FOCUSED CHECKS FOR SUPPORTED FORM AND ACCOUNT WORKFLOWS
Form Guard
Vendix Form Guard adds challenge, timing, rate, spam and identity checks to WordPress forms and account screens. This Pro module has adapters for ten form systems, including Elementor Pro Forms, Contact Form 7, WPForms and Gravity Forms, and protects WordPress login, registration and password reset with Cloudflare Turnstile or a local image CAPTCHA.
Challenges
Select a challenge that fits the form.
Choose Cloudflare Turnstile Managed or the Vendix Classic Image CAPTCHA in the CAPTCHA Engine tab. Server-side validation checks the challenge response before the protected operation continues.
Cloudflare Turnstile. Uses your own Turnstile site key and secret key; both can also be defined as constants in wp-config.php. Choose an automatic, light or dark theme and a normal, compact or flexible widget size. The server check also confirms that the response belongs to your site.
Classic image CAPTCHA. Shows a local image code of 4–8 characters that expires after one to 15 minutes, without contacting a third-party service. The settings describe it as standard protection and recommend Turnstile for high-security deployments.
Turnstile requires the appropriate provider configuration. A local challenge is a separate option; enabling a challenge does not establish protection for an unrelated form without an active adapter.
Review both successful visitor submission and a rejected challenge when setting up the integration. Keep the challenge understandable alongside the form's actual request.
Submission Protection
Review the behavior around a submission.
Honeypot, minimum completion time, rate controls and duplicate checks provide signals beyond the visible form fields. In the Spam Shield tab, each signal adds to a risk score, and the submission is blocked when the score reaches the block threshold (40–100).
- Hidden honeypot field and signed start time. A filled trap field or a missing or altered start time counts against the submission.
- Minimum completion time. A form sent faster than the set number of seconds (1–30) is treated as automated.
- Rate limit. Submissions per client address and form within ten minutes (2–100).
- Duplicate submissions. The same content sent again within the duplicate window is flagged.
- Content risk scoring. Too many links, long runs of one repeated character and terms or domains from your blocked list raise the score.
Form email, webhook and CRM actions run only after server-side validation passes. These controls work together through the configured policy. A timing rule should allow normal visitors enough room to complete the form, while rate settings should reflect legitimate use and shared connections.
A rejected submission is a policy outcome, not automatic proof that the sender was malicious. Inspect the relevant context when tuning restrictions.
Identity Checks
Apply checks where the supported workflow exposes the right context.
The Identity Guard tab protects the WordPress login, registration and password-reset forms. It can require the selected CAPTCHA on these forms, applies a cooldown after repeated attempts and answers known and unknown accounts with the same neutral message.
- Attempts and cooldown. Set 3–30 attempts before a cooldown of five minutes to 24 hours.
- Account discovery. Hide the WordPress REST user endpoints from visitors who are not logged in and block numeric
?author=lookups. - Anonymized event log. Keep the latest 200 blocked events with type, reasons, time and a salted client fingerprint. Usernames, email addresses, passwords and message content are never stored.
These account protections start switched on when Form Guard is enabled. Use these settings deliberately on login, registration or other documented account contexts. Test legitimate validation errors and the expected successful route after changing the policy.
Form Guard does not provide SiteWatch's browser-encrypted native form storage or a separate private-message reader. Those are different product capabilities.
Form Integrations
Enable the adapter for the form product you use.
Adapters are registered when both the relevant plugin and its Vendix setting are active. Form Guard has adapters for Elementor Pro Forms, QuForm, Contact Form 7, WPForms, Gravity Forms, Fluent Forms, Ninja Forms, Forminator, JetFormBuilder and Everest Forms, alongside the WordPress login, registration and password-reset forms.
Form Guard is off by default. Turn it on under Vendix → Form Guard; each adapter switch starts on and takes effect only when its form plugin is installed.
An adapter's existence does not mean every field, upload or custom extension has identical protection. Check the documented adapter scope and test the complete form after configuration.
Loads only where a form appears. Pages without a protected form load no Form Guard stylesheet, script or Turnstile. A small detector loads them when a protected form appears, including forms opened later in popups, Full Modal content or forms drawn by scripts. Server-side checks run on every protected submission either way.
Choose the CAPTCHA and Spam Shield settings for that environment rather than enabling overlapping protection layers blindly.
A Practical Form Review
- Turn on Form Guard and identify the form plugin and supported adapter.
- Choose the CAPTCHA engine and enter its keys or code settings.
- Submit a normal test and a deliberately invalid challenge.
- Review timing, rate and repeated-submission handling in Spam Shield.
- Test the login, registration and password-reset screens when Identity Guard is on.
- Confirm the expected notification and downstream action separately.
Questions About Form Guard
Does it encrypt all form messages?
No. This page describes submission and identity checks. Browser encryption and a separate reader are SiteWatch native-form capabilities.
Does one setting protect every custom form?
No. Protection applies through the documented paths and enabled adapters. Custom workflows need their own integration review.
Does Form Guard require Cloudflare Turnstile?
No. The Vendix Classic Image CAPTCHA works locally without a third-party service. Turnstile requires your own Cloudflare site key and secret key when that engine is chosen.
Which form plugins have adapters?
Elementor Pro Forms, QuForm, Contact Form 7, WPForms, Gravity Forms, Fluent Forms, Ninja Forms, Forminator, JetFormBuilder and Everest Forms, alongside the WordPress login, registration and password-reset forms. An adapter is registered when both the relevant plugin and its Vendix setting are active.
Is Form Guard part of the Free edition?
No. Form Guard is a Vendix Pro module; the Free edition does not include it.
Continue Building
Reviewed against Vendix Pro 1.11.0 · Last updated 20 October 2026