Anti-Spam: Honeypot and Cloudflare TurnstilePRO
FormForge Pro protects forms in two layers: always-on invisible honeypot plus your choice of Cloudflare Turnstile (recommended), Google reCAPTCHA, or nothing. This page explains how each layer works, walks through Turnstile setup, covers the fail-open vs fail-closed edge cases, and diagnoses the four most common failure modes.
Leave honeypot on (default) plus set the CAPTCHA Provider to Cloudflare Turnstile. Turnstile is free, invisible for most real users, catches modern bots that defeat reCAPTCHA, and doesn’t ship any data to Google. Two-layer protection with near-zero user friction.
How the two layers work
Every FormForge Pro form submission runs through both anti-spam layers in order:
| Layer | What it does | When it fires |
|---|---|---|
| Honeypot | Invisible rfp_honeypot field added to every form. Real users never see or fill it. Naive bots that auto-fill every field trip the check. Zero external API calls. |
Always first. Runs before the CAPTCHA provider so obvious bots are rejected without consuming an API call. |
| CAPTCHA provider | Whichever you pick: Cloudflare Turnstile (server-side token verification via Cloudflare’s siteverify endpoint), Google reCAPTCHA v2 (checkbox challenge) or v3 (invisible score-based), or None (Honeypot Only). | After the honeypot check passes. Sophisticated bots that skip the honeypot land here. |
Both layers can be configured globally in FormForge > Settings. The settings apply to every form on the site; there’s no per-form spam-protection override in the current release.
Set up Cloudflare Turnstile
Turnstile is a free CAPTCHA alternative from Cloudflare that works invisibly for most legitimate visitors. No Cloudflare hosting required; you just need a Cloudflare account to generate the keys.
Sign in to Cloudflare
Go to dash.cloudflare.com. If you don’t have an account yet, sign up (free forever for Turnstile use, no credit card required).
Open Turnstile in the sidebar
From the Cloudflare dashboard, find Turnstile in the sidebar. Direct link: dash.cloudflare.com/?to=/:account/turnstile.
Add a site
Click Add site. Give it a name (something like “yoursite.com forms”). Add every domain FormForge is embedded on (yoursite.com, staging.yoursite.com, dev.yoursite.com if applicable).
Pick widget mode
Cloudflare offers three modes: Managed (recommended, Cloudflare decides invisible vs. interactive per-request based on threat score), Non-Interactive (visible widget but no user click needed), Invisible (no visible widget at all). Managed is the right choice for 95% of use cases.
Copy the Site Key and Secret Key
Click Create. Cloudflare shows a Site Key (public, embedded in the form’s HTML) and a Secret Key (private, used server-side to verify tokens). Copy both.
In FormForge, go to Settings and pick Cloudflare Turnstile
WordPress admin → FormForge > Settings. Find the CAPTCHA Provider radio, pick Cloudflare Turnstile (recommended).
Paste both keys and save
Below the radio, paste the Site Key into Turnstile Site Key and the Secret Key into Turnstile Secret Key. Click Save Changes. The Turnstile widget starts rendering on every FormForge form immediately.
The Site Key you generate in Cloudflare is bound to the specific domains you list when creating the widget. If FormForge forms are embedded on a domain that isn’t in the list, Turnstile won’t render and submissions from that domain will fail the challenge. Update the domain list in the Cloudflare dashboard whenever you add a new subdomain or move to a new domain.
How the honeypot layer works
FormForge injects an invisible field named rfp_honeypot into every form. The field is positioned off-screen via CSS (position:absolute;left:-9999px), has tabindex="-1" so keyboard users can’t tab into it, and has autocomplete="off" to discourage browser autofill. Real users never see it or fill it. Naive spam bots that mindlessly fill every input trip the trap and get rejected without any API call.
Rare case: an aggressive password manager or browser extension on the visitor’s side ignores the autocomplete="off" hint and fills the honeypot field. The visitor sees a form submission fail with a “Spam detected” error even though they’re real. If you’re getting reports of this from real customers, uncheck Enable Honeypot in FormForge > Settings and rely on Turnstile alone. Turnstile catches the same bot floor with far fewer false positives.
Otherwise leave honeypot on. It costs zero API calls, catches the naive-bot majority of spam traffic without consuming a Turnstile check, and layered protection is better than single-layer.
Fail-open vs fail-closed behavior
Turnstile’s verification has a subtle fail-mode split worth understanding when you’re debugging edge cases.
| Scenario | What FormForge does | Why |
|---|---|---|
| Widget rendered, token verified against Cloudflare, verify succeeds | Submission passes | Happy path |
| Widget rendered, token verified, Cloudflare returns success=false | Submission rejected (fail-closed) | Cloudflare said this token is not a legitimate human. Trust the challenge. |
| Widget rendered, token present, siteverify endpoint unreachable or times out | Submission rejected (fail-closed) | Cannot confirm the token is valid; the safe default is to reject rather than let a bot slip through during a Cloudflare outage. |
| Widget rendered but token field is empty on submit | Submission rejected (fail-closed) | The user submitted before the challenge completed, or the widget failed to load. Either way it’s suspicious. |
| Submission carries no token field at all (field not even present in POST) | Submission passes (fail-open, Turnstile check skipped) | Legacy submission paths (email resume links, XML-RPC, custom AJAX) don’t render the widget. Demanding a token would lock those out entirely. Any form rendered by FormForge normally includes the widget, so a missing field means the request came through a non-widget path. |
This is a deliberate tradeoff. Bots could theoretically POST directly to the AJAX endpoint and omit the token field to skip the check. But bots that skip Turnstile still hit the honeypot layer first (which they usually fill), plus form nonce validation, plus per-user submission limits if configured. Attackers who post directly without a browser rendering the widget are also skipping the honeypot detection, so the honeypot catches most direct-POST attempts.
Troubleshooting the four common failures
1. Legitimate visitors are being flagged as spam
Three common causes:
- Honeypot false positive from browser autofill. An aggressive password manager or browser extension is filling the invisible honeypot field. Fix: uncheck Enable Honeypot in FormForge > Settings and rely on Turnstile alone.
- Turnstile widget didn’t load, so the token field is empty on submit. If the visitor’s browser blocks
challenges.cloudflare.com(ad blocker, extension, or corporate proxy), the widget fails silently. Test in incognito mode with extensions off. - reCAPTCHA verification failing. Google’s siteverify endpoint returned failure for the visitor’s token. Common triggers: expired or misconfigured Site Key / Secret Key pair, domain mismatch between where the form is embedded and what the reCAPTCHA key was registered for, or genuine token invalidation by Google (rare, usually browser-side issues). If v2 checkbox users complain that the checkbox never resolves, they may be on an unusual network that Google flags; consider switching to Turnstile which handles those networks more gracefully.
2. Turnstile widget doesn’t appear on the form
Four checks in order:
- CAPTCHA Provider radio is set to Cloudflare Turnstile in FormForge > Settings. Not Honeypot Only or reCAPTCHA.
- Both Site Key AND Secret Key are filled in. The widget only renders when both are configured. If just one is set, FormForge falls back to the previous provider.
- Site key belongs to the exact domain of your WordPress site. Turnstile site keys are domain-restricted. In Cloudflare’s Turnstile dashboard, open the widget’s settings and confirm your domain is in the list. Add it if missing.
- Nothing is blocking Cloudflare’s script. Open the browser console on the form page. If you see errors mentioning
challenges.cloudflare.com/turnstile/v0/api.js, a Content Security Policy, ad blocker, or JS optimizer is blocking the script. Deactivate optimizers for the form page, addchallenges.cloudflare.comto your CSP allowlist, and test in incognito.
3. Submissions still get through despite Turnstile being on
Two possibilities:
- Bot bypassed via the no-token fail-open path. Advanced bots that POST directly to
admin-ajax.phpwithout rendering the widget will trigger the fail-open behavior described above. Honeypot catches most of these; if you’re seeing high volumes of spam despite honeypot, look at the entries and check whether they filled the visible fields with reasonable-looking content (that’s a smarter bot) or with garbage (that’s a naive bot that somehow bypassed both layers). - Cloudflare’s challenge model passing them as human. In rare cases Turnstile’s detection incorrectly clears a bot. All three widget modes (Managed, Non-Interactive, Invisible) use the same underlying detection, so switching modes won’t change strictness (they only change visibility). If you’re seeing this pattern, report the false negatives to Cloudflare with the widget’s telemetry ID, or add a secondary check like a WordPress security plugin’s IP-based rate limiting on
admin-ajax.php.
4. “Spam detected” on every submission after switching providers
You changed the CAPTCHA Provider radio but left old keys populated for a different provider, and something is misaligned. Fix: go to FormForge > Settings, confirm the provider you want is selected, and make sure the correct provider’s Site Key and Secret Key pair are filled in. If you toggled from reCAPTCHA to Turnstile, the old reCAPTCHA keys stay in their fields (harmless) but the Turnstile keys must be filled. Save and re-test.
Gather: (a) which CAPTCHA Provider is selected, (b) whether the honeypot toggle is on, (c) whether Site Key + Secret Key are both filled in for the active provider, (d) any browser console errors mentioning cloudflare.com or google.com/recaptcha, (e) the exact error the visitor sees. Send to support and we can dig in.
FAQ
How does FormForge Pro block form spam?
Two layers work together. First, an always-on honeypot: an invisible field that real users never see or fill, but naive bots do. Any submission where the honeypot has a value is rejected before any other check runs. Second, a CAPTCHA provider (radio choice in FormForge > Settings): Cloudflare Turnstile (recommended, free, invisible for most real users), Google reCAPTCHA v2 or v3, or Honeypot only (no CAPTCHA). The CAPTCHA runs after the honeypot for submissions that pass the first layer.
What is Cloudflare Turnstile and why is it recommended?
Turnstile is Cloudflare’s CAPTCHA alternative. It’s free forever, requires no Cloudflare hosting on your site, works invisibly for the majority of real visitors (no distorted-text challenges), and catches modern bots that defeat reCAPTCHA. It’s the recommended choice for most FormForge Pro sites because it doesn’t ship data to Google and its user experience is dramatically better than reCAPTCHA v2’s checkbox.
How do I set up Cloudflare Turnstile?
Sign in to Cloudflare (or create a free account). Go to Turnstile from the sidebar or dash.cloudflare.com/?to=/:account/turnstile. Click Add site, give it a name, add your domain(s), pick widget mode (Managed is the recommended default), click Create. Copy the Site Key and Secret Key. In FormForge > Settings, pick Cloudflare Turnstile as the CAPTCHA Provider, paste both keys, save. The widget appears automatically on every FormForge form. Full walkthrough in the Turnstile setup section.
Should I turn honeypot off if I have Turnstile enabled?
No. Honeypot runs before Turnstile and costs zero API calls, so it’s essentially free protection against the naive-bot floor traffic. Leaving it on catches the naive-bot floor of spam traffic without ever consuming a Turnstile check. Only turn honeypot off if it’s causing false positives from browser autofill (rare, but some aggressive password managers try to fill every input including hidden ones).
Legitimate submissions are being flagged as spam. What’s happening?
Three common causes. (1) Honeypot false positive: an aggressive browser extension or password manager is filling the invisible honeypot field on real user submissions. Fix: uncheck Enable Honeypot in FormForge > Settings and rely on Turnstile alone. (2) Turnstile widget didn’t load, so the token field is empty when submitted. If the visitor’s browser or ad-blocker blocks challenges.cloudflare.com, the widget fails silently. Test in incognito mode with extensions off. (3) reCAPTCHA verification failing: token was rejected by Google’s siteverify (expired/misconfigured keys, domain mismatch, or genuine token invalidation). Consider switching to Turnstile, which handles unusual networks more gracefully than reCAPTCHA.
The Turnstile widget doesn’t appear on my forms. Why?
Four checks. (1) The CAPTCHA Provider radio in FormForge > Settings is set to Cloudflare Turnstile (not Honeypot Only or reCAPTCHA). (2) Both Site Key AND Secret Key are filled in; the widget renders only when both are configured. (3) The site key was created for the exact domain of your WordPress site. Turnstile site keys are domain-restricted. Check the widget’s settings in Cloudflare’s dashboard and add your domain if missing. (4) A Content Security Policy or JS optimizer on your site is blocking challenges.cloudflare.com/turnstile/v0/api.js. Open the browser console and look for CSP or Not-loaded errors mentioning cloudflare.com.
Does FormForge Pro fail open or fail closed on spam checks?
Depends on the failure mode. Turnstile: fail-closed when the widget rendered but the token verification against Cloudflare fails (rejects the submission). Fail-open when the submission carries NO token field at all, on the assumption that the submission came through a legacy embed point (email resume link, XML-RPC, custom AJAX) that didn’t render the widget. This tradeoff protects legitimate non-widget flows without letting bots skip verification by just omitting the field, because any modern FormForge form always renders the widget when Turnstile is enabled. reCAPTCHA and honeypot are always fail-closed. Full behavior matrix in the fail-open vs fail-closed section.
What license tier includes anti-spam protection?
All spam protection features (honeypot, reCAPTCHA, Turnstile) are included at every FormForge Pro license tier. FormForge Pro ships in three tiers (Pro, Business, Agency) and spam protection is available on all of them.