Title: FormGhost
Author: byabdalla
Published: <strong>17 di Setembar dal 2026</strong>
Last modified: 23 di Setembar dal 2026

---

Search plugins

![](https://ps.w.org/formghost/assets/banner-772x250.png?rev=3701068)

![](https://ps.w.org/formghost/assets/icon-256x256.png?rev=3701068)

# FormGhost

 By [byabdalla](https://profiles.wordpress.org/byabdalla/)

[Download](https://downloads.wordpress.org/plugin/formghost.1.2.5.zip)

 * [Details](https://fur.wordpress.org/plugins/formghost/#description)
 * [Reviews](https://fur.wordpress.org/plugins/formghost/#reviews)
 *  [Installation](https://fur.wordpress.org/plugins/formghost/#installation)
 * [Development](https://fur.wordpress.org/plugins/formghost/#developers)

 [Support](https://wordpress.org/support/plugin/formghost/)

## Description

**The spam never happened.** FormGhost is a privacy-first WordPress antispam plugin
that makes spam quietly disappear: bots are shown a fake success page and walk away
believing they got through, while you never receive a thing. No CAPTCHA is shown
unless you choose to add one, no data leaves your server, and what FormGhost keeps
stays in your own database: held submissions encrypted for a limited time, IP addresses
only as irreversible hashes. Spam goes into the Vault. Real users never see anything.

**Every feature is free. There is no Pro version, no license key, no upsell.**

#### Why FormGhost

 * No CAPTCHAs. No “select all the buses.” No “I’m not a robot” checkbox.
 * No cloud dependency — the spam detection itself makes no external HTTP calls.
   The only optional exceptions (CAPTCHA verification, MX lookup) are off by default
   and documented under External services.
 * GDPR / DSGVO friendly. IP addresses are hashed with a per-site secret before 
   storage. Form payloads are encrypted (AES-256-GCM) in the vault.
 * Ghost Response: bots see a fake success message and walk away thinking the submission
   worked. You never get the email.
 * Blocked something legitimate? Open it in the Vault and forward it to the inbox
   it was headed to in a couple of clicks.

#### How it works

Every submission is checked by up to nine independent layers, plus an identity check
that notices one mailbox sending under many names. Each layer adds to a spam score.
A score of 50 or more is held, and a filled-in honeypot is held straight away. FormGhost
then usually answers with a silent Ghost Response, so the bot never learns it was
blocked.

 1.  **Honeypot** — Daily-rotated, site-suffixed hidden fields. Different on every 
     FormGhost site; resistant to “fill every field” bots.
 2.  **Timing** — Encrypted submission timestamp. Submissions that arrive too fast (
     or with a replayed token) fail this layer.
 3.  **Proof-of-Work** — Lightweight browser challenge solved by a WebWorker. Stops
     curl / wget / scripted submissions cold.
 4.  **Behavioral fingerprint** — Mouse curvature, keystroke variance, scroll, focus
     and touch signals computed entirely in the browser. Only the resulting score is
     transmitted.
 5.  **Rate limiting** — Per-IP limits for each kind of form (contact forms, comments,
     registration, WooCommerce, password reset) within a time window, a separate failed-
     login limit per account and per IP address, and whitelisting of single IPs or 
     CIDR ranges.
 6.  **Disposable email detection** — Curated disposable-domain blocklist (extensible
     with your own block/allow lists), optional MX heuristic.
 7.  **Content patterns** — Casino / SEO / pharma phrase detection with a self-learning
     twist.
 8.  **WordPress hardening** — Disable XML-RPC, harden the REST users endpoint, generic
     login errors, optional Application Passwords lockdown.
 9.  **Optional CAPTCHA** — Turnstile / hCaptcha / ALTCHA on the core WordPress forms
     you choose (comments, login, registration, password reset) if you want a visible
     challenge as a last line of defence. Off by default.

#### Form plugin compatibility

Built-in adapters for:

 * WordPress core comments, login, registration, password-reset
 * Contact Form 7
 * WPForms
 * Gravity Forms
 * Elementor Pro Forms
 * WooCommerce checkout & registration
 * Fluent Forms
 * Ninja Forms
 * Formidable Forms
 * Forminator
 * HTML Forms
 * Jetpack Forms
 * Bricks Builder forms
 * Kadence Blocks forms
 * Divi contact forms
 * BuddyPress signup & activity
 * bbPress topics & replies

Custom forms POSTing to `wp-admin/admin-post.php` or `wp-admin/admin-ajax.php` are
picked up automatically by the generic adapter.

#### The Vault

Blocked submissions are stored encrypted for 30 days (configurable). Review them
in the admin: see what was blocked, which page it was submitted from, and which 
inbox the notification was headed to. Mark false positives as legitimate and forward
them by email in a couple of clicks — the sender’s address becomes the Reply-To,
so answering in your mail client reaches the person who filled the form. The forwarded
email treats the submission as untrusted: links and addresses in it are broken up
so they cannot be clicked by accident. Passed (legitimate) submissions are logged
too, so you can audit both sides of every decision.

#### Self-learning

When you mark a Vault entry as “spam” the engine extracts the sender’s address, 
the email domain, the domains of links in the message and distinctive phrases (and
the hashed IP address), and stores them in a learned-rules table with a score modifier.
Marking an entry as legitimate does the opposite: that sender and the matching signals
get negative weights. Future submissions matching those signatures get extra points,
automatically. Auto-confirmed rules from repeat offenders are added too. Decay over
time keeps the rule set fresh. Review, re-weight, deactivate or delete every learned
rule from the Learned Rules screen.

#### Privacy

 * The nine detection layers, the Vault and the self-learning system run entirely
   on your server. Two optional, off-by-default features talk to the outside: CAPTCHA
   verification (Cloudflare Turnstile / hCaptcha) and the DNS MX check — see “External
   services” below.
 * IPs are stored only as `sha256(site_secret + "|" + ip)` and cannot be recovered.
 * Vault payloads are encrypted at rest with AES-256-GCM (authenticated encryption).
 * Uninstalling the plugin removes every option, every table and every cron event.
   Nothing is left behind.

### External services

FormGhost’s spam detection runs entirely on your own server. Two optional features,
both **off by default**, connect to third parties. Nothing is sent unless you enable
them in the settings.

**Cloudflare Turnstile** (Layer 9, optional CAPTCHA provider)
 When you enable the
CAPTCHA layer with Turnstile for a form, the plugin renders the widget container
on that form (you add Cloudflare’s widget script `https://challenges.cloudflare.
com/turnstile/v0/api.js` to your site yourself — the plugin does not load any vendor
script), and on every submission of that form the plugin sends the widget’s response
token, your Turnstile secret key and the visitor’s IP address to `https://challenges.
cloudflare.com/turnstile/v0/siteverify` to verify the challenge. Terms: https://
www.cloudflare.com/terms/ — Privacy: https://www.cloudflare.com/privacypolicy/

**hCaptcha** (Layer 9, optional CAPTCHA provider)
 When you enable the CAPTCHA layer
with hCaptcha for a form, the plugin renders the widget container on that form (
you add hCaptcha’s widget script `https://js.hcaptcha.com/1/api.js` to your site
yourself — the plugin does not load any vendor script), and on every submission 
of that form the plugin sends the widget’s response token, your hCaptcha secret 
key and the visitor’s IP address to `https://api.hcaptcha.com/siteverify` to verify
the challenge. Terms: https://www.hcaptcha.com/terms — Privacy: https://www.hcaptcha.
com/privacy

**ALTCHA** (Layer 9, optional CAPTCHA provider) is self-hosted: the challenge endpoint
and the verification run on your server (`admin-ajax.php?action=formghost_altcha_challenge`);
no data is sent anywhere. You add the ALTCHA widget script to your site yourself.

**DNS MX lookup** (Layer 6, optional “Check MX records” setting)
 When enabled, 
the plugin asks your server’s DNS resolver for the MX records of the submitted email
address’s domain (PHP `getmxrr`). This is a standard DNS query from your server,
not a request to a third-party API; the email address itself is not transmitted,
only its domain.

### Privacy

FormGhost is designed for privacy-conscious operators.

**Data stored on your server.**

 * `{prefix}formghost_vault` — form submissions FormGhost held (and, if “Store passed
   submissions” is on, the ones it let through), encrypted with AES-256-GCM using
   the per-site secret; encryption is on by default and can be switched off in Settings.
   Each entry also records, unencrypted: the sender’s email domain, the page the
   form was submitted from, the inbox it was headed to, and keyed hashes of the 
   IP address, browser, sender address and sender name — never the address or IP
   itself. Configurable retention (default 30 days, at most 10,000 entries). Removed
   on uninstall.
 * The Vault currently also keeps FormGhost’s own technical fields that arrive with
   a submission — the behavior score and its one-time nonce, and the CAPTCHA response
   token when a CAPTCHA was used. They carry no personal data, are hidden from forwarded
   emails, and a future release will stop storing them.
 * `{prefix}formghost_learned_rules` — score modifiers learned from your reviews
   and from spam FormGhost caught on its own (honeypot, proof-of-work, bot checks).
   A rule may hold the sender email address of such a submission, or an IP address
   stored only as `sha256(site_secret + "|" + ip)`. Rules decay when stale and can
   be deleted from the Learned Rules screen. Removed on uninstall.
 * `{prefix}formghost_log` — one row per decision (blocked / passed, layer, form
   type) for the dashboard, with a hashed IP address. Purged on the Vault retention
   schedule. Removed on uninstall.
 * `{prefix}formghost_counters` — failed-login counters for the login rate limit,
   keyed by keyed hashes of the IP address and of the account; no address, username
   or password is stored. Each counter lapses after its window (15 minutes by default)
   and old rows are purged daily. Removed on uninstall. Rate-limit counts for other
   forms are kept in short-lived WordPress transients under hashed keys.
 * `formghost_site_secret` (option) — 64-char random secret used for IP / UA hashing,
   payload encryption and CSS class derivation. Removed on uninstall.

**Data sent off your server.** None by default. Only the optional services listed
under “External services” send anything, and only after you enable them.

**Cookies.** FormGhost does not set cookies.

For full source, audit, and integration docs, see https://byabdalla.com/lab/formghost.

## Screenshots

[⌊The Dashboard — blocked and passed counts, layer breakdown, recent activity.⌉⌊
The Dashboard — blocked and passed counts, layer breakdown, recent activity.⌉[

The Dashboard — blocked and passed counts, layer breakdown, recent activity.

[⌊The Vault — blocked, ghosted and passed submissions with the page they came from,
the inbox they were headed to and whether they were delivered; forward a false positive
to that inbox.⌉⌊The Vault — blocked, ghosted and passed submissions with the page
they came from, the inbox they were headed to and whether they were delivered; forward
a false positive to that inbox.⌉[

The Vault — blocked, ghosted and passed submissions with the page they came from,
the inbox they were headed to and whether they were delivered; forward a false positive
to that inbox.

[⌊Settings — choose exactly where FormGhost runs; every layer is tunable.⌉⌊Settings—
choose exactly where FormGhost runs; every layer is tunable.⌉[

Settings — choose exactly where FormGhost runs; every layer is tunable.

[⌊Learned Rules — what FormGhost learned from your reviews and from spam it caught
on its own; adjust or switch off any rule.⌉⌊Learned Rules — what FormGhost learned
from your reviews and from spam it caught on its own; adjust or switch off any rule
.⌉[

Learned Rules — what FormGhost learned from your reviews and from spam it caught
on its own; adjust or switch off any rule.

[⌊The wp-admin dashboard widget — key numbers right after login.⌉⌊The wp-admin dashboard
widget — key numbers right after login.⌉[

The wp-admin dashboard widget — key numbers right after login.

## Installation

 1. Upload the `formghost` folder to `wp-content/plugins/` (or install through the 
    Plugins screen).
 2. Activate FormGhost on the Plugins screen.
 3. Run the one-time wizard that appears on activation — toggle the surfaces to protect
    and pick a sensitivity profile; FormGhost sets timing, proof-of-work and detection
    sensitivity to match.
 4. Done. Real users keep submitting; bots stop arriving.

## FAQ

### Is FormGhost really completely free?

Yes. All nine layers, the Vault, the self-learning system, Ghost Response — everything
ships in the free plugin. There is no Pro tier and no license key.

### Will it break my real forms?

No. FormGhost is invisible — no CAPTCHA, no extra fields visible to humans, no JavaScript
prompts. The honeypot fields are hidden via multiple CSS techniques and `aria-hidden`.
The timing token and proof-of-work fields are injected by JavaScript with no UI 
footprint.

### Does it work without JavaScript?

Partly. The WordPress comment, login, registration and password-reset forms work
without JavaScript as long as “Allow visitors without JavaScript” is on (the default).
Forms from form plugins need JavaScript: FormGhost adds its checks to them with 
JavaScript, so a submission without it looks like a bot and is held. Turning the
setting off makes the core forms strict too.

### Does it send data to your servers?

No — FormGhost has no servers of its own and its spam detection never leaves your
site. The only outbound calls the plugin can make are the optional, off-by-default
Turnstile / hCaptcha token verification and the DNS MX lookup, both described under“
External services” below.

### How does the wizard configure my site?

Choose which surfaces to protect (comments, login, registration, contact forms, 
WooCommerce, password reset) and a sensitivity profile — Low, Medium or High. FormGhost
applies a curated recipe of timing thresholds, proof-of-work difficulty and pattern
aggressiveness. You can fine-tune everything afterwards in Settings, and re-run 
the wizard any time.

### I marked a legitimate submission as blocked. What now?

Open the Vault, click **Legit** on the entry, then **Send** and **Send email** to
forward it to the inbox it was originally headed to. FormGhost learns from your 
correction: that sender’s address and the matching domains and phrases get negative
weights, so similar messages are less likely to be held.

### Can I see why a submission was held?

Yes. The Vault detail view shows the score, the layer that held it and its reason
code, the page the form was submitted from, and the inbox the notification was headed
to.

### Does it work with caching plugins?

Yes. The honeypot CSS is inline, and the timing token, proof-of-work challenge and
Behavioral layer nonce are fetched fresh from a no-cache endpoint when the page 
loads, so cached pages still work. Heavy page caching does not weaken FormGhost.

### Is it compatible with WP Rocket / W3 Total Cache / Cloudflare?

Yes. Everything that must be fresh is fetched after the page loads, and the plugin
sends `nocache_headers()` on its own AJAX endpoint. On a Cloudflare-fronted site,
also see the rate-limit question below.

### How do I switch FormGhost off if I cannot log in?

Add this line to `wp-config.php`, above the line that says “That’s all, stop editing!”:

    ```
    define( 'FORMGHOST_DISABLE', true );
    ```

FormGhost then does nothing at all — no checks, no scripts, no hooks — while staying
activated, so your settings are kept. Log in, fix the setting that caused the problem,
and remove the line to switch FormGhost back on.

### Why does the login CAPTCHA let some logins through unchecked?

On the login form the CAPTCHA is a bot deterrent, not an authentication control.
If it cannot be checked — the widget did not load, the provider could not be reached,
or it rejected your secret key — FormGhost lets the login continue instead of locking
you out of your own site. Every other FormGhost check and the login rate limit still
apply to that attempt, so a bot that simply leaves the CAPTCHA out gains nothing
it could use against an account it does not already have the password for. A token
the provider actually rejects still blocks the login. When a successful login gets
through unchecked, or the provider cannot be reached, or your secret key is rejected,
FormGhost shows an admin notice so a broken setup does not go unnoticed. Comments,
registration and password reset do not fail open.

### How does the login rate limit work?

Only failed logins count. By default, one IP address can fail 10 times on the same
account, and 30 times across all accounts, within 15 minutes. After that FormGhost
blocks further login attempts from that address until the 15 minutes are up — the
correct password included, so a password-guessing bot gets nowhere. A successful
login clears that account’s failures, so someone who mistypes a few times still 
gets in. Developers can change the numbers with the `ratelimit_limits` setting.

### My site is behind Cloudflare. Does the rate limit lock out everyone at once?

Not on Cloudflare. With “Trust reverse-proxy headers” off, WordPress sees Cloudflare’s
addresses instead of your visitors’, and many visitors share each one. FormGhost
recognises Cloudflare’s published addresses and uses the visitor address Cloudflare
reports for the login rate limit, so one person’s typos do not lock others out. 
Behind other proxies — nginx, a load balancer, Docker — FormGhost cannot safely 
trust the forwarded address on its own, so everyone behind the proxy shares one 
limit until you act. In both cases wp-admin shows a notice: turn on “Trust reverse-
proxy headers” under FormGhost  Settings  General, which also lets every other check
tell your visitors apart.

### Where are blocked submissions stored?

In a `{prefix}formghost_vault` table you control, encrypted with AES-256-GCM against
a per-site secret stored in `formghost_site_secret`. Default retention is 30 days;
configurable; uninstall removes the table entirely.

### I run a forum / membership / e-commerce site — what do you recommend?

Run the wizard once and enable the registration / WooCommerce scopes that match 
your attack surface, with the Medium sensitivity profile. Layers 4 (Behavioral),
5 (Rate limit) and 6 (Email) add the most uplift against modern bots and are on 
by default.

## Reviews

There are no reviews for this plugin.

## Contributors & Developers

“FormGhost” is open source software. The following people have contributed to this
plugin.

Contributors

 *   [ byabdalla ](https://profiles.wordpress.org/byabdalla/)

[Translate “FormGhost” into your language.](https://translate.wordpress.org/projects/wp-plugins/formghost)

### Interested in development?

[Browse the code](https://plugins.trac.wordpress.org/browser/formghost/), check 
out the [SVN repository](https://plugins.svn.wordpress.org/formghost/), or subscribe
to the [development log](https://plugins.trac.wordpress.org/log/formghost/) by [RSS](https://plugins.trac.wordpress.org/log/formghost/?limit=100&mode=stop_on_copy&format=rss).

## Changelog

#### 1.2.5

 * **Fixed a lockout.** If you had switched on the optional CAPTCHA, FormGhost rejected
   every login and comment — including your own login with the correct password.
   The CAPTCHA answer is now read correctly on every form that uses it (login, comments,
   registration, password reset).
 * The login page can no longer lock you out because of the CAPTCHA. If the CAPTCHA
   widget does not load, the CAPTCHA service cannot be reached, or your secret key
   is wrong, the login goes ahead (every other check still applies) and wp-admin
   warns you instead. A CAPTCHA answer that is actually wrong still blocks the login.
   Comments, registration and password reset stay strict.
 * New wp-admin warning when the login CAPTCHA could not do its job in the last 
   7 days: how many logins, since when and why. You can dismiss it; it comes back
   if it happens again. Bots that skip the CAPTCHA and fail to log in are logged
   but do not trigger it.
 * When FormGhost blocks a login, the message now says so instead of claiming your
   password was wrong. It reads the same whether or not the password was right, 
   so it gives an attacker nothing.
 * Reworked login rate limit: only failed logins count — by default 10 per account
   and 30 per IP address in 15 minutes — and a successful login clears your own 
   mistakes, so a few typos no longer lock you out while password guessing is still
   stopped. A burst of simultaneous guesses can no longer slip past the limit.
 * Fixed: “Skip logged-in users” no longer applies to the login, registration and
   password-reset forms. Before, anyone with an account — for example a subscriber
   on a site with open registration — could get past FormGhost there.
 * Behind Cloudflare with “Trust reverse-proxy headers” off, the login rate limit
   now tells your visitors apart instead of treating them as one. When FormGhost
   sees any reverse proxy with that setting off, wp-admin suggests turning it on.
 * New emergency switch: `define( 'FORMGHOST_DISABLE', true );` in wp-config.php
   turns FormGhost off completely without deactivating it. See the FAQ.
 * Fixed: search boxes no longer get FormGhost’s hidden fields, so these no longer
   show up in search URLs.
 * Redesigned the email you get when you forward a submission from the Vault: the
   message first, the details below, a plain-text version, dark-mode support, and
   no images, links or tracking. It only says “marked legitimate” when you really
   marked it.
 * Forwarded submissions are treated as possibly dangerous: links, web addresses
   and email addresses in them are broken up (for example `hxxps[:]// example[.]
   com`) so nothing can be clicked by accident, and FormGhost’s own hidden fields
   are no longer shown.
 * Fixed: forwarding a Vault entry from WP-CLI or a scheduled task crashed.

#### 1.2.4

 * WordPress.org review: the release package no longer contains the directory artwork
   folder or other non-runtime files.
 * Elementor Pro preflight now respects the master switch, the contact-form scope
   toggle, the IP whitelist and the `formghost/skip_form` filter, so a disabled 
   FormGhost never intercepts an Elementor submission.
 * Layer 9 CAPTCHA can now actually be switched on: new per-form toggles (comments,
   login, registration, password reset) and the widget container is printed on those
   core forms automatically.
 * “Store passed submissions” now controls whether passed submissions are stored
   in the Vault (they are still counted when off).
 * Programmatic settings saves (setup wizard) no longer reset developer-managed 
   array settings.
 * Uninstall also removes the per-user “items per page” screen options.
 * Honeypot CSS is delivered once: the stylesheet WordPress prints in the page head
   now carries a marker, and the front-end script only injects its own copy when
   that stylesheet is missing.
 * Documentation: FAQ and Privacy sections corrected (optional external calls, what
   learned rules can contain); stale development notes removed from code comments.

#### 1.2.3

 * WordPress.org review: the generic interceptor now classifies admin-ajax.php /
   admin-post.php requests via core’s own signals (`wp_doing_ajax()`, `$pagenow`)
   instead of matching the request URI, so non-standard wp-admin locations work.
 * WordPress.org review: settings tab selection now travels inside the Settings 
   API’s nonce-verified option input; the Contact Form 7 adapter no longer falls
   back to reading the raw request; the Elementor recipient resolver receives the
   validated page ID from the adapter instead of reading the request itself.
 * WordPress.org review: POST field names in the Kadence and Divi adapters are sanitized
   before use; nested array values in the generic interceptor are recursively sanitized
   before scoring.
 * Hardened Vault and Rules admin write paths: explicit capability check before 
   any action, nonce checks untangled into standalone conditions, and row actions
   validated against a closed list. Rules row-action nonces are now bound to the
   individual rule ID.
 * Token issuance (timing token, proof-of-work challenge, behavior nonce, ALTCHA
   challenge) is now fully stateless — HMAC-signed with the expiry embedded — so
   anonymous bootstrap requests write nothing to the database; single-use markers
   are written only when a token is actually consumed by a submission.
 * When “behind reverse proxy” mode is enabled, the client IP is now taken from 
   the right-most public X-Forwarded-For hop (the one vouched for by the trusted
   proxy) instead of the left-most, which a client can spoof.
 * Ghost Response success messages are sanitized at the source and HTML-escaped 
   in every per-plugin JSON envelope.
 * The version constant is a literal instead of re-parsing the plugin header on 
   every request.

#### 1.2.2

 * WordPress.org review: removed leftover cleanup code from the pre-1.1 licensing
   system and the retired Ghost Network source; the plugin contains no gating code
   of any kind — every feature is free.
 * Inline `<style>` blocks (dashboard widget, honeypot) moved to enqueued stylesheets.
 * Translations now come from translate.wordpress.org language packs; the bundled
   compiled files and the `load_plugin_textdomain()` call were removed.
 * readme: full “External services” disclosure for the optional Turnstile / hCaptcha
   verification calls and the optional DNS MX lookup.
 * Improved: marking a Vault entry as spam is now decisive — the sender’s exact 
   address (+50) and hashed IP (+30) are learned alongside the content signals, 
   so the next message from that sender is ghosted; marking as legitimate (-50 on
   the address) guarantees a wrongly held sender passes. Learned rules now also 
   apply to submissions without free text.

#### 1.2.1

 * Fixed: Contact Form 7 submissions arrive through the REST API, where the timing,
   proof-of-work and behavior layers and the bot preflight were skipped — only the
   honeypot and content patterns judged them. They now run for CF7 exactly as for
   a page POST. New filter `formghost/engine/rest_browser_form_types` for other 
   JS-driven REST forms.
 * New: cross-layer check — a submission that passed the timing or proof-of-work
   check but carries no behavior data (which the tracker injects into every form)
   is scored as a bot (`missing_after_js`).
 * New: identity-churn detection — one email address submitting under changing names,
   or one IP sending as many different people, within seven days. The Vault stores
   keyed hashes only (never the address). Toggle under Layer 5.
 * New: the Learning layer now tracks the full sender address as a rule type (“Email
   address”), so a mailbox reused by a bot escalates as a repeat offender even on
   gmail.com / mail.ru.
 * Improved: content patterns learn lead-generation, “website traffic”, directory-
   listing, newsletter-bombing and advance-fee scam vocabulary; new structural signals—
   unsubscribe boilerplate, a third-party link carrying this site’s own domain, “
   Hello Owner” greetings, repeated links, emoji bait, throwaway hosting (vercel.
   app, netlify.app, workers.dev, …) and 19 more URL shorteners, matched by host.

#### 1.2.0

 * New: adapters for six more form plugins — Forminator, HTML Forms, Jetpack Forms,
   Bricks Builder, Kadence Blocks, and Divi contact forms.
 * New: complete Arabic translation, with right-to-left admin support.

#### 1.1.0

 * Everything is free: all nine layers, self-learning, Learned Rules screen and 
   Ghost Response now ship free of charge. The former activation screen was removed.
 * New: “Passed” card on the dashboard — see the submissions that were NOT blocked
   and click through to review them.
 * New: FormGhost widget on the main wp-admin dashboard with blocked/passed counts
   and quick links.
 * New: dashboard stat cards link into the filtered Vault views.
 * Improved: “Blocked today” now follows the site’s timezone instead of UTC.
 * Improved: ghost-response counting is exact — it no longer under-counts when ghost
   logging is off or entries are reviewed/purged.
 * Improved: email domains in the Vault are shown in full, and the search box matches
   partial domains.
 * Improved: the IP whitelist now honours CIDR ranges in every layer, including 
   the engine’s early skip.
 * Improved: Vault filters cover every supported form plugin (Fluent, Ninja, Formidable,
   BuddyPress, bbPress, custom forms, password reset).
 * Fixed: default settings are now merged on front-end requests too, so a partially
   saved settings option can never silently disable a layer.
 * Fixed: the “Protect contact-form plugins” toggle now also covers custom forms
   caught by the generic interceptor.

#### 1.0.0

 * Initial public release.

## Meta

 *  Version **1.2.5**
 *  Last updated **46 minutes ago**
 *  Active installations **Fewer than 10**
 *  WordPress version ** 6.0 or higher **
 *  Tested up to **7.1.2**
 *  PHP version ** 7.4 or higher **
 *  Language
 * [English (US)](https://wordpress.org/plugins/formghost/)
 * Tags
 * [antispam](https://fur.wordpress.org/plugins/tags/antispam/)[captcha alternative](https://fur.wordpress.org/plugins/tags/captcha-alternative/)
   [GDPR](https://fur.wordpress.org/plugins/tags/gdpr/)[honeypot](https://fur.wordpress.org/plugins/tags/honeypot/)
   [spam](https://fur.wordpress.org/plugins/tags/spam/)
 *  [Advanced View](https://fur.wordpress.org/plugins/formghost/advanced/)

## Ratings

No reviews have been submitted yet.

[Your review](https://wordpress.org/support/plugin/formghost/reviews/#new-post)

[See all reviews](https://wordpress.org/support/plugin/formghost/reviews/)

## Contributors

 *   [ byabdalla ](https://profiles.wordpress.org/byabdalla/)

## Support

Got something to say? Need help?

 [View support forum](https://wordpress.org/support/plugin/formghost/)