Per-form settings for Gravity Forms

Every form inherits the global settings. To change one form, open Forms, edit the form, then Settings → Formsieve (section Formsieve spam filter). An empty value, or Use the global setting, means the form follows Formsieve's global settings. Formsieve → Gravity Forms → Settings → Forms lists every form with a link to this screen.

Settings

The settings in the order they appear on the screen:

Setting	Values	Notes
Check submissions to this form	on, off	Off: the form is never checked and nothing from it is sent (logged as `form_disabled`). The other settings show only while it is on.
When a submission is spam	Save the entry and mark it as spam (recommended, reversible), Discard it (no entry is saved; Gravity Forms shows its default confirmation), Refuse it with a validation error	What happens to a blocked submission (below).
Possible spam (review band)	Use the global setting, Deliver and prefix the notification subject, Treat as spam	What happens between the review and spam thresholds.
Sensitivity	Use the global setting, Low, Medium, High	See Verdict bands and actions.
Review threshold (optional), Spam threshold (optional)	a fraction (`0.50`) or a percentage (`50` or `50%`); empty	Numeric override for this form, read the same way as the global thresholds: `1` means 100%, so a spam threshold of `1` never marks a submission as spam. A value that is neither a fraction nor a percentage is refused with a message, and the form keeps its previous thresholds. A review threshold that is not below the spam threshold is saved with a warning under the fields (nothing then goes to review). Empty uses the sensitivity.
What legitimate submissions look like (optional)	text, up to 500 characters	Sent with each check as context about this form. Example: "Job applications for our Miami office; applicants often write in Spanish." Do not include personal data.
Fields never sent for checking	field list	Hidden, password, payment, file, consent and CAPTCHA fields, HTML, section and page fields, and fields that look like health, identity or bank data are always left out anyway.
Also check submissions made through the REST API and GFAPI	on, off	Off: submissions made through the Gravity Forms REST API or `GFAPI` are not checked.
Show "screened by an automated AI service" under the form	Use the global setting, Show, Hide	Prints "Submissions are screened for spam by an automated AI service." under the form.

Notices above the settings list the fields that look sensitive (never sent), suggest turning Formsieve off or excluding fields when the form looks medical or legal, and explain that the IP-based checks do not apply when the form's Personal Data settings prevent storing IP addresses.

What each action does

Save the entry and mark it as spam (default). The entry is saved with the status Spam, so nothing is lost: find it under Entries → Spam and restore it with Not Spam. Gravity Forms sends no notifications and runs no add-on feeds for spam entries. The visitor sees Gravity Forms' default confirmation ("Thanks for contacting us! We will get in touch with you shortly."), not your form's own confirmation or redirect. On Gravity Forms 2.10 or later, turn on the form's custom spam confirmation and give it the same text as your normal confirmation, so blocked visitors cannot tell the difference.
Discard it. No entry is saved and the visitor sees the same Gravity Forms default (or custom spam) confirmation as above; a client of the Gravity Forms REST API gets an HTTP 400 response. Only the numbers in Formsieve's log remain. Use it only if spam volume is a problem and you trust the thresholds.
Refuse it with a validation error. The form is not submitted and the visitor sees the validation message "Your submission looks like spam and was not sent. Please rephrase it, remove links, or contact us another way.", so a real person can edit and try again. It also tells bots that they were caught.

The action applies to every submission Formsieve treats as spam: model blocks, pre-filter blocks (timing, rate limit, blocklists and so on) and, when Possible spam is set to Treat as spam, the review band. A submission that Gravity Forms' own honeypot catches is left to Gravity Forms: no API call and no Formsieve log row.

When the check cannot run (a cap, the circuit breaker, missing credit or an API error) and When the API cannot answer is set to Fail closed, the entry is saved as spam, whatever the action above says, and Gravity Forms' spam note gives the reason "Not checked (reason)", for example "Not checked (API unavailable)".

While Test mode is on, a simulated spam verdict is also saved as spam, whatever the action above says, with "(Test mode: simulated verdict.)" in its note, so a real submission that arrives while you try the plugin can be restored from Entries → Spam. Blocks by the pre-filters (timing, rate limit, blocklists) are real decisions and still follow the action.

On the entry

Note. Formsieve's notes are written with the author "Formsieve", so their text does not repeat the name. A blocked entry gets one note, Gravity Forms' own spam note ("This entry has been flagged as spam.") with Formsieve's reason and details, for example "Spam probability 97% (block threshold 85%): Vendor solicitation. Model jev-1.13.0 (calibrated) via TypeSafe (direct), 12 ms, request …" (when another spam filter flagged the entry first, Formsieve adds a note of its own). Review-band entries get a note such as "Possible spam (review). Spam probability 62% (review threshold 50%): Other. Model …", and entries that could not be checked because of a cap, the circuit breaker, missing credit or an API error get "Not checked (reason)", for example "Not checked (API unavailable)"; allowed entries get a note only when Notes is on (Settings → Detection). A correction adds "Marked as spam by …" or "Marked as not spam by …".
Formsieve panel in the entry detail sidebar: verdict, probability, category, model and calibration status, route, request ID and latency. When you view (not edit) an entry, the panel also has buttons:
- Mark as spam (on an active entry) and Not spam (on a spam entry), for users who can edit Gravity Forms entries. They change the status and teach Formsieve the sender, like Gravity Forms' own Spam and Not Spam actions.
- Re-check, for administrators. It sends the entry for checking again (one API call, or none in Test mode; an earlier verdict for the same text is never reused), adds a note with the new result and does not change the entry's status. The Formsieve log records it as a re-check: its API call counts in the dashboard's API calls and cost, but it is not counted as another submission, and a later correction of the entry still counts once.
Entry list column: the Formsieve probability, sortable and filterable.
Entry meta (for exports and developers): fsv_score, fsv_verdict, fsv_category, fsv_reason, fsv_model, fsv_model_status, fsv_provider, fsv_latency_ms, fsv_request_id, fsv_request_id_kind. The meta and the CSV export keep the raw values (for example vendor_solicitation); the panel, the entry list columns and the entry filters show readable labels ("Vendor solicitation").
Notifications to the site owner for review-band entries are sent with the subject prefix "[Possible spam 62%]" (the number is the probability). Notifications to the visitor (sent to an Email field) are never tagged.

Working with other spam tools

Formsieve runs on gform_entry_is_spam at priority 50: after Gravity Forms' honeypot (priority 1) and before Gravity Forms' built-in Akismet check (priority 90). When the honeypot or another plugin that hooks in before priority 50 has already flagged an entry, Formsieve makes no API call and Gravity Forms keeps that tool's reason. Akismet runs after Formsieve and only checks entries Formsieve allowed. Keeping the form's honeypot on is recommended: it is free and stops the simplest bots before Formsieve spends anything.

AJAX forms, multi-page forms and forms with payment fields are checked. Submissions made through the Gravity Forms REST API or GFAPI are checked unless Also check submissions made through the REST API and GFAPI is off for the form. Admin previews, entry edits and non-AJAX submissions from the WordPress dashboard are not checked.

Restoring and correcting

Use Gravity Forms' Spam and Not Spam actions as usual, or the buttons in the Formsieve panel. Formsieve records each correction, labels its log row and learns the sender for next time (Feedback loop). Gravity Forms does not send notifications for an entry you restore; use Resend Notifications on the entry screen if you need them.