# ActiveLayer WordPress Plugin For WordPress administrators, editors, and site owners running the ActiveLayer plugin — what the admin area shows you, what each submission status means, and how protection is applied across your forms. Updated: Aug 14, 2026 Source: https://activelayer.com/docs/wordpress-plugin/ ## Before You Start The ActiveLayer plugin connects your WordPress site to ActiveLayer and checks form submissions and comments for spam before they reach you. Once it’s set up, it runs in the background, and your visitors never see a CAPTCHA. You’ll need admin access to WordPress, an ActiveLayer API key, and at least one supported form plugin or WordPress comments enabled. ## Quick Start Checklist - Open **ActiveLayer → Settings** in your WordPress dashboard. - On the Welcome to ActiveLayer screen, connect a new account or choose **I already have an API key** to enter your existing key. - Optional: enable **Debug Logging** when troubleshooting. Tracking Mode is a developer option visible only with `WP_DEBUG` or a developer filter. - Under **ActiveLayer → Integrations**, supported providers are enabled by default after key connection. Untick a provider only if you want to exclude it; changes save immediately. - For an individual form, use its ActiveLayer setting to turn protection off if needed. - Every supported form is protected automatically once your API key is connected. To exclude a form, switch off ActiveLayer protection in that form’s settings. - Submit a test entry and confirm it appears in **ActiveLayer → Submissions** with the expected status. ## Understand the Admin Area - **Dashboard:** totals for checked requests, spam and clean submissions, plus an overview of integrations. - **Submissions:** review checked submissions and filter by `pending`, `clean`, `spam`, or `failed`. Adjust retention under Settings. - **Logs:** visible only when `WP_DEBUG` and Debug Logging are on. Great for diagnosing configuration or API issues. - **Admin notices:** Watchdog warnings surface at the top of the admin area if the queue stalls or cron stops running. ## Submission Status Glossary | Status | What it means | Action needed | | --- | --- | --- | | `pending` | Waiting for the ActiveLayer verdict. Emails pause unless Tracking Mode is on. | None—verdicts arrive in seconds. | | `clean` | Passed validation. Emails released, or never paused in Tracking Mode. | Optional if you’re auditing submissions. | | `spam` | Blocked as spam. Emails remain paused. | Optional—delete or restore manually if needed. | | `failed` | Queue or API unavailable. Emails restored automatically. | Investigate if frequent; Watchdog usually warns you. | ## How ActiveLayer Protects Your Site - **Safe by default:** if the API key is missing or an integration is disabled, ActiveLayer steps aside, and nothing is blocked. - **Background verdicts:** most providers queue submissions, pause emails, and resume once the verdict is `clean`. - **Failures:** API or queue errors mark a submission failed and can release its emails. If background jobs stop running, pending submissions and their emails remain held until the jobs resume; check the Watchdog notice. - **Check timing:** WPForms, Ninja Forms, and Formidable Forms use background checks by default; Synchronous Mode checks them inline. Other supported form integrations, including Contact Form 7, check inline. - **Tracking Mode:** a developer option for WPForms and WordPress comments, visible only with `WP_DEBUG` or a developer filter. It logs verdicts without blocking. ## Integration Playbooks Supported integrations have different submission and email flows. The playbooks below cover five common providers; see ActiveLayer > Integrations for the complete list. ### WordPress Comments - **Enable globally:** `ActiveLayer → Integrations → WP Comments` → tick **Enable spam protection**. - **Adjust behavior:** expand **Configure** to tune auto-approval, spam behavior, logged-in user rules, trackbacks, pingbacks, and comment length. - **During review:** pending comments stay in moderation until clean verdicts arrive. Manual moderation remains available. - **Failsafe:** ActiveLayer restores comments to their original status if something breaks. ### WPForms - **Enable globally:** `ActiveLayer → Integrations → WPForms`. - **Enable per form:** builder → **Settings → Spam Protection & Security → ActiveLayer** → tick the checkbox. - **Email flow:** entries are queued and emails pause until clean verdicts. Forms that skip entry storage (or when Sync Mode is forced globally) are checked before creation. - **Failsafe:** API or queue hiccups release emails immediately and mark the submission `failed`. The related entry ID appears in Submissions. ### Formidable Forms - **Enable globally:** `ActiveLayer → Integrations → Formidable Forms`. - **Enable per form:** builder → **Settings → Form Settings → ActiveLayer Protection**. - **Email flow:** email actions are captured, stored, and replayed after clean verdicts. Spam verdicts keep them blocked. - **Forms without saved entries:** ActiveLayer checks synchronously. Spam is rejected during submission; clean submissions continue through the normal email flow. ### Ninja Forms - **Enable globally:** `ActiveLayer → Integrations → Ninja Forms`. - **Enable per form:** builder → **Settings → Restrictions → Enable ActiveLayer Protection** (on by default for new forms). - **Email flow:** email actions are intercepted and replayed only after clean verdicts. Spam verdicts keep them suppressed. - **Failsafe:** Tracking Mode skips interception; API/queue failures replay emails instantly to avoid user-facing delays. ### Contact Form 7 - **Enable globally:** `ActiveLayer → Integrations → Contact Form 7`. - **Enable per form:** edit the form → **ActiveLayer** tab → tick **Enable ActiveLayer spam protection**. - **Email flow:** verification happens inline. Clean submissions proceed immediately; spam shows the standard CF7 spam message. - **Contact Form 7 field mapping:** add `activelayer:message` to a content field and preferably `activelayer:email` to the email field. Without a mapped message, this form cannot be checked. ## Tagging Contact Form 7 Fields ActiveLayer needs to know which Contact Form 7 fields map to name, email, message, and other metadata. Add `activelayer:*` options directly to each tag. Use every option only once per form. | Data | Option | Example Tag | | --- | --- | --- | | Sender name | `activelayer:name` | `[text* your-name placeholder "Your Name" activelayer:name]` | | Email | `activelayer:email` | `[email* your-email activelayer:email]` | | Website (optional) | `activelayer:url` | `[url your-site placeholder "https://example.com" activelayer:url]` | | Message | `activelayer:message` | `[textarea* your-message activelayer:message]` | **Tips:** - Add the option on the same line as other tag settings; no extra configuration required. - Tag every relevant field; missing data (especially email) reduces accuracy. - After tagging, revisit the **ActiveLayer** tab and confirm protection is still enabled. - Submit a test message to ensure the submission appears under **ActiveLayer → Submissions**. Check out the detailed guide on [how to configure ActiveLayer with Contact Form 7](https://activelayer.com/docs/how-to-stop-contact-form-7-spam/). ## Common Questions ### What does the Watchdog warning mean? The queue has not processed submissions recently. Visit **Tools → Scheduled Actions** to inspect WP Cron or check whether a security plugin is blocking Action Scheduler. ### How long do verdicts take? Usually a few seconds. If `pending` entries linger for minutes, investigate cron configuration or API connectivity. ### What is Tracking Mode for? It lets you observe detection accuracy without ever delaying emails—ideal for staging sites or for gathering data before enforcing blocks. ## Need Help? Contact our [support team](https://activelayer.com/contact/) if you run into issues with the ActiveLayer plugin. You can also email us at [support@activelayer.com](mailto:support@activelayer.com) with more details so that the team can help you.