Features

Spam protection

Four layers of rules, plus a model that reads what the rules cannot. All optional, all configurable per form.

Honeypot

A field real users never see. Bots fill in everything they find, so anything that arrives with the honeypot populated is discarded. The endpoint still answers 200 — telling a bot it failed only teaches it to try harder.

honeypot

<!-- Hidden from humans, irresistible to bots -->
<input type="checkbox" name="botcheck" style="display:none" tabindex="-1" autocomplete="off">

Captcha

Cloudflare Turnstile, hCaptcha, and reCAPTCHA are all supported. Render the widget as usual and save the matching secret key in your form settings — we verify the token server-side before accepting anything.

turnstile.html

<form action="https://submit.formemailapi.com/YOUR_FORM_ID" method="POST">
  <input type="email" name="email" required>
  <textarea name="message" required></textarea>

  <div class="cf-turnstile" data-sitekey="YOUR_TURNSTILE_SITE_KEY"></div>
  <script src="https://challenges.cloudflare.com/turnstile/v0/api.js" async defer></script>

  <button type="submit">Send</button>
</form>

Keyword rules

Add words or phrases that should never reach your inbox. Matching submissions are stored and marked as spam rather than deleted, so you can review them and correct a rule that turns out to be too broad.

Domain locking

List the domains allowed to post to this form. Requests from anywhere else are refused outright. Subdomains of a listed domain are accepted, so adding example.com also covers www.example.com.

Blocked submissions never count toward your monthly quota. You are only charged for messages you actually receive.

AI review

The four layers above are rules. Rules are fast and predictable, but they cannot read: a keyword list does not know the difference between a customer asking about pricing and an agency pitching SEO packages. AI review can tell them apart.

AI review looks at every submission the rules let through and decides whether it is a genuine message or unsolicited bulk outreach. It runs after your visitor has already been sent on their way, so it never slows a form down — but before the notification goes out, so spam it catches never reaches your inbox at all.

Anything it considers spam goes to your Spam folder with a short reason you can actually read — “Looks like an outsourced development or design pitch”, rather than “blocked keyword: seo”. Nothing is deleted: open Spam, and one click puts a message back in your inbox if the review got it wrong.

It is deliberately cautious. When a message could plausibly be genuine it is left alone, because missing one piece of spam costs you a moment and wrongly filing a real enquiry could cost you a customer. Sales, press, partnership and job enquiries from a named person are all treated as genuine.

On by default, on every plan, for every form. Switch it off per form under Configuration → Spam — the four rule layers above behave exactly the same either way.

Contact form with captchaThe honeypot and Turnstile wired into one working form — and the case for adding the honeypot first and the captcha only if you need it.