The WordPress plugin

What the plugin protects, the held inbox, releasing messages, and every setting.

What it protects

Out of the box: comments, WooCommerce reviews and registrations, and forms built with Contact Form 7, WPForms, Gravity Forms, Elementor Pro, Divi, Fluent Forms, Forminator, Ninja Forms and Formidable. Each integration switches on automatically when its plugin is present, and can be turned off under Cayve → Settings → Protect.

Developers can protect anything else with cayve_check(); see the API page.

The held inbox

Open Cayve → Messages in wp-admin. Tabs show messages that were held, blocked, released, confirmed as spam, and, during shadow mode, the ones Cayve would have acted on. Every row shows the reasons in plain English.

Release and send delivers a held message: the form’s original notification email is sent as if nothing had happened, and the sender is remembered as welcome on this site.
Spam confirms the decision and blocks that sender on this site.
Not spam on a blocked message does the opposite.
Delete removes a message you don’t want to keep.

Held messages wait 90 days for your review; everything else is cleared after 30 days.

Settings

Setting	What it does
API key	The key from your dashboard. Keys start with `cv_live_`; test keys with `cv_test_` give fixed answers.
Shadow mode on this site	Record decisions, never act. New sites are in shadow mode for their first week automatically.
Typing summary	Send counts of key presses, pastes and pointer movement with each form (never what was typed). Helps tell people from bots.
Daily email	One email a day to the site admin when messages were held.
Behind a proxy or CDN	Read the visitor’s address from Cloudflare or proxy headers. Leave on unless your host says otherwise.
Protect	Which integrations are on.

If Cayve is unreachable

The plugin waits at most a second and a half. If there’s no answer, the submission goes through as normal and is checked afterwards. Your forms never break because of Cayve.