Every WordPress contact form bleeds spam. Bots scrape the site, hammer the form endpoint, and drop hundreds of junk submissions a day into inboxes that have to be manually cleared. The traditional answer — a CAPTCHA — forces real humans to solve puzzles, damages conversion rates, and is increasingly beaten by smarter bots anyway.
The EDZNET Honeypot + Timing Guard plugin takes the opposite approach: it intercepts bots using behaviour that no human visitor exhibits. No puzzles, no maths, no "I am not a robot" clicks — the form simply refuses to send to real spammers while real users are never even aware the protection exists.
Three Techniques, One Plugin
1. The Honeypot Trap
A honeypot field is a real text input field rendered on the page but hidden with CSS positioning — moved off-screen rather than hidden with display: none, so automated scrapers that skim human-invisible markup still try to fill it in. A human never sees it and never types in it; a bot frequently does. The instant the honeypot field has content, the submission is silently discarded as spam.
2. The Timing Guard
Humans take a few seconds to type a message. Bots typically submit in milliseconds. The timing guard stamps the form with a signed timestamp — verified with an HMAC secret derived from the site's own key — and rejects submissions that arrive faster than the minimum elapsed time (3 seconds by default). Because the timestamp is cryptographically signed, a bot cannot simply fake it; the signature has to match the site's secret key.
3. Gibberish Content Detection
Many spam bots submit content optimised for SEO-link injection rather than conversation. The plugin inspects the submitted text for classic gibberish signatures — very long strings without spaces, words mixing letters and digits, and long vowel-less sequences — and rejects submissions that look like a machine hammered the keyboard.
How a Blocked Submission Appears
When any of the three checks fires, the plugin silently drops the mail — the bot sees a "success" and moves on to the next site, never learning what caught it — and logs the reason to the spam log so you can review exactly what was blocked and why.
Tuning With Filters
Everything is configurable from your theme's functions.php via simple filters:
// Minimum human fill time (seconds)
add_filter('edz_hp_min_seconds', fn() => 5);
// Require / bypass the signed timestamp
add_filter('edz_hp_require_timestamp', '__return_true');
// Turn gibberish detection on / off
add_filter('edz_hp_check_gibberish', '__return_true');
// Customise which fields are scanned
add_filter('edz_hp_gibberish_fields', fn($fields) => $fields);
Why No CAPTCHA at All?
- Accessibility — CAPTCHAs punish visually impaired users and fail WCAG conformance for many sites
- Conversion — every extra step a visitor must complete drops genuine form submissions
- Effectiveness — modern bots solve image-and-audio CAPTCHAs at human rates; behaviour checks they never exhibit cannot be beaten the same way
- User experience — your visitors complete the form exactly as they always have, instantly
Frequently Asked Questions
Will the honeypot field harm my SEO?
No. The field is hidden with CSS positioning, not deceptive cloaking, and it contains no content for search engines to index. Search engines crawl the visible page.
Do real visitors ever get blocked?
Only in the pathological case of a human typing a full message in under three seconds containing no spaces and no vowels. In practice, legitimate submissions always clear every check.
Does it work with caching plugins?
Yes. The honeypot and timestamp fields are injected server-side on every render, so they work even when the page is served from a full-page cache.
Which form plugins does it support?
It is built for Contact Form 7 (CF7), the most widely used form plugin on WordPress. When spam is detected, CF7's mail is simply never sent and the attempt is written to the spam log.
Is there a data-retention concern?
No. The plugin never transmits visitor data anywhere. The span log lives in your own database.
Download EDZNET Honeypot + Timing Guard Read about security hardening
