Spam protection

Honeypot

A field real users never see. Bots fill in everything they find, so anything that arrives with the honeypot populated is discarded. The endpoint still answers 200 — telling a bot it failed only teaches it to try harder.

<!-- Hidden from humans, irresistible to bots -->
<input type="checkbox" name="botcheck" style="display:none" tabindex="-1" autocomplete="off">

Captcha

Cloudflare Turnstile, hCaptcha, and reCAPTCHA are all supported. Render the widget as usual and save the matching secret key in your form settings — we verify the token server-side before accepting anything.

<form action="https://api.formpost.ai/submit" method="POST">
  <input type="hidden" name="access_key" value="YOUR_ACCESS_KEY_HERE">
  <input type="email" name="email" required>
  <textarea name="message" required></textarea>

  <div class="cf-turnstile" data-sitekey="YOUR_TURNSTILE_SITE_KEY"></div>
  <script src="https://challenges.cloudflare.com/turnstile/v0/api.js" async defer></script>

  <button type="submit">Send</button>
</form>

Keyword rules

Add words or phrases that should never reach your inbox. Matching submissions are stored and marked as spam rather than deleted, so you can review them and correct a rule that turns out to be too broad.

Domain locking

List the domains allowed to use a key. Requests from anywhere else are refused outright. Subdomains of a listed domain are accepted, so adding example.com also covers www.example.com.