This was written by one of my colleagues for a license holder experiencing the same issue as you:
Spammers have been more active lately in general, the dramatic shift is not really explainable and there isn’t really any correlation from reports we’ve received in the types of spam and their methods, it is likely just a new wave of spammers hitting your site over a short amount of time and likely received positive feedback from their spam going through signaling that your site is currently vulnerable to it.
If current spam counter measures are not performing as they were or you’re receiving a higher volume of attempted spam (based on your description it is most likely the latter) you will need to add more robust spam prevention solutions. The honeypot will only catch very simple automated spam, it is the bare minimum you can use to prevent spam and will only catch fully automated spam. With the recent uptick in spamming it has been common for these to beat reCAPTCHA and the honeypot usually meaning it is manually done in some way, so most automated tools will not be a catchall solution as spamming tactics become more advanced.
Here are few additional measures you can take ranging from less extreme to more extreme, usually a combination of a couple will stop most spam from being submitted:
Enable the Akismet integration on the Forms > Settings page when Akismet is active. This will pass all entered data through Akismet’s spam filter. I see you already have Akismet installed, so if you’re currently using it I would recommend enabling the integration on the Forms > Settings page and if that is already active you should consider increasing the strictness of Akismet’s spam filtering.
You could use the following third-party perk from Gravity Wiz to set up a list of blacklisted keywords using WordPress’ commenting blacklist if the spam has any sort of common keywords: https://gravitywiz.com/documentation/gravity-forms-blacklist/
Especially if the spam is coming from a foreign country most of the time, you could use Cloudflare to set up more nuanced firewall rules at a server level to stop the spammers from reaching the site entirely.
Require your users to log in before they can submit any forms.
I hope some of these issues will help prevent spam submissions on your site.
I’ve combined a couple of methods that was suggested on your colleagues post.
I have reCaptcha fields on my Gravity Form and have purchased a plan with Akismet and then integrated it with the form.
My client is still receiving spam emails.
Is there something I missed? What else should I be checking? Can you help me move forward?
Hello Jaime. I don’t have an update on a timeline. The product team is focused on the Gravity Forms 2.5 release now and this has not been added yet. Thank you for checking.
I have the same problem. Client is getting very upset. Please don’t make me move to a different form. I suggest Gravity Forms make this a priority or they will be losing customers.
Just got penalized by my host because too much spam was coming through the forms, even though v2 is installed.
I’ve been using v3 with other sites for quite some time and never had an issue. Is it really that difficult to implement it while others have it? I didn’t pick the plugin and we need some of its functionality, but if I can’t stop spam with v3 then it’s becoming more difficult to justify GF.
I’m not going to ask users to log in, I won’t block counties through Cloudflare on an international site and I won’t use yet another plugin to get a functionality that other forms have built in. Come on, these are not good solutions that you’ve mentioned above.
I recommend that anyone passionately interested in seeing reCAPTCHA v3 support in Gravity Forms add a note for our product team to our product roadmap: Click the blue in the lower left on this page to add a note for our product team:
It’s important that the product team hear from everyone regarding the individual stories and use cases and requirements. Thank you.
Just submitted again. The spam coming into v2 recaptcha is pretty wild the last few months, even with honey pot enabled. The only solution at the moment to prevent it we have found is to integrate CleanTalk premium, which has helped. Odd that v3 isn’t something important just yet as all the other major form plugins have already set up this feature.
Still using ReCaptcha v3 instead of v4. Curenlty working on blog about employee monitoring software and v4 can not detect bots at all! Hope developers of v4 will their best to fix it…
Hi @cnymike and @here - I heard recently that GravityView (one of our certified add-on developer partners) acquired the Gravity Forms Zero Spam plugin, so that’s in good hands now. I don’t get enough spam to warrant using that or to even report back on its effectiveness, but maybe this will be a good solution for someone?