How to Stop Fake Form Submissions on WordPress (Gravity Forms, WPForms & Contact Form 7)

If you run lead generation on WordPress, you know the pattern. A contact form goes live, a campaign starts spending, and within days the entries fill up with gibberish names, throwaway email addresses, phone numbers that don’t connect and “leads” that never answer. Your sales team stops trusting the form. Your cost per qualified lead quietly climbs.

The usual fixes — a CAPTCHA, a honeypot field, an anti-spam plugin — catch the crude stuff. They do much less against modern automation that fills forms like a person, and nothing at all against a real-looking email that belongs to nobody. This guide explains how to close that gap on WordPress with ClickCease Lead Shield, which now connects directly to the three most widely used WordPress form plugins.

Why do fake form submissions get past CAPTCHA and anti-spam plugins?

Most form-spam tools look at the form: was a hidden field filled in, did the user tick the box, does the message contain spam keywords. That works against simple scripts. It breaks down in three common situations:

• Bots that behave like people. Automation tools and AI agents can load the page, wait, type at human speed and solve or bypass many challenges. The form itself looks perfectly normal.
• Valid-looking contact details that lead nowhere. A disposable email or an unreachable phone number passes format checks. The entry looks fine until a sales rep wastes time on it.
• Fraud that arrives through your ads. If the same invalid traffic is clicking your campaigns, every fake form fill also counts as a conversion — and teaches Smart Bidding to buy more of it.

Catching these needs signals the form can’t see on its own: how the visitor actually behaved on your site, and whether the identity they entered holds up. That’s what Lead Shield adds.

What is ClickCease Lead Shield for WordPress?

Lead Shield is ClickCease’s form and lead fraud protection. It runs on the same CHEQ engine that powers ClickCease’s ad protection — 2,000+ cybersecurity behavioral tests per visit — and applies it to the moment a visitor submits a form.

For each protected submission, Lead Shield combines three checks into one final risk score:

• Behavior on your site, from the ClickCease tag — whether the visitor acted like a real person or like automation.
• Email validation — whether the address entered is real and trustworthy.
• Phone validation — whether the number entered is real and trustworthy.

That score becomes a verdict and a recommended action:

Until now, Lead Shield wrote these verdicts into HubSpot forms only. With the WordPress connector, the same protection works on forms built directly in WordPress — and you can run HubSpot and WordPress side by side with no limit on either.

Which WordPress form plugins does Lead Shield support?

Lead Shield supports the three most common WordPress form plugins. Where you see the results depends on whether the plugin stores entries in WordPress:

Using a different builder, such as Elementor Forms or Ninja Forms? Those aren’t supported by the Lead Shield WordPress connector today. You can still protect the site itself with Bot Mitigation (more on that below), and Lead Shield also covers standard HubSpot forms embedded on WordPress pages.

How do you set up Lead Shield on WordPress?

Setup takes a few minutes and needs admin access to your WordPress site. The full walkthrough is in the ClickCease help center; here’s the short version:

Lead Shield is included in every ClickCease plan, with no upgrade needed; protected submissions count toward your plan’s usage.

1. Install or update the ClickCease WordPress plugin. Make sure the domain is added to your ClickCease dashboard, then install the ClickCease plugin from your WordPress admin (Plugins → Add New). If it’s already installed, update it to the latest version and turn on Enable auto-updates so it stays current. If you previously added the ClickCease tag through Google Tag Manager or hard-coded it, remove that copy once the plugin is active.
2. Open Form Management. In your ClickCease dashboard, go to Lead Shield → Form Management. Your domain appears as Connected; click the arrow to see its forms.
3. Choose which forms to protect. Protect forms one by one, or turn on automatic protection so every form is covered — including forms you add later.
4. Choose what to validate. Email and phone are both validated by default. Untick either field if you only collect one.
5. Save. Lead Shield starts checking submissions on the protected forms.

Should you start in Monitoring Mode?

Usually, yes. Monitoring Mode lets you watch Lead Shield work before it changes anything in your WordPress entries. Every submission is still checked exactly as normal, but the verdicts appear only in your ClickCease dashboard.

Use that window to shape your policy. In Custom Settings you can allow or block specific email domains — for example, always accept your own company domain. In Signal Management you can switch individual detection signals on or off. When the results match what you’d expect, turn Monitoring Mode off and the verdicts start flowing into your Gravity Forms and WPForms Pro entries.

Monitoring Mode is set separately for WordPress and HubSpot, so you can test one while the other is already live. The toggle sits at the top of the WordPress Plugin section in Form Management.

What do the verdicts mean, and what should you do with them?

On Gravity Forms and WPForms Pro, the ClickCease plugin adds four columns to every protected entry:

• cq_action — the recommended action: Accept, Challenge or Deny.
• cq_email_verdict — Benign, Suspicious or Malicious, for the email address.
• cq_phone_verdict — the same, for the phone number.
• cq_threat_type — the type of threat detected, so you can see why a lead was flagged.

A simple way to act on them:

Because the verdict lives in the entry, you can filter or export by it, and use it to report cost per qualified lead instead of raw form fills. For Contact Form 7 and WPForms Lite, the same verdicts are in the Lead Shield dashboard in ClickCease, where the Detailed View lists every Malicious and Suspicious submission.

Lead Shield vs Bot Mitigation: do you need both on WordPress?

They do different jobs, and on WordPress they work best together:

• Bot Mitigation blocks. It runs through the same ClickCease WordPress plugin and stops malicious bots at the site level — before they reach your forms, checkout or login pages. Automated junk never becomes a submission.
• Lead Shield scores. It checks every submission that does reach your form — including people entering fake or throwaway details — and tells you which leads to trust.

One stops bots at the door; the other grades whoever walks in. Add Pixel Guard, which stops invalid visitors from firing your conversion tags, and fake form fills also stop teaching your ad campaigns to find more of the same.

Frequently asked questions

Sources: ClickCease help center — Setting Up Lead Shield for WordPress and Form Validation and Response Process (reviewed November 2026); ClickCease product materials; CHEQ, Form Guard enterprise case study (customer anonymized); CHEQ company overview (cheq.ai).