Every time you receive a new enquiry you check your inbox, and the message is buried under dozens of spam replies. It’s a common frustration for site owners who rely on contact forms to stay in touch with customers. If you’re using Divine Smart Forms, you have a few tools at your disposal to keep those spam submissions from clogging up your workflow.
The plugin ships with a built-in honeypot, a simple way to catch many automated bots without forcing visitors to solve a challenge. For more stubborn spam, you can add a CAPTCHA from Google, Cloudflare, or hCaptcha. Below I walk you through the exact steps to activate these features, test them, and understand what’s possible and what isn’t.
Understand the Built-In Honeypot
Honeypot protection is the default anti-spam method in Divine Smart Forms. The plugin adds a hidden field that real users never see. Bots that blindly fill out every field will pick up this hidden entry and the form will reject it. It’s lightweight and works without any external keys.
To enable it, open the form in the Visual Form Builder, go to the form settings, and toggle the “Enable Honeypot” switch. No API keys or extra setup are required. Just save the form and you’re ready to test. The honeypot won’t stop every spam bot, but it eliminates a large chunk of the unsolicited traffic.
Adding a CAPTCHA for Extra Security
When the honeypot alone isn’t enough, you can add a CAPTCHA. Divine Smart Forms supports three providers: Google reCAPTCHA v2, Cloudflare Turnstile, and hCaptcha. Each requires a small setup in the global settings.
- Navigate to Divine Forms > Settings > CAPTCHA.
- Select the provider you prefer.
- Enter the Site Key and Secret Key (or equivalent credentials). You’ll get these from the provider’s dashboard.
- Save the global settings.
- Open the form you want to protect and enable the CAPTCHA toggle in the form settings.
- Publish the form with the shortcode and test by loading the page and trying a normal fill-out.
When configured correctly, visitors will see the CAPTCHA widget. Once they solve it, the form validates the token against the provider’s API before accepting the submission.
Choosing between Google reCAPTCHA, Cloudflare Turnstile, or hCaptcha
Each provider has its own trade-offs. Google reCAPTCHA is widely used, loads a small script, and shows a familiar challenge. Cloudflare Turnstile is an alternative that also asks a question but is less likely to block real users. hCaptcha is similar to reCAPTCHA but offers a different branding and pricing model.
All three work the same way inside Divine Smart Forms: they’re optional, you can enable or disable them per form, and the plugin handles the script loading and token verification automatically. Pick the one that matches your privacy preferences and the user experience you want.
Setting up Spam Protection in Global Settings
Global CAPTCHA settings are a one-time configuration that applies to all forms. Go to Divine Forms > Settings > CAPTCHA, and enter your keys. Once you’ve done that, each form can choose to use the CAPTCHA or rely only on the honeypot. This separation keeps your forms lightweight if you don’t need a CAPTCHA on every page.
For a quick way to see your forms in action, use the “Preview” button in the Visual Form Builder. The preview highlights the CAPTCHA widget if it’s enabled. If you’re still seeing spam, double-check the keys and make sure the form’s CAPTCHA toggle is on.
Testing Your Form Live
After setting up the honeypot and/or CAPTCHA, it’s important to test the form from a visitor’s point of view. Open the page where you’ve placed the shortcode:
[divismfo_form id="123"]Next, try a spam bot simulation. A simple way is to use a script that fills out all visible fields and skips the CAPTCHA. With the honeypot on, the form should block the submission. If you have a CAPTCHA enabled, the bot will be stopped by the challenge. If you want to double-check, send a normal email from another account and confirm it appears in Divine Forms > All Entries. This confirms the data is stored correctly in the WordPress database.
Once you’re confident the spam is being filtered, you can use the Google Sheets Integration to push those entries into a spreadsheet for easier analysis. The integration requires a service-account key and the ID of the sheet. After enabling it in the form settings, each successful submission will append a row to your Google Sheet.
Limitations and What You Should Know
Honeypot is not a silver bullet. Some sophisticated bots may detect and skip the hidden field. CAPTCHAs help, but they can also annoy legitimate users if they’re too hard. The plugin does not offer advanced spam filters or email verification services. If you need deeper protection, you might need an external security plugin or a third-party service.
Divine Smart Forms stores submissions in its own database tables, but it does not backup that data automatically. If you rely on the entries, keep a backup of the database or export the entries regularly.
Also note that the form shortcode is the only way to embed the form in Gutenberg, Elementor, or other page builders that accept shortcodes. The plugin does not provide a dedicated block for every builder, so copy the shortcode and paste it into a shortcode block or widget.
FAQ
Does the honeypot block all spam bots?
No. It stops many simple bots that fill out every field, but advanced bots that detect hidden fields can bypass it. Adding a CAPTCHA gives stronger protection.
Can I use both honeypot and CAPTCHA on the same form?
Yes. The honeypot is always active when enabled, and you can turn on a CAPTCHA for an extra layer of security.
Where do I find the form ID for the shortcode?
Open Divine Forms > All Forms, hover over the form you want, and the ID appears in the URL or in the form list next to the title.
Is the Google Sheets integration secure?
The plugin uses a service-account key you provide. It only accesses the spreadsheet you choose and does not read or write any other Google data.
What if I don’t want my visitors to see a CAPTCHA?
Keep the honeypot enabled and leave the CAPTCHA toggle off. Spam levels may increase, but it’s a trade-off you’ll have to decide based on your needs.
For live demos and visual step-by-step guides, check out my YouTube channel. I also share tips and updates on my LinkedIn profile. Happy building, and may your inbox stay clear of spam!