Using AI Spam Review with Gravity Forms Zero Spam

Gravity Forms Zero Spam blocks most spam with its invisible token check before AI is ever involved. AI Spam Review is an optional layer on top of it, with two separate tools:

Catch spam the token check misses. After a submission passes the normal spam checks, AI reads its content and flags it as spam if it looks suspicious.
Rescue good submissions blocked by mistake. If the token check blocks a submission but the content looks genuine, AI can let it through. Only submissions blocked by Zero Spam’s own token check are eligible, and rescue runs during submission, before notifications are sent, so a rescued entry arrives like any normal one.

Both tools are off by default. Nothing is sent to an AI service until you turn them on.

Requirements and setup #

AI Spam Review needs WordPress 7.0 or newer with an AI service connected. WordPress 7.0 stores AI credentials centrally under Settings > Connectors, where you can connect OpenAI, Anthropic, or Google. Once a connector is set up, it is shared by every plugin on the site that uses AI.

With a connector in place, go to Forms > Settings > Zero Spam and scroll to the “AI spam protection” section. Turn on either or both tools, and optionally edit the AI instructions, which tell the AI what counts as spam on your site. The default instructions work well for most sites.

AI spam protection settings with both tools enabled and the default AI instructions visible

How confident the AI must be #

The “Advanced AI settings” section controls the confidence the AI must report before Zero Spam acts on its verdict. Both selects default to “Balanced”. Stricter options flag fewer real submissions but let more spam through; for rescue, more cautious options are available because a restored submission cannot be un-restored.

Advanced AI settings with confidence levels for flagging spam and rescuing blocked submissions

Per-form control #

Each form’s settings include the same two toggles in the Spam Detection section, along with three form-level options:

AI instructions for this form. Overrides the global instructions for this form only; leave blank to use the global ones.
Skip these fields. The selected fields are left out of the content the AI reviews. Use this for fields that collect sensitive data.
Limit AI checks per hour. Caps how many of the form’s submissions are sent to the AI each hour, to control usage. 0 means no limit.

Per-form AI settings with instructions, skipped fields, and an hourly limit

Note: The “Prevent spam using Gravity Forms Zero Spam” setting on the same screen is the master switch: when it is off for a form, AI Spam Review is off for that form too, along with every other Zero Spam check.

What the AI sees #

When a submission is reviewed, the plugin sends the form title, the page path the entry came from, and the form’s field labels, field types, and submitted values, together with your instructions. Before anything is sent, email addresses in the content are masked so only the domain remains, fields you selected under “Skip these fields” are removed, and the content is length-capped. The AI returns a classification, a confidence value, and a short reason; it does not rewrite the message.

Entries flagged by AI land in the Spam view under Forms > Entries with a note from “Zero Spam (AI)” that includes the AI’s short reason for the classification, so you can always see why an entry was flagged.

Usage and cost #

Every reviewed submission is one request to your connected AI service, billed by that provider under your account with them. Two things keep usage bounded: the tools only review submissions in their specific situations (passed checks for catching, token-blocked submissions for rescue), and the per-form hourly limit caps volume. If a broken page floods you with token failures while rescue is on, the hourly limit is the control to reach for.