How the honeypot check works

WP Armour Extended builds on WP Armour’s JavaScript honeypot protection. JavaScript adds a honeypot field to supported forms; bots that cannot use JavaScript cannot fill it to pass the anti-spam check. Visitors do not have to complete a CAPTCHA or extra verification field. The check targets automated submissions, so people can still submit spam manually.

Review spam and apply filters

Extended controls help administrators inspect unwanted submissions and respond to repeated activity:

• Record spam submissions to see what bots tried to send.
• Log IP addresses linked to bot activity.
• Block an IP address after multiple spam submissions from that address.
• Apply an additional layer of IP-based filtering.
• Mark submissions as spam when they contain specified words or phrases.

Check supported areas

WP Armour protection is listed for WordPress comments and registration, bbPress forums, Contact Form 7, Gravity Forms for non-Ajax single-page or step forms, WPForms, Formidable Forms, Caldera Forms, Toolset Forms, Elementor Forms, Fluent Forms, Divi Theme Contact Form, Theme My Login, and WooCommerce Reviews Pro.

WP Armour Extended also supports WooCommerce checkout and registration, including card-testing orders, and Easy Digital Downloads checkout and registration. Other listed integrations include QuForm, Ninja Forms, Ajax-based and multi-step Gravity Forms, MC4WP: Mailchimp for WordPress, S2 Members, Ultimate Members, Bricks Builder Form, BricksForge Pro Form, Beaver Builder Contact Form Module, Strong Testimonials, Formcraft Form, Forminator, WS Form, YITH Easy Login & Register Popup for WooCommerce, UsersWP, Youzify, MailPoet, Brevo, JetForm Builder, HTMLform, the Avia Enfold Theme, BuddyPress, BuddyBoss, Sure Forms, and Everest Forms.

Install and verify protection

Install and activate WP Armour Extended, then check the supported forms and WordPress areas used on your site. An administrator can use the WP Armour test widget beneath a supported form to confirm the honeypot is active. Review recorded submissions and adjust IP and keyword controls as spam patterns change.

WP Armour is described as GDPR compliant and as using no tracking, cookie storage, or external server calls. Its spam filtering is also described as working without external API calls such as those used by Akismet or CleanTalk.