Using Email Rejection Rules with Gravity Forms Zero Spam
Zero Spam can reject submissions based on the email address someone enters, either across your whole site or on one specific field. This is useful when spam keeps arriving from a particular domain, or when a business enquiry form should not accept free consumer addresses.
How the pieces fit together #
There are three settings involved, in two different places, and they stack in this order:
| Setting | Where it lives | What it controls |
|---|---|---|
| Enable Email Rejection Rules | Forms > Settings > Zero Spam | The whole feature. While it is off, no rules run anywhere |
| Rules | Forms > Settings > Zero Spam | The rules themselves. These apply to every email field on every form |
| Enable rejection rules | Form editor, on an email field, under Advanced | What that one field does differently |
Note: the per-field setting is not an on switch, and leaving it off does not exempt the field. Every email field uses your global rules unless you turn that setting on and choose to replace them.
Turn the feature on #
In your WordPress dashboard, go to Forms > Settings > Zero Spam, find the Email Rejection Rules section, and switch on Enable Email Rejection Rules. Do this before adding rules anywhere, including on individual fields.
Add a rule #
Once the feature is enabled, a Rules builder appears. Each rule has three parts: the Type, which decides how the value is matched, the Value itself, and the Action to take when an address matches. Fill those in, click Add Rule, then save the settings.
Saved rules are listed above the builder, where you can edit, disable, or remove each one. Disabling keeps a rule in the list but stops it running, which is useful while you work out whether a rule is too broad. Rules are checked in order and the first match wins, so when two rules would both catch an address, the one higher in the list decides what happens.
Rule types
| Type | What to enter | What it matches |
|---|---|---|
| Domain | spamdomain.com | Any address at that exact domain. Do not include the @ |
bob@spamdomain.com | That one address, and nothing else | |
| Wildcard | *@spamdomain.com | Anything fitting the pattern, where * stands for any characters |
| Regex | spamdomain\.(com|net) | Anything matching the regular expression |
Picking the wrong type is the most common reason a rule appears to do nothing. Email is an exact comparison, so a pattern such as *@spamdomain.com entered against it will never match. Use Wildcard for * patterns and Regex for expressions.
Note: Domain matches the domain exactly. A rule for spamdomain.com covers bob@spamdomain.com but not bob@mail.spamdomain.com. To catch subdomains as well, add a second rule of type Wildcard with the value *@*.spamdomain.com.
Actions
| Action | What happens |
|---|---|
| Block | The submission is stopped and a validation message appears on the form |
| Flag as Spam | The submission completes normally and the entry goes to Spam |
| Log Only | The submission completes normally and the entry is left alone |
Only Block is visible to the person filling in the form. With the other two the form behaves as though nothing happened, which is worth knowing when you are testing a rule and expecting to see an error.
Both Flag as Spam and Log Only add a note to the entry naming the rule that matched, the address, and the field it came from. Open the entry and read its notes to confirm a rule is working.
Note: the Block action requires Gravity Forms 2.9.15 or newer. On older versions the Action dropdown offers only Flag as Spam and Log Only.
Rules for a single field #
To change what one field does, open the form in the form editor, select the email field, and expand Advanced in the field settings.
Switching on Enable rejection rules gives you two modes:
- Inherit global rules + add field-specific rules runs your global rules first, then the extra rules you add here
- Use only field-specific rules (ignore global) runs only the rules you add here and skips the global list for this field
The second mode is the only way to make a field accept an address that the rest of your site rejects, such as an internal form that should still allow a domain you block everywhere else.
Change the message people see #
When a rule blocks a submission, the form shows the Default Validation Message from the Zero Spam settings.
To word it differently for one field, fill in the Validation Message box in that field’s settings. Leave it blank to use the default.
Add several rules at once #
To build a list quickly, click + Import Rules, paste your values one per line or separated by commas, choose the action to apply to all of them, and click Import. Each entry is detected as a domain or an email address automatically.
