Spam protection

Honeypot

The honeypot is a hidden field that real visitors never see and never fill in, but automated bots tend to complete every field they find. If the honeypot field arrives with a value, the submission is silently accepted — the visitor gets a normal success response — but it is flagged as spam and never delivered to your inbox. Bots get no signal that they were caught.

Add a hidden field named _honey to your form. The recommended approach is a visually hidden text input that is also removed from the tab order:

<input type="text" name="_honey" style="display:none" tabindex="-1" autocomplete="off" />

_honey is the canonical name and the one we recommend. For compatibility with forms migrated from other services, Formcrest also treats _gotcha, botfield, url, and website as honeypot fields — if any of them arrives non-empty, the submission is flagged as spam. The honeypot is active whenever the spam-protection toggle is on, which is the default. See Configuration for the toggle.

Cloudflare Turnstile

Turnstile is Cloudflare's privacy-friendly CAPTCHA alternative. It is opt-in per form: turn on Require Turnstile in your form settings, then add the widget to your form. When required, every submission must include a valid cf-turnstile-response token — a missing or failed token causes the submission to be treated as spam. Turnstile is available on every plan.

Add the widget where you want the challenge to appear, and load the Turnstile script:

<div class="cf-turnstile" data-sitekey="YOUR_SITE_KEY"></div>
<script src="https://challenges.cloudflare.com/turnstile/v0/api.js" async defer></script>

The widget renders a hidden input named cf-turnstile-response and fills it with a token. When the form is submitted, Formcrest verifies that token with Cloudflare before delivering. Replace YOUR_SITE_KEY with the site key from your Cloudflare Turnstile dashboard.

Rate limiting

Formcrest applies per-IP and per-form rate limiting at the edge. Bursts of requests beyond the allowed rate are rejected with rate_limited (HTTP 429) and a Retry-After header. This runs automatically on every form — there is nothing to configure. Normal human submission rates are well under the limit.

Complete example

This form includes both the honeypot and the Turnstile widget. Point the action at your form's endpoint and replace the site key with your own.

<form action="https://api.formcrest.com/v1/submit/abc123" method="POST">
  <label>
    Email
    <input type="email" name="email" required />
  </label>

  <label>
    Message
    <textarea name="message" required></textarea>
  </label>

  <!-- Honeypot: hidden from users, irresistible to bots -->
  <input type="text" name="_honey" style="display:none" tabindex="-1" autocomplete="off" />

  <!-- Cloudflare Turnstile widget -->
  <div class="cf-turnstile" data-sitekey="YOUR_SITE_KEY"></div>

  <button type="submit">Send</button>
</form>

<script src="https://challenges.cloudflare.com/turnstile/v0/api.js" async defer></script>

Reviewing flagged submissions

Submissions caught by the honeypot or by Turnstile are stored and flagged as spam rather than deleted, so you can review them in the dashboard if you ever need to. They do not count toward your monthly submission quota and are never emailed to your destinations.

For the settings that control these layers, see Configuration. For what happens when a submission is rejected outright, see Error codes.