Keep building your forms in Elementor and manage their protection from one settings page. The plugin checks submissions in the background without asking visitors to solve a CAPTCHA. You can enable or disable individual checks to suit your site. When a submission is rejected, the spam log helps you u
PricingFree downloadThe WordPress.org download is free. Pro versions, add-ons or external services may cost extra.
CompatibilityRequires WordPress 6.2 and PHP 8.0.
SourceWordPress plugins · Oct 27, 2026
01 / Source details
Aboutthistool.
Keep building your forms in Elementor and manage their protection from one settings page. The plugin checks submissions in the background without asking visitors to solve a CAPTCHA. You can enable or disable individual checks to suit your site.
When a submission is rejected, the spam log helps you understand why. Use it to investigate repeated attempts or troubleshoot problems reported by visitors.
The optional confirmation step serves two purposes: visitors can review their details before sending, and the additional interaction creates another hurdle for automated submissions. The form’s configured actions, such as sending an email, run only after confirmation. You choose which forms use this step.
The plugin requires Elementor and Elementor Pro with the Form widget. It is not a standalone form builder.
Features
Browser verification without an additional CAPTCHA challenge.
Checks for missing page information, missing or invalid tokens, and submissions made too quickly.
Honeypot and JavaScript submit controls.
Temporary email field names when browser verification is active.
Settings to enable or disable individual protection checks.
IP and email request limiting after repeated suspicious submissions.
Optional integration with WP Armour for spam logging and request limiting.
An optional confirmation step with a configurable title for each form.
A local spam log with recent entries in the WordPress admin and a downloadable JSON Lines file.
Optional country detection using Country.is.
An option to remove plugin settings and stored data when deleting the plugin.
Spam log
Logging is enabled by default and can be switched off independently of request limiting. Disabling logging does not delete existing entries.
Entries can contain the submission time, form name, name, email address, IP address, country code, a message excerpt, and the rejection reason. The message excerpt is limited to 125 characters, with whitespace and line breaks combined for easier reading.
The log keeps the latest 500 entries by default. Older entries are removed when the limit is exceeded; entries do not expire based on their age. Developers can change the maximum number of entries with the fw_tfe_spam_log_limit filter.
The log is stored as a JSON Lines file in the fw-tfe-logs directory inside the WordPress uploads directory. Spam log entries are not stored in the WordPress database.
IP and email request limiting
Request limiting can be enabled or disabled in the plugin settings. Save your chosen setting before using it. When enabled, it uses a separate table in the existing WordPress database.
The table stores separate counters for IP addresses and hashes of normalized email addresses, together with the start of each counting period and the end of any block. Email addresses are not stored as plain text in this table. Names and messages are not stored in it.
Three suspicious attempts from the same IP address, or five using the same email address, within five minutes trigger a block lasting one hour. Further attempts during that block do not extend it. Ordinary field validation errors and expired verification tokens do not count towards the limit.
Expired records are removed in batches during subsequent form requests. Cleanup does not rely on WP-Cron. Disabling request limiting stops enforcement but leaves the table in place.
Confirmation before sending
Enable “Require confirmation before sending” in an Elementor form’s options to let visitors review their details before the configured form actions run. You can customize the confirmation title for each form. This feature is off by default.
This is an on-page review step, not email address verification. Forms with upload fields skip this step and continue through the normal Elementor submission flow.
Pending submissions are stored temporarily in a separate database table, including form field data, form and page identifiers, and form metadata. A confirmation is valid for 15 minutes and can be used only once. Confirmed records remain stored until cleanup; cancelling an unclaimed confirmation deletes its pending record.
Expired records are removed by an hourly WP-Cron task. Actual deletion can occur later, depending on when WordPress runs scheduled tasks. Temporary confirmation storage is independent of spam logging.
WP Armour integration
When WP Armour is active and the integration is enabled, its Elementor form rejections can be included in this plugin’s spam log and request limiting. Logging and request limiting must each be enabled for their respective functions to apply.
WP Armour is optional and is not bundled with this plugin. Disabling the integration does not disable WP Armour’s own protection.
External services
Country.is
Country.is is an optional IP geolocation service used to retrieve a country code for a spam log entry. It is disabled by default and is used only after a site administrator selects Country.is in the country detection setting.
When logging a rejected submission with a valid IP address, the plugin sends that address in an HTTPS request to https://api.country.is/{ip} . Submitted names, email addresses, and message contents are not included in this lookup. As with other server-side HTTP requests, the service also receives the connection from your web server.
Country.is does not require an API key. According to the Country.is website, the API is free for commercial use, its data comes from MaxMind GeoLite2 and Cloudflare geolocation, and API requests are not logged by the service.
Country.is does not currently publish separate Terms of Service or Privacy Policy pages. Therefore, no direct links to such pages can be provided. The service information, usage conditions and privacy-related information published by Country.is are available on its website:
Country.is
Privacy and data storage
When logging is enabled, the plugin stores the personal information listed in the Spam log section on your server. When request limiting is enabled, IP addresses, hashes of normalized email addresses, and temporary request limit state are stored in a dedicated database table.
When the confirmation step is used, submitted form fields and metadata are stored temporarily in a separate database table, along with a hash of the confirmation token, an expiry time, and whether the confirmation has been used. This storage is not limited to the short message excerpt kept in the spam log.
Only optional country detection sends a visitor’s IP address to Country.is. Include your use of these features in your site’s privacy information as appropriate.
The spam log has an entry limit rather than an age limit. Request limit records become eligible for deletion after their counting period and any block have expired; physical deletion takes place during later form requests. Confirmation records expire after 15 minutes and are removed by the scheduled cleanup described above.
See it in action
Screenshots & previews.
Spam log entries.Plugin information and REST API test.Elementor forms setting for confirmation screen.Example confirmation screen.FW Tools for Elementor Forms screenshot 5
02 / Source details
Gettingstarted.
This plugin requires both Elementor and Elementor Pro to be installed and active.
01Upload the plugin directory to /wp-content/plugins/ and activate FW Tools for Elementor Forms in WordPress.
02Open Tools > Elementor Forms and select the Settings tab.
03Review the protection settings and save your choices for spam logging, IP and email request limiting, and country detection.
04Check browser verification on the Information tab and use “Test endpoint” or “Test again” if needed.
05Optionally enable “Require confirmation before sending” in the options of individual Elementor forms.
06Submit a test through your Elementor form and check that normal submissions still work.
Country detection is optional and disabled by default. The confirmation step is disabled until enabled for an individual form.
03 / Source details
Frequently asked questions.
Does this work with the free version of Elementor?
The plugin works with the Form widget provided by Elementor Pro. Elementor Pro is required in addition to Elementor.
Do I need to change my form fields?
For the spam log to capture a name, set that field’s ID to name in Elementor. This refers to the field ID, not its visible label.
The plugin uses the first populated email field and the first populated textarea field for the logged email address and message. Their field IDs can be different. Forms without those fields can still be used; the corresponding log values remain empty.
Does the plugin log every form submission?
No. When enabled, the spam log records rejections from this plugin’s page information, submit control, honeypot, browser verification, and temporary email field checks. It can also record WP Armour rejections when the integration is enabled.
Successful submissions are not added to the spam log. Requests rejected because an IP address or email address is already blocked do not create additional entries. The optional confirmation step stores pending form data separately, even when spam logging is disabled.
What happens if someone leaves a form open for a long time?
Browser verification tokens expire after two hours. An expired token causes the submission to be rejected with a form error. These rejections can be logged but do not count towards a request limit block.
The optional confirmation step has a separate 15-minute validity period.
Does request limiting block every visitor using that IP address?
Yes. IP limits apply across forms on the site, so visitors sharing a connection can share a block. Email limits also apply across forms, using the submitted email address independently of the IP address. A block on either identifier prevents submission.
Can I use request limiting without the spam log?
Yes. Request limiting has its own database table and works independently of spam logging.
Does country detection block countries?
No. It adds a country code to spam log entries to help you analyse rejected submissions. Country-based blocking is not included.
What happens when the token endpoint is unavailable?
Token verification is enforced only when the plugin’s REST endpoint check reports that the endpoint is available. Other enabled checks, including the missing page information check, honeypot, submit control, and request limiting, can still apply. Temporary email field names depend on browser verification.
What happens when I delete the plugin?
By default, stored settings and data are retained. Enable the option to delete all plugin settings and the spam log before deleting the plugin if you want uninstall to remove them. This also removes the request limit and confirmation tables and their related settings.
Deactivating the plugin or switching off a feature does not uninstall its stored data. Deactivation stops the scheduled confirmation cleanup.
Website LLMs.txt and LLMs-Full.txt Generator is an LLMs.txt generator and llms-full.txt generator for WordPress. It helps site owners generate, manage, preview, validate, and serve AI discovery files from published public content. Use it to create structured /llms.txt and optional /llms-full.txt end
EngageDock AI is a customizable floating contact widget for WordPress websites that want more leads and faster visitor communication. It helps small businesses turn website traffic into calls, texts, emails, and callback requests from one clean contact panel. Key Features: Click-to-Call – One tap ca
Altify AI is an auto ALT text and AI ALT text plugin for WordPress images. It helps generate descriptive image ALT text for accessibility and image SEO. Use bulk image ALT text tools for your Media Library, generate featured image ALT text automatically, and scale WooCommerce image ALT updates with
The Accepted Payment Methods plugin is a straightforward, lightweight solution that enhances your website by displaying visually appealing icons of the payment methods you accept. This plugin is ideal for a variety of websites, including e-commerce platforms, service-oriented websites, and informati
