Spam protection

FormThunder stops form spam in layers: a honeypot field and a content filter on every plan, hCaptcha on every plan, and Turnstile, reCAPTCHA v3, your own captcha keys and domain restriction on Pro and Agency. Anything flagged goes to the spam folder in your dashboard, where you can restore it. It doesn't reach your inbox unless you do.

Honeypot

Add a field that people never see. A bot that fills it gets a normal-looking success reply, so it learns nothing, and the submission goes to spam.

<input type="checkbox" name="botcheck" style="display:none" tabindex="-1" autocomplete="off">

Content filter

Each submission gets a score from signals such as link count and spam phrases. A score of 5 or more goes to spam. The filter is on by default, and you can switch it off with filter: false in the form's spam settings.

hCaptcha

Available on every plan, with FormThunder's own site key. Turn it on, then add the widget and our helper script.

<div class="h-captcha" data-captcha="true"></div>
<script src="https://formthunder.com/client/script.js" async></script>

curl -X PATCH https://formthunder.com/api/v1/forms/YOUR_FORM_ID \
  -H "Authorization: Bearer ft_live_..." \
  -H "Content-Type: application/json" \
  -d '{"spam":{"captcha":"hcaptcha","filter":true}}'

Turnstile

Pro. Create a widget in Cloudflare, then store its site key and secret on the form. The secret stays on our side.

<div class="cf-turnstile" data-sitekey="YOUR_SITE_KEY"></div>
<script src="https://formthunder.com/client/script.js" async></script>

{ "spam": { "captcha": "turnstile", "site_key": "YOUR_SITE_KEY", "secret": "YOUR_SECRET", "filter": true } }

reCAPTCHA v3

Pro. Run reCAPTCHA in your own page script and send the token as g-recaptcha-response or recaptcha_response. A score under 0.5 is refused. Change that with min_recaptcha_score.

{ "spam": { "captcha": "recaptcha", "site_key": "YOUR_SITE_KEY", "secret": "YOUR_SECRET", "min_recaptcha_score": 0.5, "filter": true } }

Once a form has a captcha set, a post without a valid token gets a 400.

Domain restriction

Pro. Accept posts only from your own domains. Subdomains match, and www. is ignored. A request with no Origin or Referer, such as one from a server, is refused.

{ "allowed_domains": ["example.com"] }

Report spam

Each notification email has a report spam link. One click blocks that sender on that form. In your own templates, use {{report_spam_url}}.

Rate limit

FormThunder allows 30 requests a minute per IP address per form. Further requests get a 429 with Retry-After.

Restoring a false positive

Open the spam folder in the dashboard and restore the submission. It's then delivered as normal.