Troubleshooting Gravity Forms Zero Spam

This guide covers the problems we see most often with Gravity Forms Zero Spam: real submissions being flagged as spam, spam report emails not arriving, and spam that still gets through.

Real submissions are being flagged as spam #

Before anything else, update to the latest version of the plugin. Several releases in the 1.7.x series each fixed a specific cause of wrongly flagged submissions (forms in modals or popups, pages with several forms, token delivery failures), so an update alone often resolves the problem.

Then let the entry itself tell you why it was flagged. Open the entry under Forms > Entries (click the “Spam” link above the list) and check the note in the Notes box. The wording points at the cause:

“The submission did not include a spam prevention token.” The plugin’s JavaScript never ran on the page, so the hidden token was not added to the submission. Common causes:

• An optimization plugin minified, combined, deferred, or delayed the plugin’s JavaScript. This is the cause we see most often when every submission is flagged. Exclude gf-zero-spam and gfZeroSpamConfig from JavaScript optimization (for example, WP Rocket’s “Delay JavaScript execution” exclusion list, or JavaScript minification in WP-Optimize), then clear the cache and submit a test.
• A consent manager or privacy browser extension blocked the script from loading.
• The form is rendered after the page loads (in a modal or popup, or output late by a page builder). Recent plugin versions handle most of these cases, so update first.
• The form is submitted through custom AJAX code that bypasses the normal Gravity Forms submission flow, so the token is never included.

“The spam prevention token has expired. This may be caused by page caching.” The visitor loaded a cached copy of the page that contained an old token. The fix is to raise the “Anti-Spam Expiration” value under Forms > Settings > Zero Spam so tokens stay valid longer than your page cache keeps pages. The default is 7 days; if your cache holds pages longer than that, increase the value to match.

The note names a different check. Zero Spam records which check flagged each entry, and other spam tools (the Gravity Forms honeypot, Akismet, Shield silentCAPTCHA, AI Spam Review) add their own notes. If the note names another tool, that tool made the call, and its settings are the place to look.

Where flagged submissions go, and how to restore one #

Flagged entries are not lost. They sit under Forms > Entries in the Spam view, and hovering an entry row shows a “Not Spam” action that restores it to the active entries.

Spam report emails are not arriving #

Report emails depend on two things working:

• WP-Cron. Reports are sent on a WordPress cron schedule. If your host disables WP-Cron or the site uses a server-side cron that is not running, reports never send.
• Email delivery. Reports go out through the same wp_mail() path as other WordPress email. The “Send Test Email & Save Settings” button on the Zero Spam settings page sends a test through that same path, so a working test email proves delivery is fine. If the test does not arrive, the site’s mail or SMTP setup is the problem, not the plugin.

Also keep in mind that a quiet period is not a failure: when there are no new spam entries in the reporting period, no email is sent by design.

Spam is still getting through #

The token check stops automated submissions that post directly to your site without running JavaScript, which is most bot traffic. Sophisticated bots that execute JavaScript can pass it. If some spam still reaches you:

• Enable AI Spam Review, which reads the content of submissions that passed the token check and flags the ones that look like spam.
• Add Shield silentCAPTCHA as an additional signal based on the visitor’s behavior.
• Zero Spam also runs alongside the Gravity Forms honeypot, Akismet, reCAPTCHA, and other spam plugins without conflict.