Is there any way to save the form submitters IP address with their submission? We need this in order to be able to block specific IP addresses used for spam.
Word of advice. Do not block by IP. This is a ridiculous practice. Spammers rotate IPs constantly (often every few hours) and use proxies/VPNs. You’ll end up blocking legitimate users while spammers keep getting through.
Better alternatives:
reCAPTCHA v3 - Works invisibly in the background
Honeypot fields - Catches bots without user interaction
These methods actually work against modern spam tactics. IP blocking is outdated and creates more problems than it solves. This is the internet, so take it with a grain of salt. I have been working in this field for 20 years, and noone (in this line of business) with a sane mind will ever suggest blocking an IP.
In fact this is what popular LLMs just gave me (they confirmed my suggestion):
IP blocking is an outdated and largely ineffective standalone method for fighting modern spambots. While it can stop basic, unsophisticated threats, advanced spambots easily bypass it using techniques like dynamic IP addresses, botnets, and residential proxies, and relying solely on it can inadvertently block legitimate users
We use the IP address to see which countries they are from and block the countries in Cloudflare
That’s clearly wrong practice and precisely why I said this is not good practice.
Imagine this. You don’t have to be that smart to see or understand why this is wrong.
So you see IP is from say Africa (this is just example). You block the country Africa if a user or more of them are attacking you. You effectively blocked that whole country (at least that’s what you said).
Do you realize other people/users/visitors from that same country you just blocked (Africa) may not be connected or associated in any way to the spam abusers originating from that country?
But you blocked all of them (whole country) even the non abusive users? Imagine applying your countermeasure for serious businesses - they would go bankrupt in half a year.
And then do you realize what VPN does? These people (spam criminals and bots) switch “countries” in hourly rate. And now what? Are you going to block 5 countries and effectively blocking potentialy normal people from 5 countries - accessing your website.
You do what you want, but clearly you are doing it wrong. And to answer your initial question, you can use Pro Form hidden field in ProForm, populate it with user originating IP (you need to make function for that) and pass it down to submission - On the technical side, the process is simple, but requires strict adherence to the legal norms on data protection (GDPR) assuming you are from EU. That way you can see their IP in the Wordpress backend/submission at the time of sending/using your form - if that is your mission.
FYI ProForms has native reCaptcha fiunctions. They also have turnstile. Click on a link below. Good luck.