WP Armour – Honeypot Anti Spam

88 Quality Score

Active Installs

25/30

With 400,000 active installs, WP Armour has strong traction though it sits well behind category leader Akismet at 6 million installs.

Update Freshness

25/25

Last updated in July 2026 and tested against WordPress 7.0, the plugin is clearly and consistently maintained.

User Rating

15/15

A perfect 100 out of 100 from 1,412 reviewers is exceptional and suggests users are genuinely satisfied with the results.

Support Health

8/15

Only 9 support threads with a 22.2 percent resolution rate is a real weak spot, even allowing for the fact that the plugin rarely needs help.

WP Compatibility

15/15

Compatible back to WordPress 5.0 and tested with the current 7.0 release, so it will run on virtually every modern site.

Scores higher than 98% of indexed plugins

About

Fastest growing Anti Spam plugin. No API calls, subscriptions, captcha or puzzle. Full GDPR complaint. For comments, contact form, login, registration

Active Installs 400k+

Rating ★★★★★ 5/5

Last Updated 2026-09-03 5:28pm GMT

Requires WordPress 5.0+

Tested Up To 7.1

Security History

2 known vulnerabilities, all patched

1 Critical 1 Medium

Most recent: March 15, 2024

View details ▸

What It Does

WP Armour adds invisible honeypot fields to your WordPress forms on comments, contact forms, login, and registration screens. Real users never see or fill these hidden fields, but bots do, so any submission containing data in a honeypot is silently blocked. There are no CAPTCHAs, no third-party API calls, and no puzzles for visitors to solve.

Who It's For

This is a strong fit for small business owners, bloggers, and WooCommerce store operators who get moderate comment or contact-form spam and want a set-and-forget solution that does not annoy real visitors. It is especially useful on sites that need to remain GDPR-friendly and avoid sending visitor data to external services. Works well alongside Contact Form 7 and WPForms without configuration.

Who Should Skip It

If you run a high-traffic publication that is a constant spam target, the honeypot alone will not stop determined human spammers or sophisticated bots, and you will likely need Akismet or a CAPTCHA layer on top. Sites that already rely on a full anti-spam stack or use reCAPTCHA-based form plugins do not need this added.

The Bottom Line

WP Armour is a quietly excellent plugin: invisible to real users, effective against the bulk of automated spam, and fully GDPR-compliant with no third-party calls. The only meaningful concern is thin support coverage, so if something breaks on an unusual form integration, you may need to rely on documentation rather than a fast reply. Recommended for most small to mid-sized WordPress sites that want lightweight protection without CAPTCHA friction.

Pick Akismet if you want the most proven, server-side spam filter with a free personal tier and an API that catches more than honeypots can.

CF7 Apps – Honeypot, Database, Redirection, Webhook, and Addons for Contact Form 7 90/100

Pick this if you live entirely inside Contact Form 7 and want honeypot behaviour plus submission storage and webhooks in one add-on.

Disable Comments – Remove Comments & Stop Spam [Multi-Site Support] 88/100

Pick Disable Comments if the cleanest answer to spam is removing the comment system entirely, especially across a multisite network.

Antispam Bee 88/100

Pick Antispam Bee if you want a free, GDPR-friendly comment spam filter with granular rules and no external API dependency.

Email Encoder – Protect Email Addresses and Phone Numbers

Pick Email Encoder when your real problem is email scraping rather than form spam, since it solves a different problem entirely.