Spam Protection

Because your form lives on your own site, Formiary only sees a submission once it reaches the endpoint. There are three protections you can combine to keep junk out of your data, configured from a form's Settings tab (under Submission Rules) and on individual fields.

A submission caught by any of these mechanisms is flagged as spam rather than silently dropped, so you can review anything that was caught by mistake from the Submissions view.

Honeypot fields

A honeypot is a hidden field that real users never see or fill in, but automated bots often do. If any value arrives in a honeypot field, the submission is flagged as spam.

1. Add a field (a hidden type works well) and mark it as a honeypot.
2. Include a matching input in your HTML, hidden from users with CSS. Avoid type="hidden" alone if you want to catch more bots; visually hiding a normal input tends to work better.
3. Leave it empty for real users; anything that fills it gets flagged.

Link detection

Spam submissions frequently contain links. You can flag a text field so that values containing several links are marked as spam. A field with link detection enabled flags the submission when its value contains three or more links.

Enable this per field when you edit or create a field.

Rate limits

Rate-limit rules cap how often a form can be submitted. Add them under Submission Rules → Rate Limits. Each rule defines:

• Scope — count submissions per IP address, per form, or per field value.
• Limit & window — e.g. 5 submissions every 10 minutes.
• Action — Reject the submission outright, or Mark as spam so it's still captured but flagged.

Rules can be toggled active/inactive and given a name and description so their intent is clear.

Combining protections

The three catch different things, so most forms use more than one. A common setup is a honeypot field for obvious bots, link detection on free-text fields, and a per-IP rate limit to stop floods. The form's Settings tab shows how many of each you have configured.