CleanTalk Spam Protection
CAPTCHA-free cloud anti-spam for comments, registrations, WooCommerce and 100+ form plugins, with a firewall for known bots. From $12/year.
85
WP Armour – Honeypot Anti Spam
Honeypot anti-spam plugin that blocks bots on comments and many form plugins with no CAPTCHA, API key or external calls; Extended adds more forms and logs.
Free installs400K+WordPress.org, active
Est. Pro installs~18KLikely 9K–36K
Rating5.0/51,472 reviews
Price from$19.99/yrFreemium
Last updated3 Sep 2026Version 2.4.02
Overview
WP Armour – Honeypot Anti Spam takes a different route from CAPTCHA plugins: instead of asking visitors to prove they are human, it adds a hidden honeypot field with JavaScript. Bots that do not run JavaScript, or that fill in every field, fail the check and the submission is rejected. Real visitors see nothing.
There is nothing to configure. Activation turns protection on for supported forms, each site gets its own honeypot field name, and the plugin makes no API calls to outside services. The readme describes it as GDPR compliant with no tracking, cookies or external server calls.
Free version
The free plugin covers WordPress comments, registration, login and lost password forms (including the WooCommerce login and lost password forms), bbPress, Contact Form 7, single-step non-Ajax Gravity Forms, WPForms, Formidable, Fluent Forms, Caldera, Toolset, Elementor forms, the Divi contact form, Theme My Login and WooCommerce Reviews Pro. A dashboard widget counts blocked attempts by day, week and month, and the spam error message can be changed.
WP Armour Extended
- More integrations, including WooCommerce checkout and registration, Easy Digital Downloads, Ninja Forms, Ajax and multi-step Gravity Forms, Forminator, WS Form, MailPoet, Bricks, Beaver Builder, BuddyPress, BuddyBoss and Ultimate Member
- Recording of spam submissions and spammer IPs, with IP blocking for repeat offenders
- A spam keyword filter and help against WooCommerce card-testing orders
Extended costs $19.99/year for one site, $49.99/year for five and $99.99/year for 100, with a 30-day refund policy.
Limitations
A honeypot only stops automated bots; the readme notes that spam typed in by humans is not affected, and there is no CAPTCHA fallback or cloud content filter for that. WooCommerce checkout protection and full spam logs need Extended, and the front-end script loads on every page.
It suits sites that want quiet, zero-setup bot protection that keeps all checks on their own server.
Best for: Sites that want invisible, zero-setup bot protection with no third-party services or visible CAPTCHA.
WP Armour is a straightforward, privacy-friendly way to stop automated form and comment spam without bothering visitors. Its honeypot approach will not catch human spammers, so sites with that problem need a content filter alongside it, and WooCommerce stores need Extended for checkout coverage.
Pros
- Visitors never see a challenge, so there is no friction on forms
- Works on activation with nothing to configure
- No API keys, external calls, cookies or tracking
- Free version covers many popular form plugins plus Elementor and Divi forms
- Inexpensive Extended licence adds logging, IP blocking and keyword filtering
Cons
- Honeypots do not stop spam typed in by humans
- WooCommerce checkout and registration protection is Extended-only
- Free version only shows counts, not a log of blocked submissions
- Front-end script is loaded on every page rather than only where forms appear
Key features
What WP Armour – Honeypot Anti Spam highlights on its WordPress.org page and its own website, split by version.
Free version WordPress.org
- Hidden honeypot, no CAPTCHA needed
- Works on activation, no setup
- No API calls or external services
- No cookies or tracking
- WordPress comments, login and registration
- Contact Form 7, WPForms, Gravity Forms
- Formidable, Fluent Forms, Caldera, Toolset
- Elementor and Divi contact forms
- bbPress forum protection
- Unique field name per site
- Dashboard widget with spam counts
Pro / paid adds From $19.99/yr
- WooCommerce checkout and registration
- Easy Digital Downloads and Ninja Forms
- Ajax and multi-step Gravity Forms
- Bricks and Beaver Builder forms
- BuddyPress, BuddyBoss, Ultimate Member
- Record spam submissions
- Log and block spammer IPs
- Spam keyword filter
- Card-testing order detection
- One year of premium support
Feature checklist
32 of 46 features we track in CAPTCHA & Spam, feature score 67/100
Protection methods 2/7
Google reCAPTCHA Key
Supports Google reCAPTCHA (v2 checkbox, invisible or v3 score-based).
Honeypot-only; no Google reCAPTCHA.
Not included
Cloudflare Turnstile Key
Supports Cloudflare Turnstile, the privacy-friendly CAPTCHA alternative.
Honeypot-only; no Cloudflare Turnstile.
Not included
hCaptcha
Supports hCaptcha challenges.
Honeypot-only; no hCaptcha.
Not included
Built-in CAPTCHA
Own image, math or puzzle CAPTCHA with no third-party service.
No visible CAPTCHA of any kind.
Not included
Honeypot fields
Hidden fields and timing checks that catch bots without a visible challenge.
JavaScript-injected hidden field with a unique name per site.
Included
Cloud spam filtering Key
Submissions checked against a cloud spam database of known spammers.
Readme states it uses no external API such as Akismet or CleanTalk.
Not included
No challenge for real users
Blocks bots without asking visitors to solve anything.
Honeypot is invisible to visitors; no challenge to solve.
Included
Where it protects 7/7
Comments Key
Protects WordPress comments from spam.
WordPress comments are protected in the free version.
Included
Login & password reset Key
Protects the login and lost-password forms.
Hooks into WordPress and WooCommerce login and lost-password forms.
Included
Registration
Protects the user registration form.
WordPress registration is free; WooCommerce registration needs Extended.
Included
WooCommerce checkout & account Key
Protects WooCommerce checkout, login and registration forms.
Free covers Woo login and lost password; checkout and registration need Extended.
Partial
Form plugin support Key
Works with popular form plugins such as Contact Form 7, WPForms or Gravity Forms.
CF7, WPForms, Gravity Forms (non-Ajax), Formidable, Fluent and more; Extended adds others.
Included
Page builder forms
Protects forms built in Elementor, Divi or similar builders.
Elementor and Divi forms free; Bricks and Beaver Builder in Extended.
Included
Community & membership plugins
Protects BuddyPress, bbPress, Ultimate Member or similar.
bbPress is free; BuddyPress, BuddyBoss and Ultimate Member are Extended.
Included
Rules & controls 3/5
Block and allow lists
Block or allow specific IPs, emails, words or user roles.
Extended blocks repeat-spammer IPs and filters spam keywords.
Paid version Extended
Country & language filters
Block submissions by country or language.
No country or language blocking in free or Extended.
Not included
Spam log & statistics
Log of blocked submissions with counts and reasons.
Free dashboard counts blocked attempts; Extended records submissions and IPs.
Partial
Skip for logged-in users
Hide the challenge for logged-in or trusted users.
No logged-in bypass; the honeypot is invisible so there is nothing to skip.
Not included
Custom labels & error messages
Change challenge text, errors, theme or language.
Spam error message is configurable; there is no visible challenge to style.
Partial
Privacy & performance 2/4
Privacy & GDPR options
No tracking cookies, data minimisation or a documented GDPR mode.
Readme says no tracking, cookie storage or external server calls.
Included
Works without an external service
Core protection runs entirely on your own server.
All checks run on your own server with no API calls.
Included
Scripts load only where needed
CAPTCHA scripts are only loaded on pages that have a protected form.
The small honeypot script is enqueued on every front-end and login page.
Not included
Multisite support
Works across a WordPress multisite network.
Multisite support is not documented.
Not verified
Form & plugin integrations 14/17
Contact Form 7 Key
Protects Contact Form 7 forms.
Contact Form 7 is protected in the free version.
Included
WPForms
Protects WPForms forms.
WPForms is protected in the free version.
Included
Gravity Forms
Protects Gravity Forms forms.
Free covers non-Ajax single-page forms; Ajax and multi-step need Extended.
Partial
Elementor Pro forms
Protects Elementor Pro form widgets.
Elementor forms are protected in the free version.
Included
Ninja Forms
Protects Ninja Forms forms.
Ninja Forms protection needs WP Armour Extended.
Paid version Extended
Formidable Forms
Protects Formidable Forms forms.
Formidable Forms is protected in the free version.
Included
Fluent Forms
Protects Fluent Forms forms.
Fluent Forms is protected in the free version.
Included
Forminator
Protects Forminator forms.
Forminator protection needs WP Armour Extended.
Paid version Extended
Divi contact forms
Protects Divi contact form modules.
Divi theme contact form is protected in the free version.
Included
Easy Digital Downloads
Protects EDD checkout, login or registration.
EDD checkout and registration need WP Armour Extended.
Paid version Extended
BuddyPress
Protects BuddyPress registration and activity.
BuddyPress and BuddyBoss protection needs WP Armour Extended.
Paid version Extended
bbPress
Protects bbPress topics and replies.
bbPress forum is protected in the free version.
Included
Ultimate Member
Protects Ultimate Member login and registration.
Ultimate Member protection needs WP Armour Extended.
Paid version Extended
MemberPress
Protects MemberPress signup and login.
MemberPress is not in the free or Extended supported lists.
Not included
Mailchimp for WP (MC4WP)
Protects MC4WP newsletter sign-up forms.
MC4WP sign-up forms need WP Armour Extended.
Paid version Extended
wpDiscuz
Protects wpDiscuz comment forms.
wpDiscuz is not in the free or Extended supported lists.
Not included
Custom forms & developer API
Protect any custom form via shortcode, function or hooks.
Not verified
Advanced protection 4/6
Bot firewall
Blocks known spam bots before pages load.
No bot firewall; Extended only blocks IPs after repeated spam submissions.
Partial
Disposable email blocking
Rejects throwaway or fake email addresses.
No email address checks; Extended adds a keyword filter only.
Not included
Card-testing protection
Stops bots testing stolen cards at WooCommerce checkout.
Extended covers WooCommerce checkout including card-testing orders.
Paid version Extended
REST API & XML-RPC protection
Blocks spam or abuse through the REST API or XML-RPC.
Not verified
Spam review & false-positive recovery
Review blocked submissions and approve false positives.
Extended records spam submissions for viewing; approving false positives is not documented.
Paid version Extended
Test mode & debugging
Test keys, debug logs or a test mode to check setup safely.
Admins see a WP Armour test widget under protected forms to confirm it works.
Included
Pricing
Free
$0On WordPress.org
Free
FreelifetimeUnlimited
Honeypot protection for core WordPress and many form plugins.
Extended Personal
$19.99per year1 site
Includes one year of updates and premium support.
Extended Business
$49.99per year5 sites
Extended Corporate
$99.99per year100 sites
Prices are list prices from the vendor's site, checked 14 Oct 2026. Many vendors discount the first year.
How many sites use WP Armour – Honeypot Anti Spam?
Free installs from WordPress.org, the vendor's own claim, and our estimate of paid installs.
Free version (WordPress.org)
400K+
Active installations reported by WordPress.org.
Vendor claim
—
The vendor does not publish a total.
Estimated Pro / paid installs
~18K
Our estimate, see method below.
How we estimated this: About 450K free installs x 4% (the usual share of free sites that also run the paid version when most features are free) gives 18K. Likely range: 9K to 36K. This counts sites running the paid version, including sites whose licence has lapsed. Estimates are rough and based on public figures as of 14 Oct 2026.
Stats & health
Weekly downloads
9,004 downloads last week, 5.1M all time
Rating breakdown
| Version | 2.4.02 |
|---|---|
| Last updated | 3 Sep 2026 (60 days ago) |
| Tested up to | WordPress 7.1.4 |
| Requires | WordPress 5.0+ |
| Support threads (2 months) | 2 of 12 resolved |
| On WordPress.org since | 16 Jun 2020 |
Company & policy
| Refund policy | 30-day refund (source, 6 Oct 2026) |
|---|
WP Armour – Honeypot Anti Spam compared
Simple Cloudflare Turnstile/WP Armour – Honeypot Anti Spam
CAPTCHA 4WP/WP Armour – Honeypot Anti Spam
Advanced Google reCAPTCHA/WP Armour – Honeypot Anti Spam
Antispam Bee/WP Armour – Honeypot Anti Spam
hCaptcha for WordPress/WP Armour – Honeypot Anti Spam
Akismet Anti-spam/WP Armour – Honeypot Anti SpamCleanTalk Spam Protection/WP Armour – Honeypot Anti Spam
reCAPTCHA for WooCommerce/WP Armour – Honeypot Anti Spam Alternatives to WP Armour – Honeypot Anti Spam
hCaptcha for WordPress
Free plugin that adds hCaptcha to WordPress core, WooCommerce and 60+ form, builder and community plugins, with honeypot and IP controls.
84
Advanced Google reCAPTCHA
WebFactory's free CAPTCHA and login-protection plugin with reCAPTCHA and a built-in math CAPTCHA; WP Captcha PRO adds hCaptcha, Turnstile and a firewall.
81
Simple Cloudflare Turnstile
Free plugin that adds Cloudflare Turnstile CAPTCHA to WordPress, WooCommerce and 30+ form, membership and community plugins.
73
CAPTCHA 4WP
Freemium CAPTCHA plugin: free reCAPTCHA for core WordPress forms; Premium adds hCaptcha, Turnstile, WooCommerce, form plugins and geoblocking.
67
Akismet Anti-spam
Automattic's cloud spam filter for WordPress comments and many form plugins; free keys for personal sites, paid plans for commercial use.
43
FAQ
Is WP Armour – Honeypot Anti Spam free?
Yes. WP Armour – Honeypot Anti Spam has a free version on WordPress.org. Paid plans start at $19.99/yr.
How many sites use WP Armour – Honeypot Anti Spam?
WordPress.org reports 400K+ active installations of the free version. We estimate around 18K sites run the paid version.
Does WP Armour – Honeypot Anti Spam have google recaptcha?
No: not included. Honeypot-only; no Google reCAPTCHA.
Does WP Armour – Honeypot Anti Spam have cloudflare turnstile?
No: not included. Honeypot-only; no Cloudflare Turnstile.
Does WP Armour – Honeypot Anti Spam have cloud spam filtering?
No: not included. Readme states it uses no external API such as Akismet or CleanTalk.
Does WP Armour – Honeypot Anti Spam have comments?
Yes: included. WordPress comments are protected in the free version.
Does WP Armour – Honeypot Anti Spam have login & password reset?
Yes: included. Hooks into WordPress and WooCommerce login and lost-password forms.
Does WP Armour – Honeypot Anti Spam have woocommerce checkout & account?
Yes: partial. Free covers Woo login and lost password; checkout and registration need Extended.
Does WP Armour – Honeypot Anti Spam have form plugin support?
Yes: included. CF7, WPForms, Gravity Forms (non-Ajax), Formidable, Fluent and more; Extended adds others.
Does WP Armour – Honeypot Anti Spam have contact form 7?
Yes: included. Contact Form 7 is protected in the free version.
Does WP Armour show a CAPTCHA to visitors?
No. It adds a hidden honeypot field with JavaScript, so real visitors see nothing and bots that fill it in or skip the script are blocked.
Will it stop all spam?
It targets automated bots. The plugin's own FAQ notes that spam submitted manually by people is not blocked.
Does the free version protect WooCommerce checkout?
No. The free version covers WooCommerce login and lost password forms and some review forms; checkout and registration need WP Armour Extended.
Is it GDPR friendly?
The readme describes it as GDPR compliant, with no tracking, cookies or external server calls.
Last updated 6 Oct 2026. Spotted something wrong? Suggest an edit.