Formitor checks your forms by sending a real (synthetic) submission and then confirming the lead was actually delivered. Many forms sit behind a CAPTCHA or an anti-spam filter, which are designed to block automated submissions, so without special handling they would block Formitor's tests too and make a working form look broken.
The Formitor plugin solves this by recognising its own test requests. Every Formitor test carries a cryptographically-signed token; when the plugin sees a valid token, it lets that single request pass the protection, and nothing else. Real visitors are always fully protected, and the bypass only ever applies to the one signed test request.
Supported protections
- CAPTCHA: Cloudflare Turnstile, Google reCAPTCHA v2 and v3, and hCaptcha, across WPForms, Contact Form 7, Elementor, Fluent Forms and Ninja Forms.
- Anti-spam: CleanTalk (Spam protection by CleanTalk), and WP Armour (the Honeypot and WP Armour Extended plugins).
Do I need to configure anything? No. It works automatically once the Formitor plugin is installed and active. If a form behind a CAPTCHA or anti-spam filter is showing failures, make sure each site is running the latest plugin version (you can download it from the dashboard), then re-test.
Fluent Forms honeypot
Fluent Forms has a global honeypot setting that rejects any submission missing its hidden trap field. As of plugin version 0.2.57, Formitor's test submissions carry that field the same way a visitor's browser does (present and empty), so you can keep the honeypot on and monitoring keeps passing. Custom honeypot names set through the fluentform/honeypot_name filter are honoured too.
WP Armour
WP Armour (the Honeypot and WP Armour Extended plugins) adds hidden fields that a real browser posts but a direct bot submission does not, and it can block or even ban a submission that leaves them out. As of plugin version 0.2.61, Formitor's test carries those hidden fields the same way a rendered page does, across every supported form type. On Ninja Forms the fields travel in the form's extra data, which is where WP Armour reads them. Keep WP Armour on: monitoring keeps passing, and your Formitor addresses are not auto-blocked.
Fluent Forms token-based spam protection
Fluent Forms has a global setting called token-based spam protection. When it is on, a form only accepts a submission that carries a short-lived signed token, which a visitor's browser fetches right before it submits. As of plugin version 0.2.63, Formitor's test creates that token on the site the same way Fluent Forms does for its own conversational forms, so the check passes and the protection stays on for everyone else. A custom field name set through the fluentform/token_protection_name filter is honoured.