> ## Documentation Index
> Fetch the complete documentation index at: https://formpaste.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Spam filtering

> Heuristic spam filtering with zero per-submission cost - no CAPTCHA puzzles for your visitors.

<Info>**Free** - included on every plan, no configuration required to turn it on.</Info>

Every submission to `/submit` is scored by a set of cheap heuristics before it's
delivered. There's no CAPTCHA to solve, no external anti-spam API call, and no
per-submission cost - scoring happens inline, in the same request.

## How filtering works

This is a deliberate design choice, not a missing feature. Formpaste never
shows your visitors (or an AI agent submitting on their behalf) a puzzle to
solve. Heuristics do the work instead.

## What's checked

<Tabs>
  <Tab title="Honeypot">
    Every form should include a hidden `botcheck` field that real visitors
    never see or fill in (hide it with CSS, not `type="hidden"`, so
    unsophisticated bots that skip hidden inputs still fall for it). If
    `botcheck` arrives non-empty, the submission is quarantined.

    ```html theme={null}
    <input type="text" name="botcheck" style="display:none" tabindex="-1" autocomplete="off">
    ```
  </Tab>

  <Tab title="Timing">
    An optional `_ts` field carries the timestamp the form was rendered.
    Submissions that arrive implausibly fast - faster than a human could have
    read and filled the form - score as suspicious.
  </Tab>

  <Tab title="Link density">
    Submitted text is scanned for URLs. A message packed with multiple links
    is a common spam pattern and scores accordingly.
  </Tab>

  <Tab title="Content signals">
    The message text is checked for known spam terms (in several languages),
    common letter/symbol obfuscations of those terms, and structural shapes like
    long stretches of ALL-CAPS shouting or runs of excessive punctuation. Each is
    a weak signal that adds to the score rather than blocking on its own, so a
    normal message that happens to use one of them is not quarantined by that
    alone.
  </Tab>

  <Tab title="Rate">
    Repeated submissions from the same source in a short window are rate
    limited, independent of content.
  </Tab>

  <Tab title="Disposable & duplicate email">
    Submissions from disposable/throwaway email providers can be flagged (see
    the allow-disposable-email toggle in [Domain allowlist](/docs/features/custom-domains)),
    and near-identical repeat submissions to the same form are detected as
    duplicates.
  </Tab>
</Tabs>

## Allowlisting trusted senders

If a sender you trust keeps getting caught, add their email to the form's
allowlist: open the form, go to **Configuration**, and add the address under
**Allowlisted senders**. Their future submissions to that form skip the spam
heuristics (the honeypot still applies). Marking a quarantined submission as
**Not spam** also adds its sender to this list. The allowlist is per form and
holds up to 100 senders.

## Suspicious, never dropped

A submission that scores high enough isn't discarded - it's routed to the
form's [quarantine](/docs/features/quarantine) folder instead, where you can see
it landed and review it. Nothing submitted to a valid `access_key` disappears
silently.

## Using it

There's nothing to turn on. Add the `botcheck` honeypot field to your form
(see [Framework snippets](/docs/framework-snippets) - it's already wired into
each one) and, optionally, a `_ts` field. Every other heuristic runs
automatically on every submission.

## Related errors

| Code           | HTTP | Meaning                                                      |
| -------------- | ---- | ------------------------------------------------------------ |
| `rate_limited` | 429  | Too many submissions from this source in the current window. |

See the full [error reference](/docs/reference/error-table) for the rest of the
`/submit` error codes.

Learn more about [what spam filtering is](https://formpaste.com/features/spam/)