Built-in Spam Protection
Availability: Free · Audited Free 5.0.8 / Pro 2.0.8
Free protects booking submissions with native one-use form tokens. This is token-based protection; it is not a CAPTCHA or a guarantee against every kind of spam.
How it works
The booking frontend generates a hashed token, validates it on submission and consumes it after use. In the audited version, the token expires after 20 minutes. There is no separate CAPTCHA configuration for this built-in behavior.
Verify a booking form
- Embed a supported booking shortcode on a staging page.
- Reload the page and submit a legitimate booking.
- Check confirmation and the saved appointment.
Expired form or rejected request
Reload the booking page before trying again. Check whether page caching serves stale forms or an optimization tool interferes with booking scripts. Exclude the affected booking page from problematic caching after testing. Keep WordPress, plugins and hosting protections maintained.
See Shortcodes and Debug Log Settings.