Simplify your WordPress workflow!
Build faster, cleaner, and more reliable WordPress websites using lightweight plugins designed for real-world workflows.
Get started nowSpam protection
Every form is protected from the start, with nothing to set up. A CAPTCHA adds a stronger check when you need one.
Always on
- Honeypot — a field people never see. Bots fill it in, and the submission is refused.
- Time check — a form sent within two seconds of appearing is refused. People do not type that fast.
- Rate limit — up to five submissions a minute, from one visitor to one form.
Every submission is also checked on the server against the form itself. Answers to fields the form does not have are ignored.
Add a CAPTCHA
The CAPTCHA is set once, for all forms of the site.
- Go to RB Forms → Settings → CAPTCHA.
- Choose a Provider:
- reCAPTCHA v2 — the “I’m not a robot” checkbox
- reCAPTCHA v3 — invisible, gives each visitor a score
- hCaptcha
- Cloudflare Turnstile
- Enter the Site key and Secret key from the provider’s dashboard.
- For reCAPTCHA v3, set the score threshold. A visitor who scores lower is refused; 0.5 is the default.
- Click Save, then send a test submission.
CAPTCHA and files
With a CAPTCHA on, a file can be uploaded only after the CAPTCHA is passed, so the page with a file field shows it. See File uploads.
If the CAPTCHA does not load
An ad blocker or a network problem can stop the CAPTCHA script. The form then says so, rather than hanging on Sending…. Keep this in mind if a visitor reports they cannot send a form.
