Gravity Forms includes a honeypot and a submission-speed check out of the box, which handle most automated submissions. Add-ons bring reCAPTCHA, Turnstile, Akismet, StopForumSpam and toxicity moderation, though several sit behind higher licence tiers. None of it catches spam typed by a person, and none of it records where a submission came from.
What ships built in
Two things, both free with any licence, both invisible.
Honeypot. A hidden field a real visitor never sees and a bot fills. Enable it per form. It is the highest return for the least effort of anything here.
Submission speed check. Flags submissions that arrive faster than a person could have completed the form. Automated submissions fail it almost by definition.
On a low-traffic site those two often do the whole job. Turn them on before adding anything else. Both sit in the spam detection settings for each form, documented in Gravity Forms’ own honeypot guide.
What the add-ons add
| Add-on | What it does | Licence |
|---|---|---|
| Google reCAPTCHA v2 and v3 | Challenge or score-based detection | Basic and above |
| Cloudflare Turnstile | Invisible challenge, no visitor friction | Add-on |
| Akismet | Spam-database filtering, routes to a Spam folder | Premium add-on |
| StopForumSpam | IP and email blacklist lookups | Add-on |
| Perspective | Toxicity moderation | Elite |
Source: Gravity Forms documentation, checked September 2026. There is no free version of Gravity Forms, so every add-on above assumes a paid licence.
Premium licences also file flagged entries into a Spam folder rather than deleting them, which is worth knowing. A filter that holds what it catches is a different proposition from one that drops it, because a false positive costs you a click instead of a customer.
A sensible order
1. Turn on the honeypot and the speed check. Free, invisible, minutes.
2. Add Turnstile if junk continues. It runs in the background and does not interrupt the visitor, and the token needs validating server-side to actually do anything.
3. Add Akismet if what arrives reads like a person wrote it. It is the only layer in this list looking at the message rather than the sender’s behaviour.
4. Use StopForumSpam for repeat offenders. It only knows what is already known, so it trails new patterns.
The same ordering, without the WordPress specifics, is in how to stop form spam.
What none of it catches
Human-written spam, mostly. Akismet helps, because it reads the content. The rest of the stack is looking for automation, and a person typing a pitch is not automated.
Where the submission came from. Gravity Forms records what was entered. It does not record the ad, search or referral that brought the person, or the pages they read before enquiring. Whatever junk does get through is still counted as a lead against some channel, and that channel then looks better than it is. What spam leads do to your marketing numbers covers what that costs.
Running Gravity Forms with Lead Source
Lead Source does not stop spam arriving through your Gravity Forms. The form is the plugin’s, and so are its fields and its submit handler. Lead Source has no code inside that form, so the honeypot and speed check above are the things doing prevention here, not us.
What it does add on the same site is the real source, the landing page and the full page journey behind every entry, on the individual lead record.
So the two problems have different answers. If your attribution is the gap, add Lead Source and keep Gravity Forms. If the spam is the gap, the fix is switching the form rather than adding a layer in front of it, because prevention has to happen in the form itself. Gravity Forms lead tracking covers the setup, and form spam protection covers what a Lead Source form does about spam.