How is the contact form protected from spam?

This plugin uses a nonce, a “honeypot” hidden field, and a simple rate limit per IP. For high-volume sites, add reCAPTCHA or a security plugin.