How Gravity Forms Zero Spam works (and how to test it)

Gravity Forms Zero Spam blocks automated spam without showing your visitors anything: no CAPTCHA, no checkboxes, no puzzles. This page explains the mechanism, what the plugin deliberately does not do, and how to test that it is working on your site.

The invisible token check #

When a visitor loads a page with a form, the plugin issues a signed, time-limited token and its JavaScript adds that token to the form as a hidden value at submission time. When the form is submitted, the plugin checks the token on the server. A submission with a missing, expired, or invalid token is marked as spam. If real submissions on your site are being flagged, Troubleshooting Gravity Forms Zero Spam walks through the causes.

This works because most spam bots do not behave like browsers: they post data directly to your site without loading the page and running its JavaScript, so they never pick up a token. Real visitors in real browsers pass the check without noticing it exists. The token contains only the form ID, timestamps, and random values; the plugin sets no cookies and adds no visible fields.

What Zero Spam does not do #

• It does not read the content of submissions. The token check is purely mechanical; a message is never flagged because of the words in it. (The optional AI Spam Review feature is the exception, and it is off by default.)
• It does not learn. Marking entries as spam or not spam does not train the plugin or change future decisions.
• It does not send your form data anywhere. The token check runs entirely on your own server. Spam report emails contain per-form counts, not submission content.

Why your own tests are not flagged #

Zero Spam deliberately skips some submissions, and this is the most common reason a test “fails”:

• Logged-in users who can edit entries (administrators and editors testing their own forms) bypass the check entirely.
• Form preview submissions are not checked.
• Entries created through the Gravity Forms API are not checked, so imports and integrations keep working.

So if you submit your own form while logged in as an administrator and it goes through, that is the exemption working, not the spam check failing.

How to test it properly #

The check catches clients that do not run JavaScript, so that is what you simulate:

1. Log out of WordPress (or use a private browser window where you are not logged in).
2. Submit the form normally. It should go through and appear under Forms > Entries.
3. Now disable JavaScript in your browser’s settings or developer tools, reload the page, and submit the form again.
4. This submission should be flagged: it appears under the “Spam” link above the entries list, with an entry note explaining that no spam prevention token was included.

Re-enable JavaScript afterwards, and use “Not Spam” on the test entry if you want to restore it.

What gets through, and what to add #

Bots that drive a real browser and execute JavaScript can pass the token check. If that kind of spam affects your forms, the plugin has two optional layers on top of the token check: AI Spam Review, which reads submissions that passed and flags the ones that look like spam, and the Shield silentCAPTCHA integration, which adds a behavior-based bot verdict. Zero Spam also runs cleanly alongside the Gravity Forms honeypot, Akismet, reCAPTCHA, and other anti-spam plugins.