Features

Spam protection

Four layers of rules, plus a model that reads what the rules cannot. All optional, all configurable per form.

Honeypot

A field real users never see. Bots fill in everything they find, so anything that arrives with the honeypot populated is discarded. The endpoint still answers 200 — telling a bot it failed only teaches it to try harder.

honeypot

<!-- Hidden from humans, irresistible to bots -->
<input type="checkbox" name="botcheck" style="display:none" tabindex="-1" autocomplete="off">

Captcha

Cloudflare Turnstile, hCaptcha, and reCAPTCHA are all supported. Render the widget as usual and save the matching secret key in your form settings — we verify the token server-side before accepting anything.

turnstile.html

<form action="https://submit.formemailapi.com/YOUR_FORM_ID" method="POST">
  <input type="email" name="email" required>
  <textarea name="message" required></textarea>

  <div class="cf-turnstile" data-sitekey="YOUR_TURNSTILE_SITE_KEY"></div>
  <script src="https://challenges.cloudflare.com/turnstile/v0/api.js" async defer></script>

  <button type="submit">Send</button>
</form>

Keyword rules

Add words or phrases that should never reach your inbox. Matching submissions are stored and marked as spam rather than deleted, so you can review them and correct a rule that turns out to be too broad.

Domain locking

List the domains allowed to post to this form. Requests from anywhere else are refused outright. Subdomains of a listed domain are accepted, so adding example.com also covers www.example.com.

Blocked submissions never count toward your monthly quota. You are only charged for messages you actually receive.

AI review

The four layers above are rules. Rules are fast and predictable, but they cannot read: a keyword list does not know the difference between a customer asking about pricing and an agency pitching SEO packages. A large language model can tell them apart.

AI review looks at the submissions the rules let through — the ones already on their way to your inbox — and decides whether each one is a genuine message or unsolicited bulk outreach. It runs shortly after a submission arrives rather than while your visitor is waiting, so it never slows a form down or holds up an email.

Anything it considers spam is marked in your submissions with a short reason you can actually read — “unsolicited cold pitch offering outsourced development services”, rather than “blocked keyword: seo”. Hover the marker in the list, or open the submission to see it in full.

It marks, it does not block. The notification email has already been sent by the time the review runs, and a marked submission stays in your inbox exactly where it was — nothing is moved, hidden, or deleted. AI review tells you what it thinks; what to do about it stays your call.

Available on paid plans. Turn it on per form under Configuration → Spam — it is off by default, and the four rule layers above behave exactly the same whether or not you enable it.

Contact form with captchaThe honeypot and Turnstile wired into one working form — and the case for adding the honeypot first and the captcha only if you need it.