How to Add a Spam Filter to Gravity Forms Using the gform_entry_is_spam Hook?

TLDR

If you want a safe way to add custom code:

1. Install and activate the Code Snippets plugin from the Plugins menu.
2. Go to Snippets → Add New.
3. Give your snippet a title (e.g. “Gravity Forms IP Spam Filter”) 
   1. FYI this will be a PHP snippet .
4. Paste the same code above into the code area.

add_filter( ‘gform_entry_is_spam’, ‘filter_gform_entry_is_spam_iplocate_country’, 11, 3 );

function filter_gform_entry_is_spam_iplocate_country( $is_spam, $form, $entry ) {

    if ( $is_spam ) {

        return $is_spam;

    }

    $ip_address = empty( $entry[‘ip’] ) ? GFFormsModel::get_ip() : $entry[‘ip’];

    if ( ! filter_var( $ip_address, FILTER_VALIDATE_IP ) ) {

        return true;

    }

    $response = wp_remote_get( ‘https://www.iplocate.io/api/lookup/’ . $ip_address );

    if ( is_wp_error( $response ) || wp_remote_retrieve_response_code( $response ) !== 200 ) {

        return false;

    }

    $response_body = json_decode( wp_remote_retrieve_body( $response ), true );

    if ( empty( $response_body[‘country_code’] ) ) {

        return false;

    }

    // Block submissions from China (CN) and Russia (RU)

    $country_codes = array( ‘CN’, ‘RU’ );

    return in_array( $response_body[‘country_code’], $country_codes );

}

1. Under “Run snippet everywhere”, choose that option.
2. Click Save Changes and Activate.
3. Make sure your Gravity Form is collecting IP addresses (enabled by default).

Spam submissions can quickly turn your Gravity Forms contact forms into a headache. Fortunately, Gravity Forms provides a powerful filter—gform_entry_is_spam—that allows you to programmatically mark form entries as spam based on custom logic, including integration with third-party services like iplocate.io to block submissions from specific countries.

What is the gform_entry_is_spam Filter?

The gform_entry_is_spam filter lets you intercept form submissions and decide, using your own criteria, whether an entry should be flagged as spam. When an entry is marked as spam, notifications and add-on feeds are skipped, and users see the default confirmation message instead of your custom one.

How to Use the Filter

You can apply the filter to all forms or target a specific form by appending the form ID to the hook name. For example:

php

// For all forms

add_filter( ‘gform_entry_is_spam’, ‘your_function_name’, 10, 3 );

// For a specific form (e.g., ID 6)

add_filter( ‘gform_entry_is_spam_6’, ‘your_function_name’, 10, 3 );

Your callback function receives three parameters: $is_spam (boolean), $form (form object), and $entry (entry object).

Example: Blocking Submissions from Specific Countries with iplocate.io

Suppose you want to block submissions from certain countries using the iplocate.io API. Here’s a practical example that marks entries as spam if the submitter’s IP address originates from China or Russia:

php

add_filter( ‘gform_entry_is_spam’, ‘filter_gform_entry_is_spam_iplocate_country’, 11, 3 );

function filter_gform_entry_is_spam_iplocate_country( $is_spam, $form, $entry ) {

    if ( $is_spam ) {

        return $is_spam;

    }

    $ip_address = empty( $entry[‘ip’] ) ? GFFormsModel::get_ip() : $entry[‘ip’];

    if ( ! filter_var( $ip_address, FILTER_VALIDATE_IP ) ) {

        return true;

    }

    $response = wp_remote_get( ‘https://www.iplocate.io/api/lookup/’ . $ip_address );

    if ( is_wp_error( $response ) || wp_remote_retrieve_response_code( $response ) !== 200 ) {

        return false;

    }

    $response_body = json_decode( wp_remote_retrieve_body( $response ), true );

    if ( empty( $response_body[‘country_code’] ) ) {

        return false;

    }

    // Block submissions from China (CN) and Russia (RU)

    $country_codes = array( ‘CN’, ‘RU’ );

    return in_array( $response_body[‘country_code’], $country_codes );

}

This function checks the submitter’s IP, queries iplocate.io for the country code, and marks the entry as spam if it matches a blocked country1.

Where to Add This Code

Place the code in your theme’s functions.php file, a custom plugin, or use a code snippets plugin for easy management.

Final Thoughts

With the gform_entry_is_spam filter, you have granular control over what gets flagged as spam in your Gravity Forms. Whether you want to block certain countries, filter out suspicious content, or integrate with external APIs, this filter is your gateway to a cleaner inbox and better-quality leads. For more advanced examples and documentation, check out the official Gravity Forms docs on gform_entry_is_spam