Spam bots have been a persistent problem for years: forms are automatically filled with fake data and submitted – resulting in numerous daily spam emails that must be screened and sorted. This is an unnecessary effort that costs time and frustration.
Classic CAPTCHA solutions are not a real relief: puzzles that humans themselves fail at, or dependencies on Google and other data-hungry services, make them unpopular. Honeypots offer a more elegant alternative – they lure bots without JavaScript into a trap, but require an additional plugin if the form plugin used does not already include this function.
Because all of this can be complex and difficult to manage, we have developed our own solution: the SaaS Web Spam Shield. It can be connected to a variety of common form plugins – including Gravity Forms, Contact Form 7, WPForms, Elementor, Divi, Ninja Forms, and Formidable Forms, as well as the login, registration, and comment forms of WordPress itself – and can also be manually integrated via PHP snippets for custom themes with their own forms.
How it works: A small script classifies every visitor based on network and browser characteristics – such as the country of origin and network provider of the IP address, known data center and crawler networks, and the user agent. This determines how many computational tasks the browser must solve in the background and how difficult they are: Normal visitors are usually finished in a few seconds, suspicious traffic receives significantly more complex tasks, and known spam networks and AI crawlers can be excluded entirely. The result is written into the form as a token and verified on the server side upon submission. A current browser with JavaScript enabled is required.
The browser remembers solved tasks for up to 48 hours and reuses them for further forms – so anyone submitting multiple forms does not have to recalculate every time. The server checks the solution regularly and once more upon submission. Furthermore, it limits how often a solution can be used and how many submissions it accepts. Providing more computing power does not allow more spam to get through.
Neither IP addresses nor other visitor data are sent to external services: Classification and verification run entirely on our own servers – fast and GDPR-compliant.
In our Managed Hosting for WordPress, the Spam Shield is already included and preconfigured – the supported form plugins are protected without any further setup.
Detailed information can be found here:
https://spam-shield.saasweb.net/
Do you need help with your WordPress site? We keep WordPress up to date and secure and help when things get stuck. More about WordPress Support
