Spam protection

Honeypot filtering, per-form controls, and manual review.

Every form starts with honeypot protection enabled: add a hidden _gotcha field to your form, and any submission that fills it is marked as spam instead of notifying you.

HTML

<input type="text" name="_gotcha" style="display:none" />

Spam submissions are kept in the Spam tab of your inbox — they never trigger emails or webhooks.
Anything misclassified can be flipped with Mark as spam / Not spam on each submission.
Allowed domains (in Settings) rejects posts that don't originate from your own site — a strong defence against drive-by bots.
Rate limiting is automatic: a burst of submissions from the same IP address to one form is throttled with a 429 response and a Retry-After header, so a bot can't flood your inbox or burn through your plan's monthly limit.
Spam protection can be turned off per form if you'd rather receive everything.