Layered defence that stops bots without a puzzle for the humans —
and without handing your visitors to Google.
Most spam tools make your visitors prove they’re human. QueryCue turns that around: three defences run on every free form and the honest visitor never notices any of them.
A hidden honeypot field catches the bots that fill in everything they can find. A WordPress nonce is checked before a submission is even looked at — a forged or stale request is refused with a 403. And a rate limit caps how often the same source can post: at most ten submissions in ten minutes, then a 429 until it cools off.
When you need a hard stop for a public, high-traffic form, Pro adds a real challenge — hCaptcha or Cloudflare Turnstile, verified on your own server. Both are privacy-first; neither is Google reCAPTCHA. And you switch it on only where you want it, so the rest of your forms stay frictionless.
Every submission must carry a valid WordPress nonce. Without it, the server answers 403 and stops — no form data is even read.
A field hidden from people sits in the form. If it comes back filled, the submission is quietly dropped — accepted with a straight face, but never stored and never emailed. Bots get no error to learn from.
The same visitor gets ten submissions per ten minutes. Past that it’s a 429. Visitors are counted by a salted hash of their IP — never the raw address.
With Pro, hCaptcha or Turnstile is verified server-side on the final step. If the check can’t be reached, the submission is refused, not waved through.
The default defences — honeypot, nonce, rate limit — need nothing from your visitor. No box to tick, no image grid, no drop in completion rate.
The honeypot runs instead of a challenge, so no tracker loads unless you turn one on. And QueryCue never sends your visitor’s IP address to hCaptcha.
If the captcha service can’t be reached, the submission is rejected — a network hiccup can’t quietly disable your protection and let spam through.
The widget loads only on the last step, and only on forms where you’ve switched it on — so a two-field contact form isn’t slowed down by a form built for the open internet. Verification always happens on your server: the visitor’s token is checked against the provider before the submission is accepted.
Your secret key is encrypted at rest with libsodium and is never sent back to the browser — the settings field shows blank once it’s saved, so it can’t leak through a page source or a cached admin screen.
And it’s deliberately privacy-minded: QueryCue does not pass the visitor’s IP address along to the captcha provider. The provider gets the token to verify, nothing more about who filled the form.
Spam isn’t only bots filling fields. QueryCue also refuses submissions that try to game the flow itself: only published forms accept entries, the path through the form must actually end at a success step, and only the answers on the route the visitor really took are kept — the rest are discarded. Every answer is then validated and cleaned on the server, whatever the browser claimed.
Spam protection keeps the junk out; these keep what’s left safe and useful:
Honeypot, nonce and rate-limit are free on every form. hCaptcha and Turnstile come with Pro.