Spam protection
Form spam protection that works without annoying real people
FormSubmit filters spam in layers before it reaches your inbox: a hidden honeypot field, a time-to-submit check, content scoring (links, known spam phrases, your own blocked keywords), duplicate detection and per-IP rate limiting. Suspicious submissions go to a Spam folder you can review — they never count against your monthly quota.
Honeypot field
Add a hidden input named _gotcha. Bots fill it, humans never see it. Honeypot hits are silently dropped and the bot still sees a success response.
Timing trap
Send a _ts timestamp when the form renders. Submissions that arrive faster than a human could type are scored as likely spam.
Content heuristics
Link density, BBCode/HTML links, common spam phrases, URLs in name fields and shouting are scored together. Choose low, medium or high sensitivity per form.
Your own blocklist
Add keywords that should always be treated as spam — competitor pitches, SEO offers, anything recurring.
Rate limiting & duplicates
Repeated submissions from the same IP are throttled and identical submissions within 10 minutes are flagged.
Bring your own captcha
Need more? Enable reCAPTCHA v2/v3, hCaptcha or Cloudflare Turnstile with your own keys. Tokens are verified server-side.
<input type="text" name="_gotcha" tabindex="-1" autocomplete="off" style="display:none">Frequently asked questions
Does spam count toward my submission limit?
No. Only submissions that land in your inbox count toward the monthly quota. Spam is stored separately so you can rescue false positives.
Do I need a captcha?
Most sites don't. The honeypot, timing check and heuristics stop the vast majority of bots. Captchas are available on all plans when you need them.
Is IP address data stored?
We store a salted hash of the IP address for rate limiting and abuse prevention — never the raw IP.
Related
Spam protection
How FormSubmit filters spam with honeypots, timing checks, heuristics, rate limiting and duplicate detection.
Captcha (BYO keys)
reCAPTCHA v2/v3, hCaptcha or Cloudflare Turnstile with your own keys, verified server-side.
How to stop contact form spam (without annoying real people)
A practical, layered approach to form spam — honeypots, timing checks, content filters, allowlists and captchas — and how to set each up.
Your form backend is 60 seconds away
Sign in with Google, create a form, paste the endpoint. Free forever for small sites — no credit card.