Anti-Spam Settings
Anti-Spam settings are organized into three panels: reCAPTCHA v3 Settings, Honeypot Field Settings and Blacklist — three layers of protection against bot submissions.
reCAPTCHA
Enable reCAPTCHA
A dropdown selecting how reCAPTCHA works:
- Disabled: reCAPTCHA off.
- reCaptcha v2: shows the "I'm not a robot" checkbox requiring explicit user verification.
- reCaptcha v3: invisible verification scoring user behavior automatically — the default.
Getting keys
To use reCAPTCHA (v2 / v3), sign up for an API key pair for your site — it consists of a site key and a secret.
Domain
The service domain the reCAPTCHA script loads from:
- www.google.com: default.
- www.recaptcha.net: Google's mirror domain, for networks where www.google.com is unreachable.
Site key
The site key used in the code your site serves to users.
Secret key
The key for communication between your site and Google — keep it a secret.
Captcha Score (v3 only)
The minimum score threshold for reCAPTCHA v3, range 0.1 ~ 1, default 0.5. Requests scoring below the threshold are rejected. The smaller the value, the looser the restriction — lower it slightly if legitimate users get blocked.
Theme (v2 only)
The v2 widget's color theme: light (default) / dark.
Type (v2 only)
The type of CAPTCHA v2 serves: image (default) / audio — helpful for visually impaired users.
Size (v2 only)
The v2 widget's size: normal (default) / compact.
Honeypot Field
Enable Honeypot Field
When enabled, invisible "honeypot" fields are injected into the form. Bots tend to fill every field and expose themselves; real users never touch them. Honeypot verification does not affect the user experience and also prevents duplicate submissions.
History
The hidden-field verification in early versions was replaced by the honeypot mechanism and blacklist rules in 8.9.
Blacklist
Enable Blacklist
When enabled, submissions are blocked by the three blacklists below. Available since 8.9.
Email Blacklist
Submissions from email addresses on the list are blocked — fill in one mailbox per line.
The external link of the email blacklist
Pulls the email blacklist from an external URL and merges it with the local list, for example:
https://www.dnngo.net/blacklist/mail.txtIP Blacklist
Submissions from IP addresses on the list are blocked, one IP per line.
The external link of the IP blacklist
Pulls the IP blacklist from an external URL, e.g. https://www.dnngo.net/blacklist/ip.txt.
Keywords Blacklist
Submissions containing keywords on the list are blocked, one keyword per line — ideal for common spam promotion words.
The external link of the keywords blacklist
Pulls the keyword blacklist from an external URL, e.g. https://www.dnngo.net/blacklist/keywords.txt.
TIP
With external links, multiple sites can share one centrally maintained blacklist file (a plain .txt works) — no manual updates in each admin.
Recommended Combinations
| Scenario | Recommendation |
|---|---|
| Ordinary contact form | reCAPTCHA v3 + honeypot field |
| Heavy spam pressure | reCAPTCHA v2 (checkbox) + honeypot + keyword blacklist |
| Prefer no Google service | Honeypot + email/IP/keyword blacklists |
| google.com unreachable | reCAPTCHA (Domain set to www.recaptcha.net) + honeypot |
Next Steps
- General Settings — Prompt Already Submitted
- FAQ — anti-spam FAQ