Get an endpoint
Get an endpoint Sign in

Docs Spam protection

Bay 07Five layers, cheapest first

#Spam protection

Spam protection is on for every form. Spam is still stored, in its own folder, so you can check nothing real was caught. It’s never delivered, and it’s deleted after 30 days.

7.1 Honeypot

A field that’s hidden from people but visible to bots, which tend to fill in everything. Anything in it marks the submission as spam. Call it _gotcha, or pick your own name in Form settings → Spam.

honeypot
<!-- Real people never see it. Bots fill in every field they find. -->
<input type="text" name="_gotcha" style="display:none" tabindex="-1" autocomplete="off">

7.2 Rate limits and heuristics

Each visitor can send 10 submissions a minute to a form, and a form takes 120 a minute in total. Past that, they get a 429. We count by a one-way hash of the IP address and never store the address itself.

Then come the quick checks: a message stuffed with links, well-known spam phrases, throwaway email domains, a message that’s only a URL, and keyboard-mash gibberish.

7.3 Cloudflare Turnstile

Turnstile is Cloudflare’s free alternative to “click all the traffic lights”. There are two ways to use it, depending on how your form is sent.

For plain HTML forms

Challenge page

No setup. Turn it on in Form settings → Spam. When a submission looks borderline, the visitor is sent to a short check on sendm8.com/c/…. Once they pass, the submission goes through and they carry on to your thank-you page.

See the challenge page

For AJAX forms

Bring your own Turnstile

AJAX can’t follow a redirect to a challenge, so put the widget on your own form instead. We check the token it adds with your secret key.

Bring your own Turnstile, step by step

  1. In the Cloudflare dashboard, open Turnstile and add a widget. Add your site’s hostname (for example yourstudio.com).
  2. Copy the site key into the widget on your form, as below.
  3. Paste the secret key into sendm8 under Form settings → Spam → Turnstile → Bring your own. It’s stored encrypted.
  4. That’s it. The widget adds a cf-turnstile-response field, and FormData picks it up automatically. Submissions without a valid token get a 403.
contact.html
<script src="https://challenges.cloudflare.com/turnstile/v0/api.js" async defer></script>

<form action="https://sendm8.com/f/k3x9q2m7ab" method="POST">
  <label>Your email <input name="email" type="email" required></label>
  <label>Message <textarea name="message" required></textarea></label>

  <!-- Adds a hidden cf-turnstile-response field once the check passes -->
  <div class="cf-turnstile" data-sitekey="0x4AAAAAAAyour-site-key"></div>

  <button>Send</button>
</form>

7.4 AI spam score

Optional, and off until you switch it on in Form settings → Spam. A small model scores each message after it’s been stored, so it never slows your visitor down. Anything it’s confident about moves to spam before it’s delivered. You’ll see the score and the reasons on every submission.

7.5 Phishing guard