by
Team beta version
0 (0 reviews)
Samurai Honeypot for Forms
Invisible 15-layer anti-spam for Contact Form 7 & WPForms. Score-based 3-Tier Triage silently blocks bots — no CAPTCHA, no user friction.
Samurai Honeypot for Forms ranks #31,768 among WordPress.org plugins with 10+ active installations, is #1,834 of 5,058 in the Security category, and was last updated Jul 15, 2026. Data from WordPress.org, refreshed twice daily — see methodology.
Tested up to WP 7.0.8 (Current: 7.1.4)
v1.1.6
Current Version v1.1.6
Updated 3 months ago
Last Update on 15 Jul, 2026
Refreshed 1 week ago
Last Refreshed on
#1,834 of 5,058 in Security
Top 50% by installs
Rank
#31,768
—
No change
Active Installs
10+
—
No change
KW Avg Position
108
—
No change
Downloads
820
+1 today
Support Resolved
0%
—
No change
Rating
0%
Review 0 out of 5
0
(0 reviews)
Next Milestone 20
10+
20+
8,595
Ranks to Climb
-
Growth Needed
8,000,000
Active Installs
Pro
Unlock Exact Install Count
See the precise estimated active installs for this plugin, calculated from real-time ranking data.
- Exact install estimates within tiers
- Track install growth over time
- Milestone progress predictions
Need 2 more installs to reach 20+
Rank Changes
Current
#31,768
Change
Best
#
Downloads Growth
Downloads
Growth
Peak
Upgrade to Pro
Unlock 30-day, 90-day, and yearly download history charts with a Pro subscription.
Upgrade NowReviews & Ratings
0.0
0 reviews
Overall
0%
5
0
(0%)
4
0
(0%)
3
0
(0%)
2
0
(0%)
1
0
(0%)
Track This Plugin
Get detailed analytics, keyword tracking, and position alerts delivered to your inbox.
Start Tracking FreePlugin Details
- Version
- 1.1.6
- Last Updated
- Jul 15, 2026
- Requires WP
- 5.9+
- Tested Up To
- 7.0.8
- PHP Version
- 7.4 or higher
- Author
- Team beta version
Support & Rating
- Rating
- ☆ ☆ ☆ ☆ ☆ 0
- Reviews
- 0
- Support Threads
- 0
- Resolved
- 0%
Keywords
Upgrade to Pro
Unlock keyword rankings, search positions, and detailed analytics with a Pro subscription.
Upgrade NowSimilar Plugins
Adminify – White Label, Admin Menu Editor, Login Customizer
6K+ installs
#2,757
Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits
30K+ installs
#1,015
LiteSpeed Cache
7M+ installs
#5
Akismet Anti-spam: Spam Protection
5M+ installs
#8
Wordfence Security – Firewall, Malware Scan, and Login Security
5M+ installs
#11
Really Simple Security – Simple and Performant Security (formerly Really Simple SSL)
3M+ installs
#18
Hostinger Tools
3M+ installs
#20
WPS Hide Login
2M+ installs
#27
Limit Login Attempts Security - Login Security, 2FA, Firewall, Brute Force Prevention
1M+ installs
#33
WP Super Cache
1M+ installs
#36
Frequently Asked Questions
Common questions about Samurai Honeypot for Forms
Yes. Tokens are fetched dynamically via REST API, so it works correctly with any page cache plugin.
The default difficulty is 4 (the first 4 hex characters of the SHA-256 hash must be zero). On typical devices this completes in tens to hundreds of milliseconds with no perceptible delay. You can adjust the difficulty from 2 to 6 in the settings.
Yes, for both Contact Form 7 and WPForms: Contact Form 7: Open the form editor, go to the "Additional Settings" tab, and add skip_samhp: on (or skip_samurai_honeypot: on). WPForms: Go to Settings > Samurai Honeypot > Access Control, and enter the form IDs in the "WPForms Skip Form IDs" textarea (one ID per line). You can find the form ID in WPForms > All Forms (the number in the Shortcode column).
Blocked submissions with scores between your threshold and 99 are automatically saved to the Quarantine Log (Settings > Quarantine Log). You can view the date, score, triggered defense layers, and full form data for each entry. The log retains up to 1,000 entries in a FIFO (first-in, first-out) manner. Submissions scoring 100 or higher are permanently dropped and never saved anywhere. These are considered absolute bots (e.g., missing JavaScript, invalid tokens) and are dropped to protect your server from database bloat during mass attacks.
Samurai Honeypot no longer tags spam for Flamingo's spam folder. Instead, it prevents Flamingo from saving spam entirely to protect your database, while still allowing legitimate messages (Tier 1 / Pass) to be saved in Flamingo normally. Blocked messages (Tier 2 and Tier 3) are saved in our lightweight built-in Quarantine Log (max 1,000 records, FIFO auto-rotation) instead. This means you can safely use Flamingo as a CRM for real customer messages without worrying about spam bloating your database. Could legitimate messages be blocked? (False Positives) Yes, this is possible. While the multi-layer detection system is designed to minimize false positives, certain environments may cause legitimate submissions to be flagged: Users behind enterprise proxies or corporate firewalls Users with outdated browsers (especially Chrome versions 2+ years old) Users with aggressive privacy extensions that block JavaScript features VPN users whose IP addresses may be shared with spammers Users with accessibility tools that suppress mouse/keyboard events You MUST check the Quarantine Log periodically to identify any false positives. Quarantined messages (Tier 2) are always recoverable from the log. Adjust the spam threshold or whitelist specific IPs if you notice recurring false positives.
Submissions scoring 100 or higher (Tier 3) are immediately dropped from memory without any database write. This is a hardcoded absolute threshold that cannot be changed via settings. Combined with the FIFO cap of 1,000 quarantine entries, this ensures your database remains protected even under extreme attack conditions.
Yes. Samurai Honeypot uses the wpcf7_skip_mail filter, so it works alongside reCAPTCHA, Akismet, and other anti-spam solutions.
By default, the plugin uses REMOTE_ADDR only. If you are behind Cloudflare or an Nginx reverse proxy, enable "Trusted Proxy Mode" in the plugin settings. The plugin validates proxy IPs against Cloudflare's published IP ranges and RFC 1918 private networks before trusting forwarded headers.
Go to the Samurai Honeypot settings page under Access Control. Enter one IP address or CIDR range per line (e.g. 192.168.1.0/24). Whitelisted IPs skip all spam scoring entirely. Blacklisted IPs receive an automatic +100 spam score. You can also enable "Whitelist Logged-in Users" to skip scoring for all authenticated WordPress users.
Content Rules analyze the text submitted through form fields for common spam patterns: URL Limit — Set a maximum number of URLs allowed per submission. Messages exceeding the limit receive +50 score. Set to 0 to disable. BBCode Detection — Detects [url=...] BBCode syntax, which is never used in legitimate contact form messages. Enabled by default (+100 score). WordPress Disallowed Keys — Reuses the keyword list from Settings > Discussion > Disallowed Comment Keys. Disabled by default; enable it to apply the same keyword blocking to form submissions (+100 score).
