Skip to main content
Formpaste screens the website a form is deployed on against threat-intelligence to prevent the service from being used to relay email or host files on behalf of phishing, malware, scam, or otherwise abusive or illegal sites. This protects the platform’s email-sending reputation and keeps Formpaste within its infrastructure providers’ acceptable-use policies - abuse by one account can otherwise harm every customer.

​
How it works

  • The domain a form actually submits from (its request origin) is checked against threat-intelligence the first time we see it, and the result is cached.
  • A domain confirmed bad (a known phishing or malware match) causes the form to be paused: submissions are still accepted (visitors still see success), but they’re held - nothing is emailed to the form owner, and any uploaded files are not downloadable. The owner is notified that the form is under review, with a way to appeal.
  • Uncertain cases are queued for manual review; they do not pause the form.
  • A clean domain is unaffected - screening is invisible to you and your visitors.

​
Fail-open by design

If a threat-intelligence lookup itself fails (a network error, timeout, or rate limit), the domain is not paused. A lookup failure is never treated as a bad verdict - only a positive, known-bad match pauses a form.
This is the opposite of file virus-scanning, which fails closed. A domain lookup failure tells us nothing about the domain, so pausing on it would wrongly break legitimate forms - whereas an unscanned file could be genuinely dangerous, so it’s held until it can be scanned.

​
If your form was paused in error

Legitimate sites are unblocked. If you believe your form was paused by mistake, contact support to have it reviewed. Please don’t deploy Formpaste forms on sites engaged in phishing, malware distribution, or other abusive or illegal activity - such forms are removed.

​
Your visitors never see this

Screening never blocks a submission at the visitor’s end: a visitor on any domain always gets a success response, so a paused form is never an oracle that reveals it’s under review. The hold happens entirely on our side, between accepting the submission and delivering it.