Dragwyb Docs Dragwyb Docs
Visit Website
Updated on Oct 24, 2026

How do I reduce spam without blocking real users?

Reduce form spam with the honeypot option or a configured CAPTCHA field, while testing legitimate submissions and avoiding unsupported protection claims.

Spam protection works best when it blocks automated submissions without adding unnecessary steps for genuine visitors. Smart Form Builder provides a honeypot option and a dedicated CAPTCHA field. Test protection with a normal visitor workflow before making a live form more restrictive.

1. Start with honeypot protection

  1. Edit the form and open its Advance settings.
  2. Under Security & Privacy, enable Enable Honeypot (Anti-Spam) and save the form. The control defaults to off.
  3. The frontend adds a hidden field when this option is enabled. During submission, the plugin rejects the submission if that hidden field contains a value.
  4. Test the form as a normal visitor on desktop and mobile. If a legitimate submission is rejected, check the recorded validation error before adding more restrictions.

For the full setup steps, see Configure Honeypot Protection. Honeypot protection is a useful low-friction layer, but it is not a guarantee that every automated submission will be blocked.

2. Use a dedicated CAPTCHA field when needed

  • Add the dedicated CAPTCHA field to the form and choose the required provider/type: Google reCAPTCHA v2, Google reCAPTCHA v3, or hCaptcha.
  • Configure the matching site and secret keys in Smart Forms → Settings → API Keys, under the API & Integrations section. Use the key pair for the provider selected in the field.
  • Save the form and test a valid verification and a failed or missing verification in a safe test environment.
  • If verification fails, check that the site key and secret key belong to the same provider and site, and that the website can reach the provider’s verification endpoint.

See Configure CAPTCHA Protection for provider setup. The form-level Enable reCAPTCHA switch in Advance settings is separate from the dedicated CAPTCHA field; the inspected version does not establish that this switch alone performs server-side CAPTCHA verification. Do not rely on that switch as a substitute for adding and configuring the dedicated field.

3. Reduce false positives

  • Keep the form’s required fields and validation rules limited to information you actually need.
  • Test conditional and multi-step paths so legitimate visitors can reach and submit every intended branch.
  • Change one anti-spam setting at a time. If a genuine user cannot submit, capture the safe validation message and check the CAPTCHA configuration or honeypot setting before tightening protection further.
  • Do not ask visitors to send private form data or CAPTCHA tokens when reporting a problem.

If spam continues

Review the pattern of unwanted submissions and the form’s validation errors before choosing another control. Honeypot and CAPTCHA checks reduce some automated submissions, but neither can guarantee that all spam will stop or that false positives will never occur.

Screenshot to add: [Smart Form Builder honeypot and dedicated CAPTCHA field settings]