Spam protection

Protect your forms from spam bots with multiple layers of defense. Pro users get access to CAPTCHA integrations and advanced protection.

Protection layers

Honeypot (free)

A hidden field that only bots fill out. If it has a value, the submission is silently rejected.

How it works

1. Hidden field added to form (invisible to humans)
2. Bots auto-fill all fields, including the hidden one
3. If hidden field has value → spam
4. Submission rejected (bot thinks it succeeded)

Configuration

Enabled by default. No configuration needed.

Time-based protection (free)

Rejects submissions made too quickly (bots submit instantly).

Configuration

1. Go to Form Settings → Spam Protection
2. Set Minimum Time: 3 seconds (default)

How it works

1. Timestamp recorded when form loads
2. Timestamp checked on submission
3. If submitted too fast → spam
4. Submission rejected

Recommended: 2-5 seconds. Too long frustrates real users.

Google reCAPTCHA v3 (Pro)

Invisible CAPTCHA that scores user behavior. No user interaction required.

Setup

1. Go to Google reCAPTCHA Admin
2. Register your site for reCAPTCHA v3
3. Copy your Site Key and Secret Key
4. In Fodo Forms: Settings → Spam Protection → reCAPTCHA
5. Enter keys and enable

Configuration

How it works

1. reCAPTCHA analyzes user behavior
2. Assigns score: 0.0 (bot) to 1.0 (human)
3. Scores below threshold are rejected
4. All invisible to the user

Score thresholds

Start with 0.5 threshold. Adjust based on results.

hCaptcha (Pro)

Privacy-focused CAPTCHA alternative. May show visual challenge.

Setup

1. Sign up at hCaptcha
2. Get your Site Key and Secret Key
3. In Fodo Forms: Settings → Spam Protection → hCaptcha
4. Enter keys and enable

Configuration

Why hCaptcha?

• Privacy-focused (GDPR compliant)
• Doesn't track users
• Rewards website owners
• Good for EU-based sites

Cloudflare Turnstile (Pro)

Free, privacy-preserving alternative to CAPTCHA. Invisible most of the time.

Setup

1. Go to Cloudflare Dashboard
2. Navigate to Turnstile
3. Create a widget for your site
4. Copy Site Key and Secret Key
5. In Fodo Forms: Settings → Spam Protection → Turnstile
6. Enter keys and enable

Advantages

• Free (no usage limits)
• Invisible most of the time
• Privacy-focused
• Fast performance
• Works without Cloudflare CDN

Modes

Combining protection

Use multiple layers for best protection:

Recommended setup

Layer 1: Honeypot (always on)
Layer 2: Time-based (3 seconds)
Layer 3: reCAPTCHA v3 OR Turnstile

Don't use multiple CAPTCHAs together, pick one.

Blocking by content

Keyword blocking

Block submissions containing specific words:

Blocked Words: viagra, casino, crypto, SEO services

Case-insensitive matching.

Link blocking

Block submissions with too many links:

Max Links: 2

Spammers include multiple URLs.

Country blocking (advanced)

Block submissions from specific countries:

Blocked Countries: [select from list]

Based on IP geolocation.

Viewing spam

Spam log

Blocked submissions are logged (not stored as entries):

[2024-01-15 14:30] Blocked: Honeypot triggered
[2024-01-15 14:32] Blocked: reCAPTCHA score 0.2
[2024-01-15 15:01] Blocked: Contains blocked word

Spam statistics

View spam blocking rates:

Last 7 Days
───────────────────
Total Submissions: 150
Legitimate: 142 (95%)
Blocked Spam: 8 (5%)

Blocking Method:
- Honeypot: 5
- reCAPTCHA: 2
- Keywords: 1

Troubleshooting

Legitimate users blocked

If real users are being blocked:

1. Lower reCAPTCHA threshold (e.g., 0.3)
2. Reduce time-based minimum
3. Check keyword blocklist for common words
4. Review spam logs for patterns

Still getting spam

If spam is getting through:

1. Enable additional protection layer
2. Raise reCAPTCHA threshold
3. Add keyword blocks for common spam terms
4. Consider country blocking if pattern exists

CAPTCHA not showing

1. Verify API keys are correct
2. Check domain is registered
3. Look for JavaScript errors
4. Verify no conflicts with caching plugins