Spam filtering

Ways to protect your form against spam

Public forms attract bots. FormBackend filters spam automatically, and you can harden a form further with a honeypot, CAPTCHA, and domain allowlisting.

Honeypot

A honeypot is a hidden field that humans should leave empty. If it contains data, the submission is marked as spam. The default field name is formbackend_nono. You can change it under the form’s Settings tab.

<form action="https://www.formbackend.com/f/{token}" method="POST">
  <!-- other fields -->
  <input name="formbackend_nono" style="position: absolute; left: -9999px" tabindex="-1" autocomplete="off">
  <button type="submit">Submit</button>
</form>

CAPTCHA providers

These are among the most effective options for blocking bots:

• Google reCAPTCHA
• hCaptcha
• Cloudflare Turnstile

Configure keys on the form Settings tab, then add the matching response field to your HTML form.

Whitelisted domains

Limit submissions to referrers from domains you trust. If your form lives on https://www.example.com/contact, enter https://www.example.com under Settings → Spam → Whitelisted domains. Submissions from other origins are rejected.

Reviewing spam

Open Submissions and switch the inbox filter to spam to review flagged entries. You can move false positives back to the inbox. Event history on a submission records why filters ran.

You can also use form rules to mark (or un-mark) spam based on submitted values.