Every submission is scored against a set of signals you can see and tune. Obvious junk is dropped, borderline ones are held for a look, and a real enquiry caught by mistake is released with one click, attachments and all.
Each signal adds points: a blocked domain, a throwaway address, too many links, a message in the wrong script, a form filled in two seconds flat. Nothing is blocked on one signal alone unless you say it should be.
Below the first threshold it goes through. Above the second it is dropped. In between it is held for review, so the grey area lands with you instead of in the bin or the inbox.
A held submission has run none of the form's actions. Release it and every one of them fires exactly as if it had come in clean: the email, the CRM, the stored entry, and the attachments with it.
Domains and whole TLDs like .ru, individual senders, IPs and ranges, countries, and keywords with wildcards or full regex. Allow lists win over everything, so a client's own address can never be caught.
Turn it on, and for a week nothing is blocked. The dashboard still shows exactly what would have been, so you tune the rules against real traffic before a single enquiry is at stake.
If a rule breaks, a server hiccups or a table goes missing, the submission goes through and the log says why. A spam plugin that eats real leads when it stumbles is worse than no plugin at all.
Thirty days at a glance: what was let through, what was held, what was rejected and which rules did the work. Rejected submissions are not kept, but their score and reasons are, so you can always tell why.
Every field as submitted, every rule that fired with the points it added, and where it came from. Decide in a glance, then release it, block the sender, or block the whole domain and IP with it.
Every rule has a switch, a points value and a block-outright option. The defaults are sensible for a contact form; an agency with a hundred of them can tune once, export, and have every site follow.
Spam is not the only way to lose an enquiry. An email that never sends, a webhook that times out or a CRM that rejects the data loses it just as surely, and usually nobody notices for weeks. Form Guard watches every form for that too, and tells you.
Breakdance records whether each action delivered: the email, the webhook, the CRM. When one reports an error, Form Guard opens a problem that names the form and the action, with the message the action gave.
Forms that store nothing leave no record, so Form Guard reads the answer the form sends back. If a genuine submission gets an error after passing the checks, it notices, without changing a byte of the response.
If WordPress cannot send an email, you hear about it straight away, through the channels that do not depend on email working.
Once a day it looks at forms with twenty or more submissions in the last four weeks. When one goes much longer than usual without a single submission, and never less than three days so a quiet weekend is fine, it warns you.
A notice on every admin screen, a panel on the dashboard, an email, and a line in the summary. Add a webhook and alerts land in Slack, Microsoft Teams or Discord as well.
As soon as the form delivers again the problem closes on its own, and the webhook says so. A problem that keeps happening is alerted at most once a day, not once per failure.
Spam is a per-site chore that scales badly. These are the parts that make it one job instead of fifty.
Publish an export at a URL and point every site at it. Each one syncs on a schedule, and entries typed in locally are tracked apart from the feed, so a sync never overwrites what a site owner curated by hand.
Rules, lists, thresholds and per-form settings as one JSON file. Tune a site until it is right, export, and import it on the next one in merge or replace mode.
Paste an address, a domain, an IP or a phrase into the tester and it tells you which lists it hits. The answer to "why was this held" without going hunting.
Daily or weekly, only when something happened: what was blocked, what is waiting, what caught it, and a button straight to the quarantine. Quiet days send nothing.
Every Breakdance form on the site is found automatically. Switch protection off for one, or give a high-traffic form its own thresholds, without touching the rest.
One click on a held submission blocks the sender, and optionally their whole domain and IP, straight into the lists. The next one from them never gets as far as being held.
Turnstile asks whether a browser is driven by a human, and stops the flood of automated submissions. Form Guard asks whether a submission is worth reading, and catches what gets past: real people pasting SEO outreach, spammers on genuine Gmail accounts, the manual junk that makes up most of what actually lands. Run both.