Forminator without captcha
Do WPForms and Forminator still need a captcha with Hive?
Against scripts and bots, WPForms and Forminator no longer need a captcha once the Hive adapters are on. The execution proof refuses anything that did not come from a browser that rendered the form. It cannot tell a person from a botnet driving a real browser; for that, the community threat check looks at the address behind the request.
Does Hive work alongside the WPForms token and the Forminator honeypot?
Hive runs alongside the WPForms anti-spam token, the Forminator honeypot and Akismet without conflict. It adds its own check before an entry is saved, so a submission Hive refuses never becomes an entry. You can keep the plugins’ own protection switched on; the checks complement each other.
Which plan do I need for WPForms and Forminator protection?
The adapters for WPForms and Forminator are part of the Business plan, together with Gravity Forms, Formidable Forms, Elementor Forms and Ultimate Member. Contact Form 7, comments, sign-up and password reset are protected on every plan, including Free. The computation check needs the Professional plan or higher.
Read on
The Hive documentation covers bot detection and form spam and caching and compatibility in detail. The OWASP list of automated threats to web applications describes the bot types these checks are built against. All plans are compared on the pricing page.