Free - included on every plan, no configuration required to turn it on.
/submit is scored by a set of cheap heuristics before it’s
delivered. There’s no CAPTCHA to solve, no external anti-spam API call, and no
per-submission cost - scoring happens inline, in the same request.
How filtering works
This is a deliberate design choice, not a missing feature. Formpaste never shows your visitors (or an AI agent submitting on their behalf) a puzzle to solve. Heuristics do the work instead.What’s checked
- Honeypot
- Timing
- Link density
- Content signals
- Rate
- Disposable & duplicate email
Every form should include a hidden
botcheck field that real visitors
never see or fill in (hide it with CSS, not type="hidden", so
unsophisticated bots that skip hidden inputs still fall for it). If
botcheck arrives non-empty, the submission is quarantined.Allowlisting trusted senders
If a sender you trust keeps getting caught, add their email to the form’s allowlist: open the form, go to Configuration, and add the address under Allowlisted senders. Their future submissions to that form skip the spam heuristics (the honeypot still applies). Marking a quarantined submission as Not spam also adds its sender to this list. The allowlist is per form and holds up to 100 senders.Suspicious, never dropped
A submission that scores high enough isn’t discarded - it’s routed to the form’s quarantine folder instead, where you can see it landed and review it. Nothing submitted to a validaccess_key disappears
silently.
Using it
There’s nothing to turn on. Add thebotcheck honeypot field to your form
(see Framework snippets - it’s already wired into
each one) and, optionally, a _ts field. Every other heuristic runs
automatically on every submission.
Related errors
See the full error reference for the rest of the
/submit error codes.
Learn more about what spam filtering is