Skip to content
Formwire
Spam protection

Spam stops before it reaches your inbox

Every form gets a honeypot, a content filter and rate limits with nothing to configure. Spam goes to its own folder instead of your email, and you can tighten things further from the form's settings.

Start free Read the docs 250 free submissions per month.

Honeypot field

Add one hidden input to your form. People never see it, so they leave it empty; bots fill in every field they find, and a filled honeypot sends the submission straight to the Spam folder.

  • The field is called fax by default, a name bots like to fill in; rename it per form.

Content filter and rate limits

The spam filter blocks link-stuffed and empty submissions. Rate limits on the sender's IP address and on your access key stop a bot from flooding one form.

  • Caught spam is kept in the Spam folder for 30 days, so you can check nothing real was lost.
  • The filter is on by default and can be switched off per form.

Blocked words

List words or phrases you never want to see, and any submission that contains one goes straight to the Spam folder.

Allowed domains

List the sites your form lives on and Formwire refuses posts from anywhere else, so a copied access key is useless on a spammer's own page. Turn on Require a website to refuse posts with no origin at all.

  • Works with your access key being public: the key says which form, the domain says who may post.
  • A Recently blocked list shows which origins were refused and how often.

Captcha

Pick hCaptcha, Cloudflare Turnstile or Google reCAPTCHA in the form's settings, drop the widget in your form and Formwire verifies the token on every post. A post without a solved captcha goes to Spam.

  • hCaptcha works with Formwire's own key, so there's nothing to sign up for. Turnstile and reCAPTCHA use your own keys.
How it works

Add the honeypot

One hidden input is all the markup it takes. Everything else runs on the server.

  1. 1

    Add a text input named fax, the default name, and hide it with CSS, not type=hidden, so bots still see a field to fill.

  2. 2

    Leave Spam filter on in the form's Spam & security settings. Rename the field there to anything you like.

  3. 3

    Add your domains under Allowed domains, and pick a captcha if you want a challenge as well.

  4. 4

    Open the Spam folder in the inbox now and then. Mark anything real as not spam and it's delivered.

html formwire 
<form action="https://formwire.io/submit" method="POST">
  <input type="hidden" name="access_key" value="YOUR_ACCESS_KEY">
  <input type="email" name="email" required>
  <textarea name="message"></textarea>

  <!-- Honeypot: hidden from people, filled in by bots -->
  <input type="text" name="fax" tabindex="-1" autocomplete="off"
         style="position:absolute;left:-9999px">

  <button>Send</button>
</form>

Which plans include it

Honeypot, spam filter, blocked words, rate limits and hCaptcha are on every plan, including Free. Allowed domains, reCAPTCHA and Turnstile come with Pro.

See pricing
FAQ

Questions about spam protection

Do I have to add a captcha?

No. The honeypot, the content filter and rate limits run on every form with nothing in your markup but one hidden input. Add a captcha when a form attracts more spam than they catch.

What happens to spam?

It goes to the form's Spam folder in the dashboard and no email is sent. Spam is kept for 30 days; mark a submission as not spam and it is delivered as normal.

Can I use reCAPTCHA or Turnstile?

Yes, on Pro. Pick reCAPTCHA (v2 or v3) or Turnstile in the form's settings and add your own keys. hCaptcha works on every plan with Formwire's key, so there's nothing to sign up for.

Can I see what was blocked?

Yes. Blocked posts from a refused domain show in the Recently blocked list under the form's settings, and spam caught by the honeypot, filter or captcha is in the Spam folder with its reason.

Related

Goes well with