Honeypot

The form contains a field hidden from normal visitors. If automated software fills in this field, the plugin rejects the request as spam.

Minimum completion time

At least three seconds must pass between loading the form and submitting it. Forms submitted extremely quickly by automated systems are therefore rejected.

Temporary rate limit

After a request has been sent successfully, the plugin blocks another request from the same visitor for two minutes. An HMAC hash derived from the IP address is used as a temporary transient key for this purpose.

No raw IP in the request record

The rate-limit key does not contain the raw IP address. In Lite, the contact request is also not stored by the plugin as a support record; it is sent by email via WordPress.