gravity-forms-zero-spam
Last commit date
dist
2 months ago
includes
2 weeks ago
languages
2 weeks ago
LICENSE
3 years ago
gravityforms-zero-spam.php
2 weeks ago
readme.txt
2 weeks ago
readme.txt
288 lines
| 1 | === Gravity Forms Zero Spam === |
| 2 | Contributors: gravityview |
| 3 | Tags: gravity forms, spam, captcha, honeypot, anti-spam |
| 4 | Requires at least: 4.7 |
| 5 | Tested up to: 7.0.0 |
| 6 | Stable tag: 1.9.0 |
| 7 | Requires PHP: 7.4 |
| 8 | License: GPLv2 or later |
| 9 | License URI: http://www.gnu.org/licenses/gpl-2.0.html |
| 10 | Donate link: https://www.gravitykit.com?utm_source=plugin&utm_campaign=zero-spam&utm_content=donate |
| 11 | |
| 12 | Enhance your Gravity Forms to include anti-spam measures originally based on the work of David Walsh's "Zero Spam" technique. |
| 13 | |
| 14 | == Description == |
| 15 | |
| 16 | This Gravity Forms add-on blocks spam using a non-obtrusive anti-spam measure and can email a spam report summary. |
| 17 | |
| 18 | ## Spam blocking for Gravity Forms |
| 19 | |
| 20 | To get started, all you need to do is activate the plugin! |
| 21 | |
| 22 | ### Is the Gravity Forms honeypot field not working for you? 🍯 🐝 |
| 23 | |
| 24 | Zero Spam is better than the Gravity Forms anti-spam honeypot field. If you're getting spammed, try this plugin. |
| 25 | |
| 26 | ### Use this plugin instead of reCaptcha |
| 27 | |
| 28 | **reCaptcha is user-hostile!** Use this instead! Users don't need to click stoplights, crosswalks, or bicycles when you use this plugin to stop spam. |
| 29 | |
| 30 | ### Enable or disable filtering per form |
| 31 | |
| 32 | If you only want the plugin for specific forms, that's possible! The plugin adds a simple "Prevent spam using Gravity Forms Zero Spam" setting to each form (requires Gravity Forms 2.5 or newer). |
| 33 | |
| 34 | ## Spam report emails |
| 35 | |
| 36 | Spam summary report emails are disabled by default. Once enabled, a spam summary that includes the number of entries per-form will be sent via email. |
| 37 | |
| 38 | Choose whether you want to be notified after the number of entries reaches a threshold (e.g. 10 spam entries) or after a certain number of days (e.g. every week). If there are no spam entries, no report will be sent. |
| 39 | |
| 40 | ------- |
| 41 | |
| 42 | Requires [Gravity Forms](https://www.gravityforms.com/?partner_id=1210629&irgwc=1&utm_medium=affiliate&utm_campaign=1210629&utm_source=Katz%20Web%20Services%2C%20Inc.). |
| 43 | |
| 44 | _Brought to you by [GravityKit](https://www.gravitykit.com?utm_source=plugin&utm_campaign=zero-spam&utm_content=readme). We create essential Gravity Forms Add-Ons._ |
| 45 | |
| 46 | == Frequently Asked Questions == |
| 47 | |
| 48 | = Does the Gravity Forms Zero Spam plugin stop email notifications from being emailed when a message is considered spam? = |
| 49 | |
| 50 | Yes! When this plugin marks an entry as spam, it prevents processing of any configured notifications and add-on feeds. |
| 51 | |
| 52 | Note: When an entry is marked as Spam, it also prevents use of the configured confirmation. Users submitted a entry marked as Spam will see the default Gravity Forms “Thanks for contacting us! We will get in touch with you shortly.” confirmation text instead. |
| 53 | |
| 54 | = I have Gravity Forms 2.7 installed. Do I need this plugin? = |
| 55 | |
| 56 | Gravity Forms 2.7 added functionality that has similar features to this plugin, but we're adding additional features soon—keep this plugin installed! |
| 57 | |
| 58 | = Does this plugin work in combination with other CAPTCHAs, honeypot fields, or spam blocker plugins? = |
| 59 | |
| 60 | Yep, you can use this plugin in combination with all other spam-blocking plugins: |
| 61 | |
| 62 | - Gravity Forms' Google reCaptcha feature |
| 63 | - WPBruiser |
| 64 | - Akismet |
| 65 | - Gravity Forms' honeypot fields |
| 66 | - GravityCaptcha |
| 67 | - СleanTalk |
| 68 | - WP Armor |
| 69 | - fail2ban |
| 70 | |
| 71 | Zero Spam will not interfere with the operation of those plugins. It also doesn't interfere with Gravity Forms' built-in honeypot functionality. |
| 72 | |
| 73 | = What version of Gravity Forms does this work with? = |
| 74 | |
| 75 | This works with all Gravity Forms releases after v2.3 (released June 2017). |
| 76 | |
| 77 | = Will this block spam comments or registrations on my site? = |
| 78 | |
| 79 | No. For that, we recommend Ben Marshall‘s [WordPress Zero Spam plugin](https://wordpress.org/plugins/zero-spam/). |
| 80 | |
| 81 | = How do I disable Zero Spam on specific forms? = |
| 82 | |
| 83 | 1. Go to the form |
| 84 | 2. Click on Settings |
| 85 | 3. Under Form Options, disable "Prevent spam using Gravity Forms Zero Spam". _Don't see the setting? This feature requires Gravity Forms 2.5 or newer._ |
| 86 | 4. Save the settings |
| 87 | |
| 88 | New form submissions will not be checked using Zero Spam. |
| 89 | |
| 90 | = I only want on specific forms. How do I disable Zero Spam by default? = |
| 91 | |
| 92 | To disable by default, from your Dashboard, go to Forms, then Settings, then the Zero Spam tab. Under the "Enable Zero Spam by Default" setting, choose "Disabled", then save the form. |
| 93 | |
| 94 | Once you have saved the setting, to enable for specific forms: |
| 95 | |
| 96 | 1. Go to the form |
| 97 | 2. Click on Settings |
| 98 | 3. Under Form Options, enable "Prevent spam using Gravity Forms Zero Spam". _Don't see the setting? This feature requires Gravity Forms 2.5 or newer._ |
| 99 | 4. Save the settings |
| 100 | |
| 101 | Now that form will use Zero Spam. |
| 102 | |
| 103 | = All entries are going to spam. What can I do? = |
| 104 | |
| 105 | First, **de-activate and re-activate the plugin**. Then let us know on the support tab! |
| 106 | |
| 107 | = Spam summary report emails = |
| 108 | |
| 109 | You can enable a spam summary report email. This email will be sent to the email address configured in the "Spam Summary Email" setting on the Gravity Forms "Forms" menu, click Settings, then click the Zero Spam tab. |
| 110 | |
| 111 | == Changelog == |
| 112 | |
| 113 | = 1.9.0 on June 11, 2026 = |
| 114 | |
| 115 | * Added: AI-powered spam review that flags likely spam the token check missed and recovers legitimate submissions it blocked by mistake, powered by an AI service (OpenAI, Anthropic, or Google Gemini) connected in WordPress 7.0+. |
| 116 | * Fixed: Per-form links in the spam report email opened an empty Spam entries list, hiding spam received after the previous report. |
| 117 | |
| 118 | = 1.8.0 on April 16, 2026 = |
| 119 | |
| 120 | * Added: Translations in 27 languages |
| 121 | * Fixed: Spam report emails could fail to send when the feature was first enabled |
| 122 | |
| 123 | = 1.7.5 on April 9, 2026 = |
| 124 | |
| 125 | * Fixed: Forms rendered in modals or other elements output via `wp_footer` (e.g., site-wide popups, slide-ins) were missing the spam prevention token, causing legitimate submissions to be flagged as spam |
| 126 | |
| 127 | = 1.7.4 on April 2, 2026 = |
| 128 | |
| 129 | * Added: "Anti-Spam Expiration" setting to control how long spam prevention tokens remain valid, accessible from Forms > Settings > Zero Spam |
| 130 | * Fixed: Email rejection settings and form editor scripts not loading when Gravity Forms No Conflict mode is enabled |
| 131 | * Fixed: Form submission failure ("Cannot read properties of undefined") caused by the token fetch request failing unexpectedly |
| 132 | |
| 133 | = 1.7.3 on March 24, 2026 = |
| 134 | |
| 135 | * Improved: Extended token lifetime to 7 days and improved token fetching compatibility |
| 136 | * Fixed: Submissions from pages with multiple Gravity Forms were incorrectly marked as spam when the form wasn't the first one on the page |
| 137 | * Added: `gf_zero_spam_token_ttl` and `gf_zero_spam_fallback_token_ttl` filters to adjust the lifetime of dynamically fetched and HTML-embedded fallback tokens respectively (default for both: 7 days) |
| 138 | |
| 139 | = 1.7.2 on March 12, 2026 = |
| 140 | |
| 141 | * Fixed: Forms with conditional logic could be invisible to visitors |
| 142 | |
| 143 | = 1.7.1 on March 6, 2026 = |
| 144 | |
| 145 | * Fixed: Fatal error on sites where `AUTH_KEY` or `SECURE_AUTH_KEY` constants are not defined in `wp-config.php` |
| 146 | |
| 147 | = 1.7.0 on March 5, 2026 = |
| 148 | |
| 149 | * Added: Stronger spam prevention using signed, time-limited tokens |
| 150 | * API: Added `gf_zero_spam_client_ip` filter to override the visitor IP used for rate limiting (useful for sites behind Cloudflare or load balancers) |
| 151 | * API: Added `gf_zero_spam_rate_limit` filter to adjust the maximum token requests allowed per IP per minute (default: 30) |
| 152 | |
| 153 | = 1.6.0 on February 27, 2026 = |
| 154 | |
| 155 | * Improved: Removed dependency on jQuery |
| 156 | * Fixed: "Prevent spam using Gravity Forms Zero Spam" toggle appeared twice in form settings |
| 157 | |
| 158 | = 1.5.0 on February 26, 2026 = |
| 159 | |
| 160 | **This release requires PHP 7.4 or newer.** |
| 161 | |
| 162 | * Added: Email rejection rules to validate email field submissions and take action based on matching addresses, domains, or patterns |
| 163 | - Match by exact email, domain (e.g., `@example.com`), wildcard, or regular expressions (regex) |
| 164 | - Block the submission (requires Gravity Forms 2.9.15+), flag it as spam, or log it with an entry note |
| 165 | - Import multiple rules at once from a text list |
| 166 | - Enable/disable rules individually |
| 167 | - Set field-specific overrides in the Form Editor |
| 168 | * Added: Spam entries now show the reason they were flagged (e.g., missing or invalid key) |
| 169 | * Added: Zero Spam toggle now appears in the "Spam" form settings section on Gravity Forms 2.9.21+ |
| 170 | * Added: Spam protection for Save and Continue, preventing bots from creating spam drafts |
| 171 | * Improved: Redundant spam checks are skipped when the entry is already flagged by another filter |
| 172 | * API: Added `gf_zero_spam_email_rules` filter to modify email rejection rules before evaluation |
| 173 | * API: Added `gf_zero_spam_email_rule_match` action that fires when an email matches a rejection rule |
| 174 | |
| 175 | = 1.4.6 on January 7, 2025 = |
| 176 | |
| 177 | * Fixed: Fatal error on PHP 7.2 and older |
| 178 | |
| 179 | = 1.4.5 on November 28, 2024 = |
| 180 | |
| 181 | * Fixed: PHP deprecation warning when using Gravity Forms 2.8 or newer |
| 182 | |
| 183 | = 1.4.4 on October 15, 2024 = |
| 184 | |
| 185 | * Improved: Submissions by users who have the capability to edit Gravity Forms entries are no longer processed by Zero Spam (thanks for the idea, @richardjb62!) |
| 186 | * Fixed: Use GMT time for spam summary email reports to make sure the report is sent at the correct time |
| 187 | |
| 188 | = 1.4.2 & 1.4.3 on October 10, 2024 = |
| 189 | |
| 190 | * Improved: Sanitized form ID in JavaScript |
| 191 | * Modified: Changed the text domain for strings to `gravity-forms-zero-spam` to match the plugin slug |
| 192 | * Fixed: Added missing Text Domain header for translation |
| 193 | |
| 194 | = 1.4.1 on November 10, 2023 = |
| 195 | |
| 196 | * Fixed: Conflict with the Gravity Forms Stripe Add-On |
| 197 | |
| 198 | = 1.4 on April 24, 2023 = |
| 199 | |
| 200 | * Added: **Spam summary email reports** are now available! Receive a helpful email summarizing spam messages received. To enable, from your Dashboard, go to Forms, then Settings, then Zero Spam to enable and configure this feature. |
| 201 | - Choose when to send the report (threshold-based or frequency-based) |
| 202 | - Customize the report message |
| 203 | - Works with any spam messages, not just those blocked by Zero Spam |
| 204 | * Added: A setting to globally enable or disable Zero Spam by default (default: Enabled) |
| 205 | |
| 206 | = 1.3 on February 18, 2023 = |
| 207 | |
| 208 | Gravity Forms 2.7 added improved spam blocking in 2.7. Keep this plugin installed—it won't hurt, and we're about to add some great new features soon! ❤️ Thanks to Richard Wawrzyniak for the code updates in this release. |
| 209 | |
| 210 | * Added: Support for API submissions (which don't have a form submit action) |
| 211 | * Fixed: Gravity Forms 2.7 support |
| 212 | * Fixed: PHP 8.0 warnings |
| 213 | * Tested with WordPress 6.2 |
| 214 | |
| 215 | = 1.2.3 on August 11, 2022 = |
| 216 | |
| 217 | * Tweak: Changed the autocomplete on the hidden field to `new-password` instead of `off`. Thanks for the suggestion, Ross! |
| 218 | |
| 219 | = 1.2.2 on August 11, 2022 = |
| 220 | |
| 221 | * Improved: Prevent autocomplete on the hidden field. This may help prevent some reported false-positives. |
| 222 | * Tested with WordPress 6.0.1 |
| 223 | |
| 224 | = 1.2.1 on February 16, 2022 = |
| 225 | |
| 226 | * Improved: Don't check for spam on the Gravity Forms Preview page |
| 227 | * Tested with WordPress 5.9 |
| 228 | |
| 229 | = 1.2 & 1.2.0.1 on December 10, 2021 = |
| 230 | |
| 231 | * New! Added a per-form setting "Prevent spam using Gravity Forms Zero Spam" that enables or disables Gravity Forms Zero Spam from processing! [Check out the FAQ to learn how to use this setting](https://wordpress.org/plugins/gravity-forms-zero-spam/#faq-header). Note: this feature requires Gravity Forms 2.5 or newer. |
| 232 | |
| 233 | = 1.1.3 on August 9, 2021 = |
| 234 | |
| 235 | * Enhancement: Adds an entry note when an entry is marked as spam. Thanks to Gravity Forms for the enhancement! |
| 236 | |
| 237 | = 1.1.2 on July 5, 2021 = |
| 238 | |
| 239 | * Fixed: Entries going to spam on websites that have plugins that override random password generation. Thanks, @thomascharbit! |
| 240 | |
| 241 | = 1.1.1 on April 22, 2021 = |
| 242 | |
| 243 | * Fixed: Script not being correctly loaded using Gravity Forms' inline JavaScript |
| 244 | |
| 245 | = 1.1 on April 21, 2021 = |
| 246 | |
| 247 | * Improved: The JavaScript code that adds the spam-catching field is now output at the same time as Gravity Forms' inline JavaScript. |
| 248 | - The script is only loaded when forms are displayed |
| 249 | - jQuery is always available because Gravity Forms loads it as-needed |
| 250 | |
| 251 | = 1.0.7 on March 18, 2021 = |
| 252 | |
| 253 | * Fixed: All entries marked as spam for AJAX-enabled forms. Sorry, folks! Won't happen again. |
| 254 | * Went back to using jQuery to listen to form submissions. |
| 255 | |
| 256 | = 1.0.6.1 on March 15, 2021 = |
| 257 | |
| 258 | * Fixed: JavaScript "null is not an object (evaluating 'el.addEventListener')" error on pages without a form |
| 259 | |
| 260 | = 1.0.6 on March 11, 2021 = |
| 261 | |
| 262 | * Improved: No longer requires jQuery |
| 263 | * Fixed: Only checks for spam on submissions that were submitted by a form, not for entries created programatically |
| 264 | |
| 265 | = 1.0.5 on February 16, 2021 = |
| 266 | |
| 267 | The Gravity Forms Zero Spam plugin is now maintained by [GravityKit](https://www.gravitykit.com?utm_source=plugin&utm_campaign=zero-spam&utm_content=changelog). We look forward to continuing to improve this simple, effective spam blocker for Gravity Forms. Thanks to GoWP for their great work! |
| 268 | |
| 269 | * Improved: Only add anti-spam JavaScript when the Gravity Forms plugin is active |
| 270 | * Fixed: Sanitized key, in case there were any unsafe characters generated by overriding the `random_password` filter. |
| 271 | * Fixed: Made `GF_Zero_Spam::deactivate` a static method |
| 272 | * Updated: Now using the `wp_print_footer_scripts` action to add the script (was `wp_footer`) |
| 273 | |
| 274 | = 1.0.4 = |
| 275 | * Should fix 'jQuery undefined' errors |
| 276 | |
| 277 | = 1.0.3 = |
| 278 | * Added support for multi-page forms (thanks, @supporthero) |
| 279 | |
| 280 | = 1.0.2 = |
| 281 | * Update FAQ and compatibility notes in readme.txt |
| 282 | |
| 283 | = 1.0.1 = |
| 284 | * Fix issue with forms not submitting after an initial validation error |
| 285 | |
| 286 | = 1.0.0 = |
| 287 | * Initial version |
| 288 |