Contact Form 7 & spam filtering

A lot of our clients use Contact Form 7 for their contact forms. With a couple of additional plugins you can mitigate most spam and bot submissions.

First, you probably already have Akismet, you definitely do if you’re a WP Support HQ customer. If not, it’s worth getting and might be free depending on your use.

This is great because it’s already supported by Contact Form 7.

To use it you need to add the follow special tags to the From Name and From Email fields in your form.

[text* your-name akismet:author]
[email* your-email akismet:author_email]

Next we add something called a honeypot. This is a special field that normal users don’t see, but bots and other automated scripts will. If it’s filled out, then Contact Form 7 knows it was a bot or spam. I like this because it’s a user friendly way of filtering. Invisible to users actually.

Install the Honeypot Module for Contact Form 7. After you activate it, on your form edit page, add the honeypot field. It will look something like this:

[honeypot honeypot-37]

You’ll want to change the default naming to something that looks like an actual field that should be filled out. I often use “interests” or “categories”.

[honeypot interests]
After the changes for Akismet & Honeypot

That should take care of most spam and leave a good user experience. If you need or what to be more restrictive you can checkout setting up a ReCAPTCHA.

How We Manage WordPress Sites at WP Support HQ

When a new site signs up we do a number of things to make sure it’s backed up, updated, secure, and running smoothly. We think our WP management service is a great value, but we also think these are things every WordPress site should do. So for the do-it-yourselfers out there, here’s how we do today.


First thing we do is make sure there are backups so we can fix anything that might go wrong. It usually doesn’t, but a back up is nice. We use UpdraftPlus for all our backups. It’s a great plugin and stores everything to Amazon’s’ S3 storage solution for safe keeping. We configure it to automatically run every day.

Now that’s done, we see what needs updated. If the site hasn’t been updated in a while, then we need to do some research to make sure the plugins and themes will work with the latest stuff. Check the Updates screen and many plugins will state whether or not they work with the latest.

Compatibility with WordPress 4.5.3: 100% (according to its author)

For those that don’t, we find the plugin in the Plugin Directory. Checking the reviews and support tabs will usually surface any issues. If WordPress itself is really out of date, then the Directory is helpful to see if the current version is supported.

Next we check the theme. Although we don’t automatically update themes, it’s good to know if there are updates available and if they’ll work. This is something we just report on.

Next we remove any disabled plugins. They aren’t running on the site, but WordPress still loads them and they can be a security risk.

Are there any active plugins that aren’t used on the site? It’s pretty hard to tell without doing a more thorough audit. But sometimes there are obvious ones, like Hello Dolly, the sample plugin installed with WordPress. We disable and remove those too.

Next up is Akismet. Comment spam protection. If comments are turned off everywhere, then this can be removed. If comments are on and Akismet not set up with an API key, we set it up.

Anti-malware. We love the Anti-Malware Security and Brute-Force Firewall plugin and set it up next. Not only is it an amazing anti-malware scanner, it repairs issues it finds and also protects from some very common attacks, including Brute-force logins. Brute-force logins, arguably the most common way sites are hacked, are a program that just tries to guess the password by logging in over and over very fast.


To keep up on things we setup some automation. We already have the backups running every day. But what about updates and security scans?

WordPress core can automatically update itself and now that we’re starting from an up-to-date site, we make sure it does. In the wp-config.php file, we add the following if it’s not there.

define( 'WP_AUTO_UPDATE_CORE', ‘minor’ );

This allows WordPress to auto update any minor updates, this includes security fixes. We don’t enable everything in here, because major updates and plugin updates can break a site, we like to make sure that doesn’t happen.

For the rest of the updates we use MainWP. This keeps an eye on everything and lets us auto update plugins we’re confident won’t break a site. For everything else, we manually update and verify those once a month.

MainWP also includes some other great features, like fixing common security configuration problems and scanning the site with Sucuri.


Lastly we take a look at performance. The biggest things that affect performance are too many plugins, caching, and images.

We’ve already audited the plugins, but if there are still a lot, like 15 or more this could be an area of improvement.

Next is caching. Some hosting companies take care of this at the server level. For the rest a caching plugin is helpful. We use WP Fastest Cache. It’s easy to setup and works really well.

Lastly, images. Not everyone knows how to optimize images for the web, and big images can cause slowness. WP Smush will automatically optimize images and speed things back up.

Done. Almost!

With everything set up. We’re set until the next update cycle, except for one thing.

Watch for security alerts. These are usually bugs that allow attackers in so we want to catch them as soon as possible. Usually there’s an update that we can install, other times the plugin has to be disabled until an update is ready.

We hope you find this helpful to keep your site updated and secure. If you want us to handle it, you can sign up for WP Support HQ here.

Photo by Jamiecat *

Help! I’m Getting a Bunch of Contact Form Spam

You just redesigned your site, or maybe just added a new contact form to your current site, and now you’re getting a bunch of non-sense emails. Contact form spam! A lot of people default to using a CAPTCHA to fight spam, those annoying puzzle image things you hate filling out. But there’s another way, a honeypot field!

A what?

A honeypot field is a form field that scripts don’t know they shouldn’t fill out, so they do, and in doing so reveal that they are in fact a script. The great thing is that actual users don’t see them and don’t have to do any extra work to contact you!

Let’s cover two of the more common form plugins, Contact Form 7 and Ninja Forms.

Contact Form 7

You’ll need another plugin for the honeypot field. Install and activate the Contact Form 7 Honeypot plugin.

Next, edit your contact form and add the honeypot short code. I usually add it next to one of the other fields and give it a name that sounds important, like age or recommendation.

[honeypot recommendation]

Save your form!

Ninja Forms

Make sure you’re plugin is updated. That’s it!

Ninja Forms includes a honey pot field on all forms now. If you have an Anti-Spam field setup, you can remove it from your form, unless you want extra protection from scripts.

This should be a nice balance of usability for your users and little spam for you!

Photo by freezelight

Best Plugins for Improving WordPress Speed

Faster-loading websites tend to provide a better user experience. With a platform as open-ended as WordPress, sites sometimes get bogged down, which leads to slow loading times and, worse—frustrated users. Not to worry, as the WP community is prepared to tackle this problem with a host of intuitive plugins to improve WordPress speed.

Make Use of Caching with W3 Total Cache

This plugin tends to fly under the radar, but it’s great for improving the overall speed of your WordPress site. It improves a website’s load time using caching, as well as offering the ability to store information on a cloud-based server. This decreases the load on your server and greatly reduces overall loading time, thus improving the user experience.

Get Rid of Broken Links with Broken Link Checker

Have you ever visited a website, only to leave a short time later because none of the navigation links work properly? Broken links not only slow your site down, they negatively affect the user experience to a huge extent. Your SEO suffers, your users suffer—it’s an all-around bad problem to have.

But who has time to manually click on every link within your website? Thankfully, you don’t have to. Broken Link checker is a simple tool that does exactly what its name implies.

Eliminate Digital Waste with WP Smush

This is an excellent plugin that improves your site’s performance by eliminating the kind of bulky hidden information that attaches itself to images and other site features. Pages will load faster, and images will remain high-res, but the useless junk information is left out. This is a great tool for improving site speed, and thus user experience.

Want to know more about WordPress? Feel free to contact us.