Getting started

Setting up takes about five minutes: install, choose where your key comes from, give consent, test the connection, describe your site.

1. Install

1. Download the installable plugin zip: formsieve-for-gravity-forms.zip or formsieve-for-cf7.zip. (From CodeCanyon, choose Download → Installable WordPress file only. The "All files & documentation" download is a package that contains this zip.)
2. In WordPress go to Plugins → Add New Plugin → Upload Plugin, choose the zip, then Install Now and Activate.
3. Requirements are checked on activation:
   • Formsieve for Gravity Forms needs Gravity Forms 2.7 or later. Until it is active, Formsieve shows a notice and stays idle.
   • Formsieve for CF7 declares Contact Form 7 as a required plugin, so WordPress activates it only while Contact Form 7 is active, and it needs Contact Form 7 6.0 or later.

Both plugins can be active on the same site; they share the Formsieve admin menu and keep separate settings, keys and logs.

2. Run the setup wizard

Open Formsieve → Gravity Forms (or Formsieve → Contact Form 7). The wizard starts the first time; Skip for now takes you to the plugin's Dashboard, Settings, Log and Privacy tabs, and Settings → Connection → Run the setup wizard brings it back.

Where is your key from? Nothing is pre-selected. Choose the route that matches your key; each option shows its current, dated terms:

• TypeSafe (direct): a key from console.typesafe.ai.
• Vercel AI Gateway: an AI Gateway key from a Vercel team. You must confirm "My Vercel team is on a paid Pro or Enterprise plan" (the Hobby plan is for non-commercial use and has no data processing agreement).
• OpenRouter: an OpenRouter key. "Require zero data retention" is on by default.
• Custom base URL: your own proxy (for example LiteLLM with your TypeSafe key). Enter the base URL, the path (default /v1/systemone) and the model (default jev-1.13.0). You confirm that you have your own agreement with the proxy operator.

No key yet? See Getting a key, or skip to Test mode.

API key. Paste the key. It is stored in its own option (not autoloaded), obfuscated at rest, and shown only as dots and its last four characters. To keep it out of the database, define it in wp-config.php instead:

define( 'FSV_GF_API_KEY', 'your-key' );     // Formsieve for Gravity Forms only
define( 'FSV_CF7_API_KEY', 'your-key' );    // Formsieve for CF7 only
define( 'FORMSIEVE_API_KEY', 'your-key' );  // shared name, used when the plugin constant is not set

A plugin constant wins over the shared constant, which wins over a saved key. One key may serve all of your own sites; do not create extra provider accounts to get more credit.

Consent. Formsieve sends nothing until an administrator opts in. The consent screen lists exactly which data is sent, to which companies (the gateway and TypeSafe AI, Inc. on a gateway route), in which country, with links to each recipient's privacy policy, data processing agreement and terms, and what a check costs. Tick the box to agree. You can withdraw consent at any time on the plugin's Privacy tab, and changing the route asks again, because the recipients change.

Test connection. One real call with a canned spam sample (about 500 input tokens, roughly $0.00002), sent only after you have given consent for the route. The result shows:

• the route and endpoint;
• the model requested, the model sent and the model that answered;
• the calibration status: Calibrated, Unrecognized or Version not reported (Vercel), explained in Calibration;
• the request ID and its kind, and the latency;
• the verdict and spam probability for the sample;
• the billing state: OK, key invalid, key valid but no credit, or payment method required, with a link to the right top-up page.

Nothing is saved or sent automatically: the call runs only when you click the button.

3. Describe your site

Under Settings → Detection:

• What this site does: one or two sentences about what you do and what visitors use your forms for. Example: "Web design agency in Miami. Visitors ask for quotes, ask about our services or request support for existing projects." This helps Jev tell a real enquiry from a sales pitch.
• Languages visitors write in: language codes such as en, es (empty: the site language).
• Preset (under Sensitivity): Low, Medium (default) or High. See Verdict bands and actions.

Then open each form's Formsieve settings if a form needs its own context, threshold or excluded fields: Per-form settings for Gravity Forms, Per-form settings for Contact Form 7. Settings → Forms lists every form with its decisions over the last 30 days and a link to its Formsieve settings.

4. Check it works

Submit a test message on a live form from a logged-out (private) browser window, then open the entry under Forms → Entries (Gravity Forms), Flamingo → Inbound Messages (if Flamingo is installed) (Contact Form 7) or the plugin's Log tab. You should see the verdict, the probability and the request ID, and the dashboard counts it.

Test mode

Test mode (Settings → Advanced) returns simulated verdicts from recorded examples for every submission, runs the full decision path, and makes no API calls; you need no key and no consent. A red Test mode badge shows in the admin bar while it is on, and log rows are marked as demo. Use it to try the plugin, to show it to a client, or to review it without a key.

To see each verdict, submit a form from a logged-out (private) browser window, because trusted logged-in users are allowed without a check, and put one of these markers anywhere in the message:

Only what the visitor typed is looked at (not your site or form descriptions). Without a marker, words such as "SEO" or "backlinks" produce a spam verdict, "guest post" or "partnership" a review verdict, and anything else is allowed. The pre-filters stay active: wait a few seconds before submitting (faster than 3 seconds counts as a bot), and expect the rate limit after 5 submissions in 10 minutes from one IP address.

Turn Test mode off before relying on Formsieve for real submissions. While it is on, a simulated spam verdict is saved as spam even on forms set to discard spam or refuse it with a validation error, so a real submission can be restored from Entries → Spam.