Feature · Spam Protection
Honeypot fields, time-trap detection, IP rate limits, and content scoring stop bots before they hit your inbox — without a single CAPTCHA.
Your form posts to one splitforms endpoint — no server, API route, or SDK. splitforms is the backend.
Every submission is saved to a searchable dashboard and emailed to you — spam filtered before it lands.
No glue code, no third-party middleman — it ships as part of splitforms and works from your first submission.
Copy-paste ready
Replace YOUR_ACCESS_KEY with the key from your splitforms dashboard. No SDK to install, no build step — the same html you already write.
<!--
Drop-in spam protection for any HTML form. No CAPTCHA, no scripts,
no Google cookies — just a hidden honeypot + a time-trap field.
-->
<form action="https://splitforms.com/api/submit" method="POST">
<input type="hidden" name="access_key" value="YOUR_ACCESS_KEY" />
<input type="text" name="name" placeholder="Name" required />
<input type="email" name="email" placeholder="Email" required />
<textarea name="message" placeholder="Message" required></textarea>
<!-- 1. Honeypot — hidden from real users, bots fill it in -->
<input type="checkbox" name="botcheck" style="display:none" tabindex="-1" autocomplete="off" />
<!-- 2. Time-trap — submissions faster than 2s are auto-rejected -->
<input type="hidden" name="form_loaded_at" value="" />
<script>
document.currentScript.previousElementSibling.value = Date.now();
</script>
<button type="submit">Send</button>
</form>
<!--
Optional: also call the API directly with fetch() for SPAs.
const res = await fetch("https://splitforms.com/api/submit", {
method: "POST",
headers: { "Content-Type": "application/json" },
body: JSON.stringify({
access_key: "YOUR_ACCESS_KEY",
name, email, message,
botcheck: "", // must stay empty
form_loaded_at: pageLoadedAt, // ms since epoch
}),
});
// res.json() => { success: true, message: "Submission received" }
// Suspected spam is accepted silently too: { success: true } — bots never see an error
-->How to set it up
How spam protection flows through splitforms — what you do, what we do, and what lands in your inbox.
Drop one hidden checkbox named 'botcheck' (display:none, tabindex=-1, autocomplete=off) and a hidden 'form_loaded_at' field that JavaScript fills with Date.now() on page load. Real users never touch either; bots that auto-fill every input and submit in under 2s are rejected before storage.
On submit, the API runs the honeypot check, time-trap, IP rate limit, and a rule-based content-scoring pass (link count, spam keywords, throwaway TLDs, repeated text, gibberish, and more). Honeypot and time-trap hits are rejected; suspicious content is quarantined without triggering email, webhooks, or integrations.
The dashboard's Spam queue shows submissions quarantined by content scoring for the active form. One click marks a false positive 'not spam', restores it to your inbox, sends the notification email, and trusts that sender from then on.
How spam protection works
splitforms blocks contact-form spam without ever showing a CAPTCHA. Every form gets a layered defence: a built-in honeypot field that bots auto-fill but real users never see, a time-trap that rejects submissions sent less than 2 seconds after the page loaded, IP-based rate limiting that throttles flooders by default, and a rule-based content-scoring layer that catches link spam, repeated phrases, throwaway TLDs, known attack-probe patterns, and other spam signals. Route the same submission to an email inbox or a webhook at the same time — nothing here is one-or-the-other.
What you get
Every reason below is the boring, reliable kind — the fundamentals of spam protection, built once and tested in production so you never have to.
How SplitForms works
splitforms receives the submission, filters spam, saves it to your dashboard and emails you — then, on paid plans, sends it on to your webhooks and integrations. No backend infrastructure to build.
Point your form to your unique SplitForms endpoint. That's it.
We instantly capture and organize every submission in your inbox.
Send data to email, spreadsheets, CRMs, webhooks, and 7,000+ apps.
No credit card required. Set up in under 60 seconds.
Connect & automate
On paid plans, submissions can also go to Slack, Discord, Google Sheets, Notion, Airtable, Zapier or any signed webhook — and splitforms works on the platforms you build on, from WordPress and Shopify to Next.js. With Stripe connected, your forms can take payments too.
NewTake payments on your formsDeposits, bookings, order forms — submitters check out through Stripe and the money goes straight to your Stripe account. Included on every paid plan.See plans →Common questions
Every submission runs through a layered server-side filter: (1) honeypot — several hidden field names (like 'botcheck') that real users can't see but bots auto-fill; (2) time-trap — submissions sent in under 2 seconds are rejected since real humans take longer to type; (3) IP rate limiting; (4) content scoring — rule-based checks flag link spam, throwaway TLDs, suspicious hosts, repeated text, gibberish, and attack-probe strings; (5) an optional per-form Google reCAPTCHA or Cloudflare Turnstile check if you turn it on. You can also restrict a form to an allowed list of domains. This runs without ever loading a CAPTCHA widget unless you opt in.
Yes — every layer (honeypot, time-trap, IP rate limit, content scoring, Spam queue) is included on the Free plan (500 submissions, no card). There is no upsell. Spam protection is identical at every tier; paid plans raise the monthly submission cap and add features like webhooks, integrations, and exports.
It's on by default — you don't have to enable anything. To get the strongest protection, add two hidden inputs to your form: <input type='checkbox' name='botcheck' style='display:none' tabindex='-1' autocomplete='off' /> for the honeypot, and <input type='hidden' name='form_loaded_at' /> populated by JavaScript with Date.now() on page load for the time-trap. Both are optional — submissions without them still get IP rate-limit and content scoring — but adding them meaningfully improves catch rate.
Yes. The honeypot, time-trap, and content scoring are all server-side, so they don't care what framework rendered the form. For an SPA using fetch() instead of a native form POST, send a JSON body with access_key, your fields, an empty botcheck: '' (must stay empty), and form_loaded_at set to the timestamp when the form mounted. The endpoint returns { success: true, message } on accept; suspected spam is also accepted with { success: true } so a bot never learns it was filtered, and only validation, auth, or rate-limit failures return { success: false, message, code }.
Open the form's Spam queue, find the submission, and click 'Not spam'. That recovers the submission to your inbox, sends the notification email, and adds the sender's email address to your trusted senders, so the content filter won't quarantine that person again (marking a message as spam withdraws the trust). If a whole pattern of legitimate messages keeps getting caught, email [email protected] with an example.
Simple pricing
Free gives you 500 submissions for $0 — no card, no time limit. Pro is $5/month for 5,000 submissions a month, and Annual is $49/year for 15,000 a month with every Pro feature.
For side projects and indie devs.
Every paid feature, for agencies and growing products.
Every Pro feature with triple the volume — $0.27 per 1,000 at full use.
No credit card required on Free • Cancel anytime • Full pricing and FAQ
