Stop Gravity Forms spam and fix broken-looking forms

To cut Gravity Forms spam, turn on the form's honeypot and submission speed check, then add a CAPTCHA if spam still gets through. When a form has odd spacing or fields that look off, the usual cause is a setting called Enable legacy markup.

New to forms? Start with Build a contact form with Gravity Forms.

Turn on Gravity Forms' spam checks

Gravity Forms has two free checks built in. Both are invisible to visitors.

1. Go to Forms and open the form.
2. Open Settings → Form Settings and find Spam Detection (older versions put the honeypot under Form Options).
3. Turn on Detect spam using the Advanced Honeypot. It adds a hidden field that people never see but bots fill in.
4. Turn on Submission Speed Check. It flags forms sent within a moment of the page loading, faster than a person could fill them in.
5. Under If the Advanced Honeypot flags a submission as spam, choose Do not create an entry to throw spam away, or Create an entry and mark it as spam to keep it for review.
6. Save the form. Repeat for each form: these settings are per form.

Entries marked as spam go to the Spam list on the form's Entries screen, not your inbox. Check it now and then for real messages that were caught by mistake.

Add a CAPTCHA if spam keeps coming

Bots that load the page like a real browser can get past a honeypot. For those, add a check such as Google reCAPTCHA (Gravity Forms' CAPTCHA field or its reCAPTCHA add-on) or Cloudflare Turnstile ("verify you're human").

Use one check per form. Two checks don't stop more spam, but they do add weight to the page and another way for the form to break.

Why some spam still gets through

No setting can stop:

• A real person who passes the check and types junk
• Paid services that solve CAPTCHA challenges for spammers

Stricter filtering starts blocking real customers too. A little spam in the inbox is better than missing a real inquiry.

Keep forms short. Extra fields don't stop spam, but they do stop real people from finishing.

Why does my form look broken?

Forms created in older versions of Gravity Forms can still use the old layout, which modern theme styles don't match.

1. Go to Forms and open the form that looks wrong.
2. Open Settings → Form Settings.
3. Turn Enable legacy markup off.
4. Save the form, then check it on the page. Some older field layouts shift a little.
5. Repeat for each form that looks broken. The setting is per form.

Don't see Enable legacy markup? Gravity Forms hides it when no forms use the old layout. In that case the setting isn't the problem.

If your site runs on Dirigible

The Dirigible theme turns on the Advanced Honeypot and a 2-second Submission Speed Check for every form, and discards submissions they flag. New forms are covered as soon as you create them, and the form's Spam Detection settings show these as set by the theme. It also catches a bot re-sending copies of one real submission from many addresses, and treats a web address typed into a Name field as a link, following the form's If Links/URLs are found choice.

• Form Submission Limit, under Appearance → Customize → Settings → Gravity Forms, caps how often one visitor can submit in an hour, which helps against bursts of spam.
• With the Simple Cloudflare Turnstile plugin and Dirigible Optimize, the "verify you're human" check loads only when a visitor reaches the form, and reCAPTCHA steps aside on forms Turnstile protects. See Turnstile on demand.
• To clear out old spam entries, use Forms → Entry cleanup in Dirigible → Tools & Maintenance. See Forms and email tools.

More on how Dirigible styles and protects forms: Gravity Forms.