Spam protection
Honeypot fields, content scoring, rate limiting and duplicate detection keep bots out of your inbox.
Every form gets several layers of protection on the server. You only need to add one line of HTML for the honeypot; everything else is automatic.
Honeypot field
A honeypot is a field people never see. Bots fill in every field they find, so if the honeypot has a value, Formclick drops the submission. The bot still gets a normal success response, so it has no reason to try again.
<!-- Option 1: checkbox (recommended) -->
<input type="checkbox" name="botcheck" class="fc-hp" tabindex="-1" autocomplete="off">
<!-- Option 2: text field -->
<input type="text" name="_honeypot" class="fc-hp" tabindex="-1" autocomplete="off">
<style>
/* Hide from people but keep it in the page for bots */
.fc-hp { position: absolute; left: -9999px; width: 1px; height: 1px; overflow: hidden; }
</style>display:none, which some bots detect. tabindex="-1" and autocomplete="off" stop keyboard users and password managers from filling it by accident.Captcha
For forms that attract determined bots, add a captcha. Formclick verifies the token on every submission and rejects the ones that fail, so bots can’t skip it. Supported: Google reCAPTCHA v2 and v3 and Cloudflare Turnstile, on the Starter, Pro and Business plans.
Restrict to your websites
On paid plans you can restrict a form to your own domains, so it rejects submissions sent from any other website.
Content scoring
Each submission is scored on signals that show up almost only in spam, for example:
- A link inside a name field.
- Many links in one message, or HTML/BBCode link markup.
- Well-known spam phrases (SEO offers, crypto schemes, “buy followers”…).
- An email field that is not a valid address.
Suspected spam is never deleted. It is saved to the Spam tab of your dashboard and skips your notification email, integrations and monthly submission count. If a real message lands there, mark it Not spam.
Rate limiting
Each IP address can send 5 submissions per form every 10 minutes. Further attempts get a 429 response with “Too many submissions. Please try again later.”
Duplicate detection
If the same visitor sends exactly the same data twice within 2 minutes, for example by double-clicking Send, the second copy is ignored but still answered with success. You get one email, not two.
Empty submissions
Submissions where every field is blank are rejected with 400 Submission is empty.