Spam Protection

Because your form lives on your own site, Formiary only sees the submissions that reach its endpoint. It gives you a few layers of protection you can combine to keep junk out of your data. Configure these from a form's Settings tab (under Submission Rules) and on individual fields.

A submission caught by any of these mechanisms is flagged as spam rather than silently dropped, so you can review anything that was caught by mistake from the Submissions view.

Honeypot fields

A honeypot is a hidden field that real users never see or fill in, but automated bots often do. If any value arrives in a honeypot field, the submission is flagged as spam.

1. Add a field (a hidden type works well) and mark it as a honeypot.
2. Include a matching input in your HTML, hidden from users with CSS (avoid type="hidden" alone if you want to catch more bots — visually hiding a normal input tends to work better).
3. Leave it empty for real users; anything that fills it gets flagged.

Link detection

Spam submissions frequently contain links. You can flag a text field so that values containing several links are marked as spam. A field with link detection enabled flags the submission when its value contains three or more links.

Enable this per field when you edit or create a field.

Rate limits

Rate-limit rules cap how often a form can be submitted. Add them under Submission Rules → Rate Limits. Each rule defines:

• Scope — count submissions per IP address, per form, or per field value.
• Limit & window — e.g. 5 submissions every 10 minutes.
• Action — Reject the submission outright, or Mark as spam so it's still captured but flagged.

Rules can be toggled active/inactive and given a name and description so their intent is clear.

Combining protections

These layers are complementary. A common setup is a honeypot field to catch obvious bots, link detection on free-text fields, and a per-IP rate limit to stop floods. The form's Settings tab shows a summary of how many of each protection you have configured.