Formsieve filters spam in Gravity Forms in two layers. Local checks run first on your own server, after the Gravity Forms honeypot: a signed time-to-submit token, a replay cache, a per-IP rate limit, allow and block lists, WordPress’s Disallowed Comment Keys and disposable e-mail domains. Each entry that passes them gets one AI check from the Formsieve service, which returns a spam probability, a category (such as vendor solicitation or scam) and a short reason.
Because the AI check reads the message itself, sales pitches typed by a person can be caught as well as bots. There is no CAPTCHA.
- Uses Gravity Forms’ own spam handling. Per form: mark as spam (the default), discard, or refuse with a validation error. Not Spam restores an entry.
- Sends nothing for an entry that the Gravity Forms honeypot has already flagged.
- Three bands, allow, review and block, from presets or your own thresholds, per form if you like. Entries in the review band are delivered with a “[Possible spam 62%]” tag in the notification subject.
- An entry panel with the verdict, Re-check and Mark spam or not spam, a sortable probability column, and entry meta for filters and exports.
- Fails open: by default an outage never blocks a form, and a billing state never does.
- Nothing is sent before an administrator enters a key and accepts a notice that names every recipient. Never sent: the visitor’s IP address or full e-mail address, passwords, payment fields or uploads. The plugin’s readme lists what is sent, when and to whom, under “External services”.
The plugin and its local checks are free (GPL). The AI check needs a Formsieve key: a free trial of 14 days or 500 AI checks, whichever comes first (no card), then the Free plan of 100 AI checks a month for one production site, or a paid plan from $49 a year (as of 2026-10-09; https://formsieve.com/pricing/).
Formsieve is made by Thinking42, Inc. It is not affiliated with, endorsed by, or sponsored by Rocketgenius, Inc. Gravity Forms is a registered trademark of Rocketgenius, Inc.