Spam Protection

formbuild.io scores every response for spam automatically, and gives you extra layers — allow/deny rules and an optional bot challenge — when you need them. Clear spam is filtered without CAPTCHAs that annoy real visitors.

Automatic detection

Every response is scored on submit using signals like link count, disposable email addresses, duplicate content, submit timing, all-caps, and known spam phrases. Based on the score:

• Clear spam is filtered automatically and excluded from your monthly response count.
• Borderline responses are stored and sent to the Review tab in your Inbox so you can decide.
• Everything else lands in your Inbox as normal.

Marking a response Not spam or Spam changes where that response appears in your Inbox. It does not retrain the automatic scoring rules. Automatic detection runs on every plan — nothing to configure.

Sensitivity Pro

In Security & Rules → Spam Protection you can set how aggressively borderline responses are flagged for review:

• Off — only clear spam is filtered; nothing is sent to Review.
• Standard (default) — a balanced threshold.
• Strict — flags more borderline responses for review.

Sensitivity only changes what gets sent to the Review tab. It never changes what counts toward your plan — only clearly-detected spam is ever excluded from your response count.

Allow & deny rules Pro

Match responses by email, domain, keyword, or country, then choose what happens:

• Allow — always let this sender through, skipping all spam checks.
• Review — keep the response but send it to the Review tab. It still counts toward your plan.
• Block — reject the response before it's stored. It's never received and never counts.

Add rules under Security & Rules → Spam Protection — for example, Block the domain spam.com, Review the keyword crypto, or Allow a trusted customer's email.

Honeypot fields Pro

A honeypot is a hidden field that real visitors never see or fill in. Bots that auto-fill every field trigger it. On formbuild-hosted forms it's applied automatically; on your own HTML, add the hidden field:

1. In your form settings, go to Security & Rules → Spam Protection → Advanced and set a honeypot field name (e.g. _honey).
2. Add a matching hidden input to your HTML form:

<!-- Hidden honeypot — do not show to users -->
<div style="display:none" aria-hidden="true">
  <input name="_honey" tabindex="-1" autocomplete="off" />
</div>

If a response includes a non-empty value for this field, we silently discard it — returning a success status so the bot doesn't know it was caught.

Bot challenge

For high-traffic forms, add an invisible CAPTCHA. Choose one provider in Security & Rules → Spam Protection and enter your own keys.

Cloudflare Turnstile

Available on every plan, privacy-first, and near-invisible. Create a widget at the Cloudflare Turnstile dashboard, then under Spam Protection select Cloudflare Turnstile and paste your Site Key and Secret Key. On formbuild-hosted forms the widget is added for you; on your own HTML, include the script and widget:

<script src="https://challenges.cloudflare.com/turnstile/v0/api.js" async defer></script>
<div class="cf-turnstile" data-sitekey="YOUR_SITE_KEY"></div>

formbuild.io detects the cf-turnstile-response field and verifies it before accepting the submission.

Google reCAPTCHA Pro

Prefer reCAPTCHA? Select it under Spam Protection and enter your Site Key and Secret Key from the reCAPTCHA Admin Console, then add it to your page:

<script src="https://www.google.com/recaptcha/api.js" async defer></script>
<div class="g-recaptcha" data-sitekey="YOUR_SITE_KEY"></div>

formbuild.io detects the g-recaptcha-response field and verifies it with Google before accepting the submission.

Rate limiting

Every form endpoint is automatically protected by global rate limiting to prevent abuse and bot flooding.

Custom rate limits Pro — on Pro you can set a Max submissions per hour cap per form under Spam Protection → Advanced.

Bulk actions

In the Inbox, select multiple responses and use bulk actions to mark as spam, mark as not spam, or move them to Trash. Trash keeps responses recoverable for 30 days; permanent deletion happens from the Trash tab. See Managing Responses.

Tips

• Automatic detection is on by default — start there before adding a challenge.
• Use allow rules for trusted customers so their responses never get caught by mistake.
• Use tabindex="-1" and autocomplete="off" on the honeypot input so screen readers and browsers skip it.
• Combine spam protection with server-side validations (e.g. require an email field) for stronger coverage.