Bay 07Five layers, cheapest first
Spam protection
Spam protection is on for every form. Spam is still stored, in its own folder, so you can check nothing real was caught. It’s never delivered, and it’s deleted after 30 days.
Nothing goes to spam silently. When our filters catch something, your inbox shows how much went to spam that week, and you get one email about it, at most once a week, that flags any close calls worth a second look.
7.1 Honeypot
A field that’s hidden from people but visible to bots, which tend to fill in everything. Anything in it marks the submission as spam. Call it _gotcha, or pick your own name in Form settings → Spam.
<!-- Real people never see it. Bots fill in every field they find. -->
<input type="text" name="_gotcha" style="display:none" tabindex="-1" autocomplete="off">7.2 Rate limits and heuristics
Each visitor can send 10 submissions a minute to a form, and a form takes 120 a minute in total. Past that, they get a 429. We count by a one-way hash of the IP address and never store the address itself.
Then come the quick checks: a message stuffed with links, well-known spam phrases, throwaway email domains, a message that’s only a URL, and keyboard-mash gibberish. A post with no browser and no page behind it (a script, in other words) counts a little against it too, though never enough on its own to be spam: plenty of honest server-to-server posts look exactly like that.
Each check adds to a score out of 1. At 0.8 the submission goes to the spam folder instead of being delivered; below that it arrives as normal, with the score and the reasons shown next to it.
7.3 Cloudflare Turnstile
Turnstile is Cloudflare’s free alternative to “click all the traffic lights”. There are two ways to use it, depending on how your form is sent.
For plain HTML forms
Challenge page
No setup. Turn it on in Form settings → Spam. When a submission looks borderline, the visitor is sent to a short check on sendm8.com/c/…. Once they pass, the submission goes through and they carry on to your thank-you page.
For AJAX forms
Bring your own Turnstile
AJAX can’t follow a redirect to a challenge, so put the widget on your own form instead. We check the token it adds with your secret key.
Bring your own Turnstile, step by step
- In the Cloudflare dashboard, open Turnstile and add a widget. Add your site’s hostname (for example
yourstudio.com). - Copy the site key into the widget on your form, as below.
- Paste the secret key into sendm8 under Form settings → Spam → Turnstile → Bring your own. It’s stored encrypted.
- That’s it. The widget adds a
cf-turnstile-responsefield, andFormDatapicks it up automatically. Submissions without a valid token get a403.
<script src="https://challenges.cloudflare.com/turnstile/v0/api.js" async defer></script>
<form action="https://sendm8.com/f/k3x9q2m7ab" method="POST">
<label>Your email <input name="email" type="email" required></label>
<label>Message <textarea name="message" required></textarea></label>
<!-- Adds a hidden cf-turnstile-response field once the check passes -->
<div class="cf-turnstile" data-sitekey="0x4AAAAAAAyour-site-key"></div>
<button>Send</button>
</form>7.4 AI spam score
On for new forms, and switchable in Form settings → Spam. A small model scores each message after it’s been stored, so it never slows your visitor down. Its score is kept on every submission it looks at, so you can see what it made of the quiet ones too, and anything it’s confident about moves to spam before it’s delivered. The model reads English best, so for messages written mostly in another script, such as Persian, Arabic, Chinese or Cyrillic, its score is shown but it can’t send them to spam on its own.