🛡️
CheckLayer
CheckLayer · WordPress

CheckLayer User Handbook

Practical guidance for WordPress site owners and admins who rely on CheckLayer to keep submissions clean, accurate, and fully auditable.

Quick Start → Integration Guides

Before You Start

This handbook is for WordPress administrators, editors, and site owners using the CheckLayer plugin. Bring your WordPress admin access, an active CheckLayer API key, and at least one supported form plugin (or native comments) to follow along.

Quick Start Checklist

  1. 1

    Open CheckLayer → Settings in your WordPress dashboard.

  2. 2

    Paste your CheckLayer API key and click Verify Key. Look for the green check mark confirmation.

  3. 3

    Decide whether to enable Tracking Mode (logs without blocking) or Debug Logging (requires WP_DEBUG).

  4. 4

    Under Integration Settings, tick each provider you want CheckLayer to protect.

  5. 5

    Click Save Changes.

  6. 6

    Enable the CheckLayer toggle inside each form builder (WPForms, Ninja Forms, etc.) for every form that needs protection.

  7. 7

    Submit a test entry and confirm it appears in CheckLayer → Submissions with the expected status.

Understand the Admin Area

  • Dashboard: real-time snapshot of spam caught, clean traffic, and queue health. Ideal for daily check-ins.
  • Submissions: searchable archive with metadata. Filter by pending, clean, spam, or failed.
  • Logs: visible only when WP_DEBUG and Debug Logging are on. Great for diagnosing configuration or API issues.
  • Admin notices: Watchdog warnings surface at the top of the admin area if the queue stalls or cron stops running.

Submission Status Glossary

Status What it means Action needed
pending Waiting for the CheckLayer verdict. Emails pause unless Tracking Mode is on. None—verdicts arrive in seconds.
clean Passed validation. Emails released, or never paused in Tracking Mode. Optional if you’re auditing submissions.
spam Blocked as spam. Emails remain paused. Optional—delete or restore manually if needed.
failed Queue or API unavailable. Emails restored automatically. Investigate if frequent; Watchdog usually warns you.

How CheckLayer Protects Your Site

  • Safe by default: if the API key is missing or an integration is disabled, CheckLayer steps aside and nothing is blocked.
  • Background verdicts: most providers queue submissions, pause emails, and resume once the verdict is clean.
  • Automatic fallbacks: if the queue or API fails, CheckLayer releases emails and marks the submission failed.
  • Contact Form 7 exception: CF7 runs synchronously—spam is blocked before submission completes.
  • Tracking Mode: great for trials; logs everything but never alters the user experience.

Integration Playbooks

Each integration follows the same flow: enable globally, turn it on per form, and understand how emails behave while the verdict is pending.

WP

WordPress Comments

  • Enable globally: CheckLayer → Settings → WP Comments → tick Enable spam protection.
  • Adjust behaviour: expand Advanced Settings to tune auto-approval, spam behaviour, logged-in user rules, trackbacks, pingbacks, and comment length.
  • During review: pending comments stay in moderation until clean verdicts arrive. Manual moderation remains available.
  • Failsafe: CheckLayer restores comments to their original status if something breaks.
WF

WPForms

  • Enable globally: CheckLayer → Settings → WPForms.
  • Enable per form: builder → Settings → Spam Protection & Security → CheckLayer → tick the checkbox.
  • Email flow: entries are queued and emails pause until clean verdicts. Forms that skip entry storage (or when Sync Mode is forced globally) are checked before creation.
  • Failsafe: API or queue hiccups release emails immediately and mark the submission failed. The related entry ID appears in Submissions.
FF

Formidable Forms

  • Enable globally: CheckLayer → Settings → Formidable Forms.
  • Enable per form: builder → Settings → Form Settings → CheckLayer Protection.
  • Email flow: email actions are captured, stored, and replayed after clean verdicts. Spam verdicts keep them blocked.
  • Failsafe: if no Record Submission action exists, CheckLayer replays emails immediately. Tracking Mode skips interception.
NF

Ninja Forms

  • Enable globally: CheckLayer → Settings → Ninja Forms.
  • Enable per form: builder → Settings → Restrictions → Enable CheckLayer Protection (on by default for new forms).
  • Email flow: email actions are intercepted and replayed only after clean verdicts. Spam verdicts keep them suppressed.
  • Failsafe: Tracking Mode skips interception; API/queue failures replay emails instantly to avoid user-facing delays.
CF7

Contact Form 7

  • Enable globally: CheckLayer → Settings → Contact Form 7.
  • Enable per form: edit the form → CheckLayer tab → tick Enable CheckLayer spam protection.
  • Email flow: verification happens inline. Clean submissions proceed immediately; spam shows the standard CF7 spam message.
  • Failsafe: Tracking Mode prevents blocking. Tag key fields for best accuracy (see below).

Tagging Contact Form 7 Fields

CheckLayer needs to know which CF7 fields map to name, email, message, and other metadata. Add checklayer:* options directly to each tag. Use every option only once per form.

Data Option Example Tag
Sender name checklayer:name [text* your-name placeholder "Your Name" checklayer:name]
Email checklayer:email [email* your-email checklayer:email]
Website (optional) checklayer:url [url your-site placeholder "https://example.com" checklayer:url]
Message checklayer:message [textarea* your-message checklayer:message]

Tips:

  • Add the option on the same line as other tag settings—no extra configuration required.
  • Tag every relevant field; missing data (especially email) reduces accuracy.
  • After tagging, revisit the CheckLayer tab and confirm protection is still enabled.
  • Submit a test message to ensure the submission appears under CheckLayer → Submissions.

Common Questions

What does the Watchdog warning mean?

The queue has not processed submissions recently. Visit Tools → Scheduled Actions to inspect WP Cron or check whether a security plugin is blocking Action Scheduler.

How long do verdicts take?

Usually a few seconds. If pending entries linger for minutes, investigate cron configuration or API connectivity.

What is Tracking Mode for?

It lets you observe detection accuracy without ever delaying emails—ideal for staging sites or for gathering data before enforcing blocks.

Need Help?

Contact CheckLayer support to troubleshoot queue issues, tagging, or configuration—we are happy to guide you through setup and optimisation.

  • Support inbox: [email protected]
  • Incident channel: Slack/Teams #checklayer-alerts (request an invite from your account team).
  • Account assistance: Reach out to your CheckLayer account manager.