Spam and Rate Limiting
What is automatic, and what you never see
The spam and abuse protections built into every form -- nothing to configure.
What runs automatically
- A Cloudflare Turnstile check on every form, invisible to a real visitor most of the time.
- A rate limit of 5 submissions per 30 minutes, per visitor, per form -- someone hitting this limit sees a friendly message, not an error.
- A visitor is IP address is stored only as a hash, never in plain readable form, even to you.
None of this needs to be turned on or configured -- it applies to every form automatically.
If something still gets through
Mark it Spam in the Requests inbox. This is for your own organization only -- it does not train or improve the automatic filtering, which is intentionally simple and low-maintenance rather than a full spam-learning system.