內容簡介
Formsieve 是一款專為 Gravity Forms 和 Contact Form 7 設計的 AI 聯絡表單垃圾郵件過濾器，能有效阻擋手動輸入的垃圾郵件，並無需 CAPTCHA 驗證。透過本地檢查和 AI 檢查，確保只有高概率的垃圾郵件被攔截，提升表單的有效性。
【主要功能】
• 本地檢查：免費本地檢查阻擋常見機器人垃圾郵件
• AI 檢查：根據訊息內容判斷垃圾郵件
• 多層檢查：結合本地和 AI 檢查提高準確性
• 自訂設定：可依需求調整垃圾郵件判斷閾值
• 支援多表單：同時支援 Gravity Forms 和 Contact Form 7
• 學習功能：透過用戶反饋優化垃圾郵件識別
外掛標籤
開發者團隊
② 後台搜尋「Formsieve – AI Contact Form Spam Filter」→ 直接安裝（推薦）
原文外掛簡介
Formsieve is built to keep spam out of your Gravity Forms and Contact Form 7 (CF7) forms, including the sales pitches that people type or paste by hand, with no CAPTCHA for your visitors: free local checks stop common bot spam before any AI check. Honeypots and CAPTCHAs judge the visitor, so a person with a pitch gets through them. The AI check reads the message itself, so SEO offers, link building and other pitches can be caught even when a person sent them.
The AI check blocks only confident spam: a spam probability of 85% or more at the default setting (90% when the site’s first language is not English). By default, a message it is unsure about still reaches you, tagged as possible spam. Every AI decision comes with a probability, a category and a short reason.
The plugin and its local checks are free and need no key. The AI check is a service you connect with a Formsieve key: a free trial (14 days or 500 AI checks, whichever comes first; no card), then the Free plan (100 AI checks a month for one production site) or a paid plan (as of 2026-10-08; https://formsieve.com/pricing/). The AI is included, so you need no account with an AI provider.
How it works
Formsieve checks form submissions for spam in two layers. Free local checks run first on your own server. Submissions that pass them get one AI spam check from the Formsieve service, which asks TypeSafe AI’s Jev model a fixed set of questions; the plugin turns the answers into a calibrated spam probability and decides.
Local checks first, with or without a key: a honeypot, a signed time-to-submit token, a replay cache, a per-IP rate limit, allow and block lists, WordPress’s Disallowed Comment Keys, disposable e-mail domains and heuristics. What they stop needs no AI check.
One AI check for what passes them: a spam probability, a category (such as vendor solicitation or scam) and a short reason.
Three bands: allow, review and block, from presets or your own thresholds, per form if you like. Review-band submissions are delivered with a “[Possible spam 62%]” subject tag, so an uncertain lead still reaches you.
Explained: probability, category, model, request ID and latency on each entry, in Flamingo and in the log.
Fails open: by default an outage never blocks a form, and a billing state never does: the submission is delivered with a “not checked” note, or held for review if you prefer.
Learns from you: your spam and not-spam corrections teach it trusted and blocked senders (stored as hashes).
One plugin covers Gravity Forms and Contact Form 7, on the same site if you use both: it turns on a module for each form plugin that is active, with one key, one settings screen, one dashboard and one decision log.
Gravity Forms
Runs after Gravity Forms’ own honeypot and sends nothing for an entry it has flagged.
Per form: mark as spam (default), discard, or refuse with a validation error. Not Spam restores a blocked entry.
An entry panel with the verdict, Re-check and Mark spam or not spam, a sortable probability column, and entry meta for filters and exports.
Contact Form 7 and Flamingo
Adds a hidden honeypot field and a signed time-to-submit token to each form.
Uses Contact Form 7’s own spam status, spam log and spam message; mail addressed to the visitor is never tagged.
With Flamingo (recommended), spam is kept in its Spam folder with the explanation, and “Not spam” teaches the sender.
Per-form settings in a tab of the form editor, and the “formsieve: off” additional setting.
Privacy
Nothing is sent before an administrator enters a key and accepts a consent screen that names every recipient.
Never sent: the visitor’s IP address, user agent or full e-mail address, passwords, payment fields or uploads. Phone numbers are redacted by default, and sensitive fields are left out.
A one-line notice under forms (“Submissions are screened for spam by an automated AI service.”, with no product name or link), on by default once the AI check runs, off under Settings > Privacy or per form.
Privacy-policy text, personal-data export and erasure, and log retention.
What is sent, when and to whom, with the terms and privacy policies: “External services” below.
Also included
A Dashboard with your plan and the AI checks used this month; notices at 80% and 100%, on the plugin’s own screens only. An optional hourly limit of AI checks per form, to protect your allowance during a bot wave.
Test mode, WP-CLI commands and developer hooks.
Translation-ready: translations come from translate.wordpress.org.
Requirements
WordPress 6.6 or later and PHP 7.4 or later, with Gravity Forms 2.9 or later, Contact Form 7 6.0 or later (Flamingo recommended), or both.
Documentation and support
Documentation: https://formsieve.com/docs/
Questions about the plugin: the support forum here on WordPress.org.
Questions about your account, plan or invoices: [email protected] (https://formsieve.com/support/). Never post your key in a public forum.
External services
Formsieve uses one external service, for its AI check: the Formsieve spam-check service at https://api.formsieve.com, run by Thinking42, Inc. (USA). It needs a key (a free trial, the Free plan or a paid plan: https://formsieve.com/pricing/). The local checks need no service.
When: never before an administrator enters a key and accepts the notice in the set-up wizard or on the settings screen. Then: once for each submission that passes the local checks (each form can be switched off); when you save a key (to verify it) or click Test connection (a sample, no form data); when you open the Dashboard (plan and usage, at most every 15 minutes); once a day (key, plan, usage and this site’s slot); and when you disconnect the key or delete the plugin (to free this site’s slot). Test mode sends nothing.
What each check sends: the site name, the form name, the site and form descriptions you write, the site languages, the label, type and value of the submission’s ordinary fields (phone numbers redacted by default; passwords, payment, identity-document and health fields excluded automatically; any field can be excluded; values capped), the sender’s e-mail domain (optional), signals computed on your server (the number of links and their host names, whether a phone number is present, the time taken to submit, the number of submissions from the same IP address in the last hour, the writing systems used, the message length, and whether you marked the sender as spam or not spam before), your key, this site’s address and environment (production, staging or development), and which form plugin handled the submission (for example “gf” or “cf7”). The key calls send your key, this site’s address and environment and which form plugins are active, and no form data. Every call carries the plugin, WordPress and PHP versions. Never sent: the visitor’s IP address, user agent or full e-mail address, passwords, uploads, payment fields or the plugin’s own hidden fields.
Where it goes: Thinking42 runs the service on Amazon Web Services, Inc., behind Cloudflare, Inc. It sends the content, with fixed questions, to TypeSafe AI, Inc.’s Jev model through OpenRouter, Inc. (all US companies; Cloudflare runs a global network, and OpenRouter does not promise to handle a request only in the USA, as of 2026-10-08) and returns the answers; the plugin computes the spam probability on your server. Thinking42 does not store the content of submissions; it keeps request records without the content (such as the time, key and site identifiers, status, timing and the spam band of the result) for 30 days (as of 2026-09-25).
Formsieve (Thinking42, Inc.): https://formsieve.com – Terms: https://formsieve.com/terms/ – Privacy policy: https://formsieve.com/privacy-policy/ – Data Processing Agreement: https://formsieve.com/dpa/ – Sub-processors: https://formsieve.com/subprocessors/
OpenRouter, Inc.: Terms: https://openrouter.ai/terms – Privacy policy: https://openrouter.ai/privacy
TypeSafe AI, Inc.: Terms: https://typesafe.ai/legal/terms – Master customer agreement: https://typesafe.ai/legal/mca – Privacy policy: https://typesafe.ai/legal/privacy-policy
Credits
Admin fonts in assets/fonts/, under the SIL Open Font License 1.1, so no font is loaded from another site: Unbounded (Copyright 2022 The Unbounded Project Authors), DM Sans (Copyright 2014 The DM Sans Project Authors) and IBM Plex Mono (Copyright 2017 IBM Corp., with Reserved Font Name “Plex”). Sources: assets/fonts/README.txt.
Disposable e-mail domain list: https://github.com/disposable-email-domains/disposable-email-domains (CC0 1.0), copied 2026-09-22.
Composer class loader (MIT licence).
Disclaimer
Formsieve is an independent product of Thinking42. It is not affiliated with, endorsed by, or sponsored by TypeSafe AI, Inc., Rocketgenius, Inc., or Rock Lobster Inc. TypeSafe and Jev are trademarks of TypeSafe AI, Inc. Gravity Forms is a registered trademark of Rocketgenius, Inc. Contact Form 7 is a registered trademark of Rock Lobster Inc. WordPress is a registered trademark of the WordPress Foundation. All other names are used only to identify compatibility.
