# Spam protection

> Honeypot fields, content scoring, rate limiting and duplicate detection keep bots out of your inbox.

Source: https://docs.formclick.io/html-forms/spam-protection

Every form gets several layers of protection on the server. You only need to add one line of HTML for the honeypot; everything else is automatic.

_Diagram: a real message goes to the inbox, a bot that ticks the honeypot is dropped, and a spammy message goes to the Spam tab. Bots that fill the honeypot are dropped, spammy messages go to the Spam tab, real people reach your inbox._

## Honeypot field

A honeypot is a field people never see. Bots fill in every field they find, so if the honeypot has a value, Formclick drops the submission. The bot still gets a normal success response, so it has no reason to try again.

```html
<!-- Option 1: checkbox (recommended) -->
<input type="checkbox" name="botcheck" class="fc-hp" tabindex="-1" autocomplete="off">

<!-- Option 2: text field -->
<input type="text" name="_honeypot" class="fc-hp" tabindex="-1" autocomplete="off">

<style>
  /* Hide from people but keep it in the page for bots */
  .fc-hp { position: absolute; left: -9999px; width: 1px; height: 1px; overflow: hidden; }
</style>
```

> **Tip:** Moving the field off-screen works better than `display:none`, which some bots detect. `tabindex="-1"` and `autocomplete="off"` stop keyboard users and password managers from filling it by accident.

## Captcha

For forms that attract determined bots, add a captcha. Formclick verifies the token on every submission and rejects the ones that fail, so bots can’t skip it. Supported: [Google reCAPTCHA v2 and v3](https://docs.formclick.io/html-forms/recaptcha) and [Cloudflare Turnstile](https://docs.formclick.io/html-forms/turnstile), on the Starter, Pro and Business plans.

## Restrict to your websites

On paid plans you can [restrict a form to your own domains](https://docs.formclick.io/html-forms/restrict-domain), so it rejects submissions sent from any other website.

## Content scoring

Each submission is scored on signals that show up almost only in spam, for example:

- A link inside a name field.
- Many links in one message, or HTML/BBCode link markup.
- Well-known spam phrases (SEO offers, crypto schemes, “buy followers”…).
- An email field that is not a valid address.

Suspected spam is **never deleted**. It is saved to the **Spam** tab of your dashboard and skips your notification email, integrations and monthly submission count. If a real message lands there, mark it **Not spam**.

## Rate limiting

Each IP address can send **5 submissions per form every 10 minutes**. Further attempts get a `429` response with “Too many submissions. Please try again later.”

## Duplicate detection

If the same visitor sends exactly the same data twice within **2 minutes**, for example by double-clicking Send, the second copy is ignored but still answered with success. You get one email, not two.

## Empty submissions

Submissions where every field is blank are rejected with `400 Submission is empty`.