Settings reference
All settings live under Formsieve → Gravity Forms or Formsieve → Contact Form 7, Settings tab, in six sections: Connection, Detection, Forms, Privacy, Lists and Advanced. Only administrators (the manage_options capability) can see or change them. Each plugin keeps its own settings; a site running both plugins configures each one.
Labels are shown as they appear on the screen, values in bold are the defaults, and the stored key is shown in brackets for developers (option fsv_gf_settings or fsv_cf7_settings).
Connection
Where is your key from? Choose one route; nothing is pre-selected, and nothing is sent until a route is chosen, a key is present and consent is given. Changing the route asks for consent again.
| Setting | Values | What it does |
|---|---|---|
| Route | TypeSafe (direct), Vercel AI Gateway, OpenRouter, Custom base URL | Where requests go. Each card shows who receives the data, where to get a key and how precisely the model version is pinned. The model is fixed per route: TypeSafe jev-1.13.0, OpenRouter typesafe/jev-1.13, Vercel typesafe-ai/jev (Calibration). |
| Require zero data retention | on (OpenRouter only) | Adds provider.zdr: true and provider.data_collection: deny to every OpenRouter request. If OpenRouter has no such endpoint available, the submission is not checked and follows When the API cannot answer, and a notice says so (Troubleshooting). |
| My Vercel team is on a paid Pro or Enterprise plan. | required (Vercel only) | Vercel acts as a processor only for paid teams. |
| Base URL, Path (optional), Model ID (optional) | Custom only | HTTPS base URL (HTTP only for localhost and .test hosts), endpoint path (default /v1/systemone) and model (default jev-1.13.0). Only the Custom route lets you choose the model. |
| API key | text | Your key. Stored in its own option with autoload off, obfuscated at rest, displayed masked. Never exported or logged. Remove the saved key deletes it. The constants FSV_GF_API_KEY or FSV_CF7_API_KEY and FORMSIEVE_API_KEY override it. |
| Test connection | button | One real call with a canned sample (about 500 tokens), available once consent is given for the route. It tests the saved route, or a route and key typed above before you save them; the saved key is only ever sent to the saved route. See Getting started. |
Run the setup wizard opens the wizard again.
Detection
Your site
| Setting | Values | What it does |
|---|---|---|
What this site does [site_description] |
text, up to 1,000 characters | Sent with each check so Jev knows what a real enquiry to your site looks like. |
Languages visitors write in [site_languages] |
language codes such as en, es; empty = the site language |
When the first one is not English, both thresholds move up by 0.05 (a precaution, see Calibration). |
Sensitivity
| Setting | Values | What it does |
|---|---|---|
Preset [preset] |
Low, Medium, High | Review and block thresholds: Low 0.65 / 0.92, Medium 0.50 / 0.85, High 0.40 / 0.75. |
Review threshold (advanced), Block threshold (advanced) [threshold_review, threshold_block] |
a fraction (0.85) or a percentage (85 or 85%); empty (use the preset) |
Numeric override for advanced users. 1 means 100%, so a block threshold of 1 never blocks. An entry that is not a valid threshold (text, a negative number, more than 100) is refused with a message and the previous value is kept. If the review threshold is not below the block threshold, saving shows a warning: nothing then goes to review. Never shifted for language. |
Review band [review_action] |
Deliver and tag the subject "[Possible spam NN%]", Send to spam | What happens to submissions between the two thresholds. |
When the API cannot answer [fail_mode] |
Fail open: deliver, noted "not checked", Fail closed: send to spam, noted "not checked" | Applies to timeouts and errors, an open circuit breaker, missing credit, reached cost limits and OpenRouter finding no zero-data-retention endpoint. Never to a missing route, key or consent: those submissions are always delivered. The note "Not checked (…)" goes on the entry (Gravity Forms) or "Formsieve: not checked (…)" goes to Flamingo and the Formsieve log; the mail itself is not tagged (Contact Form 7). |
Aggressive mode [aggressive_mode] |
off | Blocks without an API call when two or more strong local hints match (Pre-filters). |
Notes [annotate_all] |
off | Also adds a Formsieve note to allowed entries / Flamingo messages (review, block and not-checked ones always get one). |
Cost limits
| Setting | Values | What it does |
|---|---|---|
Checks per form per hour [hourly_cap] |
number; 0 = no limit | Maximum requests to the API per form per clock hour. Every request sent counts, a retry included. Above it, submissions follow the fail mode. |
Checks per month [monthly_cap] |
number; 0 = no limit | Maximum requests to the API per calendar month (UTC), all forms together, counted the same way. |
The counters exist only while a cap is set; see Cost and caps.
Free local checks
These run on your server before the AI check and cost nothing; see Pre-filters for how each one decides.
| Setting | Default | Notes |
|---|---|---|
Trusted users [allowlist_logged_in] |
on | Logged-in users who can edit Gravity Forms entries or forms skip the check; authors and contributors are checked like visitors. (Gravity Forms) Logged-in users who can edit the contact form (Editor and up by default) skip the check. (Contact Form 7) |
Honeypot [honeypot] |
on | Blocks when Formsieve's own hidden trap field _fsv_hp is filled. |
| Honeypot | (no setting) | Gravity Forms has its own honeypot: turn on "Anti-spam honeypot" in each form's settings (Form Options). Formsieve adds no second trap field, and entries that honeypot marks as spam are not sent for checking. |
Timing [timing], Minimum seconds [timing_min_seconds] |
on, 3 (1–60) | Submissions sent faster than the minimum are blocked. |
Trivial content [trivial] |
on | Submissions without free text are allowed without an API call. |
Replay cache [replay] |
on | Reuses the verdict for identical text for 7 days; the same text from 3 or more IP addresses is blocked. |
Rate limit [rate_limit], Submissions allowed [rate_limit_max], Within seconds [rate_limit_window] |
on, 5, 600 | More submissions than allowed from one IP address within the window are blocked. While it is off, nothing is counted and the model is not told how many submissions came from the address in the last hour. |
Blocklists [blocklist] |
on | The Always block lists and learned blocked senders. While it is off, Disallowed comment keys and Disposable email have no effect either. |
Disallowed comment keys [use_disallowed_keys] |
on | WordPress's Settings → Discussion → Disallowed Comment Keys also block form submissions (needs Blocklists on). |
Disposable email [disposable] |
on | Blocks throwaway e-mail domains from the bundled list (needs Blocklists on). |
Heuristics [heuristics] |
on | Local hints (shorteners, repeated values, crypto addresses, prompt-injection patterns, a field longer than 20,000 characters and others) used for aggressive mode and the injection rule; they are not sent to the model. Link, phone, writing-system and length signals are sent either way. |
Forms
A table of every Gravity Forms or Contact Form 7 form (up to 100) with its decisions and blocked submissions over the last 30 days, a link to its log rows and a Formsieve settings link to that form's own settings (Per-form settings for Gravity Forms, Per-form settings for Contact Form 7). Every form is checked with the global settings unless its own settings say otherwise.
Privacy
| Setting | Values | What it does |
|---|---|---|
Email domain [send_email_domain] |
on | Sends only the domain of the visitor's e-mail address, never the full address. Off sends no e-mail information at all. |
Phone numbers [redact_phone] |
on | Replaces phone numbers with [phone] before sending. |
AI notice under forms [ai_notice] |
Automatic, Always show, Never show | Prints "Submissions are screened for spam by an automated AI service." under each form. Automatic means on for the Vercel route (its terms require it) and off elsewhere. Forms can override it. |
Keep decision log for [retention_days] |
30 days, 90 days, 1 year, Keep until deleted | A daily task deletes older rows. |
The Privacy tab (next to Settings) shows exactly what is sent, the privacy-policy text to copy into your policy and the consent status, and lets you withdraw consent. See Privacy kit.
Lists
One entry per line, up to 1,000 per list. The lists are saved separately from the other settings (option fsv_gf_lists or fsv_cf7_lists), are not loaded on every page of your site, and are read only when a check needs them.
| Setting | Accepts |
|---|---|
Always allow: Email addresses, Email domains, IP addresses or ranges [allow_emails, allow_domains, allow_ips] |
full addresses; domains such as partner.example; IPv4 or IPv6 addresses and CIDR ranges such as 203.0.113.0/24. Addresses and domains match what the visitor types, and IPs match the address the form plugin reports (Pre-filters); never list your own site's address or domain. |
Always block: Email addresses, Email domains, IP addresses or ranges [block_emails, block_domains, block_ips] |
the same; a blocked domain matches the sender's e-mail domain or the domain of any link in the message |
Always block: Words or phrases [block_keywords] |
words or phrases, matched case-insensitively in the submitted text |
Allow lists win over everything else. Learned from your corrections shows how many trusted and blocked senders Formsieve has learned (Feedback loop); they are stored as e-mail hashes and are not editable.
Advanced
| Setting | Values | What it does |
|---|---|---|
Test mode [test_mode] |
off | Simulated verdicts, nothing sent, red admin-bar badge (Getting started). |
Strict calibration [strict_calibration] |
off | While the route answers with an unrecognised model version, would-be blocks go to review instead (Calibration). No effect on Vercel, which does not report the version. |
Price per million input tokens (USD) [price_per_mtok] |
0.042 | Used to estimate cost when the route does not report it. |
Error email [error_email] |
off | At most one e-mail a day to the site administrator when API errors occurred. |
Uninstall [delete_on_uninstall] |
off | "Delete all Formsieve data when the plugin is deleted": settings, key, consent record, learned lists and decision log. Deactivating never deletes anything. |
Below the settings, Advanced also shows the Endpoint in use (and whether a constant or filter overrides it), the Unrecognized model versions seen so far, Export and import settings (a JSON file with the settings, the lists and the route, never the API key, the consent record or the learned senders) and a link to run the setup wizard again. An import never changes Test mode or Uninstall on the receiving site, and a file with a different route asks for consent again before anything is sent.
Constants for wp-config.php
| Constant | Effect |
|---|---|
FSV_GF_API_KEY |
API key for this plugin; wins over everything else. |
FSV_CF7_API_KEY |
API key for this plugin; wins over everything else. |
FORMSIEVE_API_KEY |
API key used when the plugin constant is not set. |
FSV_GF_API_BASE |
Replaces the route's base URL (for a proxy or a test server). |
FSV_CF7_API_BASE |
Replaces the route's base URL (for a proxy or a test server). |
Filters for the same purposes are listed in Developer hooks and WP-CLI for Gravity Forms and Developer hooks and WP-CLI for Contact Form 7.