WP Manifestindependent plugin directory
manifest / security / honeypot-for-elementor

Honeypot for Elementor Forms

Lightweight honeypot anti-spam protection for Elementor Pro forms. No captchas, no API keys.

by Hassan Ali | Coresol Studio · github.com/creativehassan/honeypot-for-elementor · website

★ 0stars

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/creativehassan/honeypot-for-elementor/archive/refs/heads/main.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.
Readme github.com/creativehassan/honeypot-for-elementor ↗

Lightweight honeypot anti-spam protection for Elementor Pro forms. No captchas, no API keys — just invisible trap fields that catch bots.

How It Works

  1. JavaScript injects two hidden fields into every form.elementor-form on the page:

    • A trap field (hfe_alt) — positioned off-screen so humans never see it, but bots fill every input they find.
    • A verification field with a randomly generated name and value — proves the browser executed JavaScript.

  2. On form submission, the server validates:

    • The trap field must be present and empty.
    • The verification field must exist in the POST data.

  3. If either check fails, the submission is rejected as spam with a configurable error message.

Bot Behavior Result
No JavaScript execution Hidden fields never injected → blocked
Fills all inputs Trap field filled → blocked
Strips hidden inputs Verification field missing → blocked
Real human with JS Fields injected, trap empty → allowed

Features

  • Zero configuration — activate and it works.
  • No captchas — nothing for users to solve.
  • No external services — no API keys, no third-party requests, no cookies.
  • Elementor-only — purpose-built for Elementor Pro forms.
  • Lightweight — under 5 KB total, vanilla JavaScript (no jQuery).
  • MutationObserver — catches dynamically loaded forms (popups, AJAX content).
  • Clean uninstall — removes all stored options on deletion.

Requirements

Requirement Minimum
WordPress 5.8+
PHP 7.4+
Elementor Pro Any version with Forms widget

Installation

  1. Upload the honeypot-for-elementor folder to wp-content/plugins/.
  2. Activate from Plugins → Installed Plugins.
  3. Done — all Elementor Pro forms are now protected.

License

GNU General Public License v2.0

Author

Hassan Ali — Coresol Studio