Paid traffic brings real leads and a lot of junk: numbers like 1111111, random digits, bots. Phone Validator for WPForms filters them out before they reach your inbox or CRM. It works with WPForms Lite and WPForms Pro and needs no setup to start: install, activate, done.

What it checks

Phone number rules. Minimum and maximum length, identical digits in a row (000000), ascending and descending sequences (1234567), your own blacklist.
Any country. Numbers are understood in national and international form (020 7946 0958, +44 20 7946 0958, 0044 20 7946 0958). Set a default country or write your own conversion rules like 07 => +447. A table of country calling codes and number lengths is built in. The number stored by WPForms is never changed.
Allowed country codes. Accept only the countries you serve, for example +1, +44, +33, +34.
Input mask. Describe the format once, for example +1 *** *** ****, and visitors get it while typing. The server checks the number again, so the mask cannot be bypassed by a bot.
Honeypot. An invisible field that people never fill and simple bots always do. The field name is random for your site and you can change it. A counter shows how many bots were stopped.
Browser check. A small script adds a hidden field in the visitor’s browser. Bots that send the form without a browser, or with a forged value, are stopped before WPForms saves anything. Can be switched off if a caching plugin delays scripts on your site.
Limits per IP. A minimum interval between submissions and a limit of submissions per IP address in 24 hours. Trusted IP addresses and logged-in administrators can be excluded.
Correct IP behind Cloudflare and proxies. Without it every visitor would look the same and the limits would block everyone. Cloudflare is built in; other proxies are supported through a list of trusted addresses.
History. Rejected and accepted submissions with filters, paging, download and automatic cleanup.

Good to know

The mask is applied while typing to plain phone fields. WPForms “Smart” phone fields (with a country selector) format themselves, for them the server check applies.
The honeypot, the browser check and the mask are re-checked on the server. Rejecting submissions without the browser check needs JavaScript in the visitor’s browser; you can turn that option off.
A short note under forms is shown only to logged-in administrators (it can be turned off). Visitors never see any label or link of the plugin.

Privacy

The plugin does not send data anywhere. The optional history is a file in the uploads folder (random name, not accessible from the web) with phone numbers and IP addresses of visitors. Logging can be turned off and old entries are deleted automatically (30 days by default). If you collect data of visitors from the EU, mention the history in your privacy policy or turn it off.

Credits

The table of country calling codes and number lengths is generated from the open libphonenumber metadata (Apache License 2.0).