Spam Protection Docs: Honeypots & Rate Limiting
Prevent form spam with invisible honeypot fields, per-IP rate limits, and origin checks — how each layer works and how to configure it.
What is the core specification for spam protection docs: honeypots & rate limiting?
Form2Lead blocks form spam with three server-side layers: an invisible honeypot field (_gotcha) that bots fill but humans never see, distributed IP + form rate limiting, and submission-signature analysis. Flagged submissions are quarantined in a Spam tab instead of your live inbox — with zero CAPTCHA friction for real visitors.
<input type="text" name="_gotcha" style="display:none !important" tabindex="-1" autocomplete="off" />
How the honeypot works
Add a hidden text input named _gotcha to your form and hide it with CSS. Real users never see or fill it. Automated bots that crawl your HTML and auto-fill every field will populate it — Form2Lead detects the filled value and silently drops the submission without ever notifying you or the bot.
Rate limiting without CAPTCHAs
Every endpoint is protected by layered rate limits (per form-IP pair, per form, per organization, per IP) powered by Upstash Redis. A burst of automated submissions trips the limit and returns HTTP 429 — long before it can burn your monthly quota or pollute your lead pipeline.
Reviewing flagged submissions
Submissions that fail signature checks are moved to the Spam tab in your dashboard instead of being discarded. You can inspect the payload and reclassify a false positive to your main inbox at any time.
Spam Protection Docs: Honeypots & Rate Limiting FAQ
Will the honeypot field affect my analytics or SEO?
No. The field is invisible to humans and search engines — it is a standard accessibility-safe pattern used across the form-backend industry. Use display:none with tabindex="-1" and autocomplete="off" as shown.
What happens when my form is rate-limited?
The caller receives HTTP 429 with a JSON error body. Legitimate visitors on the same IP are briefly limited, so Form2Lead also enforces per-form quotas that reset automatically.