Skip to content

Trip Reviews

[trip_rating_summary] Shortcode

Updated July 31, 2026 6 min read

InquiryFlow protects public submissions with a honeypot field, IP rate limiting, required consent, and optional hCaptcha. Honeypot and rate limiting are always on and cannot be disabled.

Google reCAPTCHA is available with InquiryFlow Pro.

Step-by-step guide

Open spam settings

  1. Go to WordPress Admin → WP Travel Kit → InquiryFlow → Settings.
  2. Click Spam & Security in the left nav.

Configured under Form & Consent:

  1. Consent checkbox text — visitors must check this to submit.
  2. Privacy policy URL — optional link in the consent line.

Submissions without consent are rejected.

Honeypot (always on)

A hidden field traps bots. If filled, the submission is silently rejected. No setting to disable.

Rate limiting (always on)

  • 10 submissions per 15 minutes per IP address for inquiry forms.
  • 30 events per 15 minutes per IP for analytics beacons.

Visitors who exceed the limit see an error asking them to try again later.

Enable hCaptcha (Free)

  1. Sign up at hcaptcha.com and create a site.
  2. In Captcha provider, choose hCaptcha.
  3. Enter hCaptcha site key (public).
  4. Enter hCaptcha secret key (stored securely; not shown after save).
  5. Click Save.

When hCaptcha is enabled but keys are missing or invalid, submissions fail until fixed.

reCAPTCHA (Pro)

With InquiryFlow Pro and an active license, Google reCAPTCHA appears as an additional provider option. See reCAPTCHA.

Tips

  • Start with honeypot + rate limit only; add hCaptcha if you see spam.
  • Test submissions in a private window after enabling captcha.
  • Whitelist your office IP only via developer filter inquiryflow_rate_limit_client_id if needed — Developer documentation.

Common mistakes

  • Enabling hCaptcha on staging without keys — all submissions fail.
  • Expecting to turn off rate limiting — not supported by design.
  • Forgetting consent checkbox — required field; unchecked submissions fail.

Troubleshooting

IssueFix
“Too many requests”Wait 15 minutes; reduce test submissions from same IP
Captcha not showingConfirm provider and site key; clear cache
All submissions fail after captchaVerify secret key; check hCaptcha dashboard
Bot spam still gets throughEnable hCaptcha; consider Pro reCAPTCHA