🛡️ Spam Protection: Five Built In Layers, reCAPTCHA v3 And Akismet

Every ResultsAiX form is protected by five spam layers that run on every submission. Visitors never solve a puzzle and never see them working. Two more layers, Google reCAPTCHA v3 and Akismet, are there when you want them.

Where to find it:

Open AiX Forms, then the Settings tab, then Spam protection. reCAPTCHA is then switched on per form in the builder's Style box.

The five built in layers:

• Honeypot: an invisible box that people never see and bots fill in. A bot that fills it gets the normal thank you and nothing is stored, so it learns nothing.
• Time trap: a form sent faster than your minimum is turned away. The time is measured by the visitor's own browser from the moment the form appeared, so a wrong clock on their computer never matters. A submission that arrives without the form's own script at all is quietly thanked and not stored.
• Rate limit: up to 10 submissions in 5 minutes from the same visitor. After that, they are asked to wait a few minutes.
• Duplicate guard: the same answers from the same visitor within 10 minutes are stored once. A double click or a reload simply shows the thank you again.
• Word blocklist: your own list of words and phrases. A submission containing any of them anywhere is turned away.

The settings:

• Word blocklist (one word or phrase per line): matching ignores capital letters. Good entries are words your real customers would never use, such as casino or buy followers.
• Minimum seconds to fill a form: 3 is a good default. 0 turns the trap off, and the highest is 30. For a very short form, such as a one field newsletter box, 2 or 3 is right.

Click Save settings at the bottom of the page.

What visitors see:

A person who trips a layer by accident gets a short, polite line under the form and can try again, for example "That was a little too fast. Please try again." The honeypot and duplicate guard never show anything: the visitor sees the normal thank you.

Google reCAPTCHA v3, step by step:

reCAPTCHA v3 scores each visitor invisibly, with no puzzles. It is off until you set it up.

1. Get free keys at google.com/recaptcha/admin and pick reCAPTCHA v3. Add your domain, for example yoursite.com.
2. In Settings, Spam protection, paste the Site key and the Secret key.
3. Leave Minimum score (0 to 1) at 0.5, Google's recommended default. Higher is stricter.
4. Click Save settings.
5. Open each form that should use it, tick Google reCAPTCHA v3 on this form in the Style box, and click Save form.

The secret key is never shown again after saving. Leave the box blank to keep it, paste a new one to replace it, or tick Remove the saved secret key. The Show button lets you check what you are typing.

How reCAPTCHA behaves:

• Google's script only loads on pages carrying a form that opted in, never anywhere else.
• Each answer from Google must be for your site and for this form, so a token made elsewhere is refused.
• If Google cannot be reached, the submission goes through and the five built in layers still apply. A Google outage never costs you a lead.

Akismet:

If the separate Akismet plugin is installed and has an API key, tick Check every submission against Akismet. Submissions are then also classified by Akismet under your own Akismet account. Until Akismet is ready, the box stays greyed out and nothing is sent anywhere.

What stays on your site:

With reCAPTCHA and Akismet both left off, all spam checking happens on your own site and no submission is sent to any outside service. Visitor IP addresses are never stored: the rate limit and duplicate guard use a one way fingerprint that expires within a day.

Seeing what was turned away:

The error log on the Diagnostics tab notes, as Info lines, submissions turned away by the time trap, the word blocklist, reCAPTCHA and Akismet, so you can check your settings are not too strict.

Works with page caching:

Forms do not rely on a WordPress nonce. They are protected by each form's unguessable public key and the layers above, so they keep working on pages served from a full page cache.

A real example:

Northfield Renovations keeps the minimum at 3 seconds and blocks four phrases: casino, crypto pump, seo services and buy followers. The Diagnostics log shows one submission turned away for being too fast and one for a blocked word, and no complaints from real customers.

Choosing a good blocklist:

Look at the spam that reached you before and pick words that only spam uses. Phrases work too: "crypto pump" blocks only that phrase, not every message with the word crypto. Matching looks inside every answer, ignores capital letters and also matches inside longer words, so prefer whole, unusual phrases over short words. A spam web address you keep seeing works best as its domain name alone, without the https:// part, for example spam-site.example.

Getting reCAPTCHA keys, step by step:

1. Sign in at google.com/recaptcha/admin with a Google account.
2. Create a new site, give it a label such as Northfield website, and choose reCAPTCHA v3 (score based).
3. Add your domain without https, for example yoursite.com.
4. Copy the Site key and the Secret key into Settings, Spam protection.

Picking a minimum score:

Google gives each visitor a score from 0 (likely a bot) to 1 (likely a person). With 0.5, Google's recommended default, most people pass. Raise it to 0.7 if bots still get through; lower it to 0.3 if real people are being turned away. Each submission turned away by reCAPTCHA appears as an Info line in the error log with its score.

What the visitor sees with reCAPTCHA:

Nothing extra. Google shows its small badge on the page, and the check happens when the visitor clicks the button. If a visitor is turned away, they see "We could not verify you are human. Please reload the page and try again."

Testing your form after changing spam settings:

1. Open the page in a private browser window.
2. Fill in the form at a normal pace and send it.
3. Check the entry arrives on the Entries tab.
4. Check the error log on Diagnostics for any Info line about your test.

Tips:

• Start with the built in layers only. Add reCAPTCHA if spam still gets through.
• Keep the blocklist short and specific. A common word could block a real customer.
• Check the Info lines on Diagnostics after changing the minimum seconds.