Keep your forms bot-free with multiple layers of spam protection.
Hidden field that catches bots automatically
Blocks submissions that are too fast
Optional challenge for suspicious traffic
A honeypot is a hidden field that real users won't see or fill, but bots typically will. This is the easiest and most effective spam prevention method.
<input type="text"
name="_formigo_hp"
value=""
style="display:none"
tabindex="-1"
autocomplete="off">Use display:none
Don't use visibility:hidden or positioning tricks
Add tabindex="-1"
Prevents keyboard users from accidentally focusing the field
Add autocomplete="off"
Prevents browsers from auto-filling the field
The field must remain empty. If it's filled, the submission will be flagged as spam (100 points).
Timestamp validation prevents bots that submit forms instantly. Real users take at least a couple seconds to fill out a form.
<!-- Hidden input for timestamp -->
<input type="hidden" name="_formigo_t" value="">
<script>
// Set timestamp when form loads
document.querySelector('input[name="_formigo_t"]').value =
Math.floor(Date.now() / 1000);
</script>This works even if JavaScript is disabled - the field will just be empty and add minimal spam points. Real users won't be blocked.
For high-value or high-spam forms, you can add CAPTCHA protection. Formigo supports both hCaptcha and Cloudflare Turnstile.
Free, privacy-friendly, and less intrusive than reCAPTCHA.
Privacy-focused alternative to reCAPTCHA with better accessibility.
<!-- Add Turnstile widget -->
<div class="cf-turnstile" data-sitekey="YOUR_SITE_KEY"></div>
<!-- Load Turnstile script -->
<script src="https://challenges.cloudflare.com/turnstile/v0/api.js"
async defer></script>
<!-- Hidden field (auto-populated by Turnstile) -->
<input type="hidden"
name="_formigo_captcha"
class="cf-turnstile-response"><!-- Add hCaptcha widget -->
<div class="h-captcha" data-sitekey="YOUR_SITE_KEY"></div>
<!-- Load hCaptcha script -->
<script src="https://js.hcaptcha.com/1/api.js"
async defer></script>
<!-- Hidden field (auto-populated by hCaptcha) -->
<input type="hidden"
name="_formigo_captcha"
class="h-captcha-response">You'll need to enable CAPTCHA in your form settings and provide your secret key for validation.
Here's a complete form with all spam protection layers (without CAPTCHA):
<form action="https://formigo.com/f/your-form" method="POST">
<!-- Your actual form fields -->
<div>
<label for="name">Name:</label>
<input type="text" id="name" name="name" required>
</div>
<div>
<label for="email">Email:</label>
<input type="email" id="email" name="email" required>
</div>
<div>
<label for="message">Message:</label>
<textarea id="message" name="message" required></textarea>
</div>
<!-- Spam protection fields -->
<!-- Honeypot (hidden field) -->
<input type="text"
name="_formigo_hp"
value=""
style="display:none"
tabindex="-1"
autocomplete="off">
<!-- Timestamp -->
<input type="hidden" name="_formigo_t" value="">
<button type="submit">Send Message</button>
</form>
<script>
// Set timestamp when form loads
document.querySelector('input[name="_formigo_t"]').value =
Math.floor(Date.now() / 1000);
</script>Formigo automatically rate limits submissions to prevent abuse:
5 submissions
Per IP, per form, every 10 minutes
20 submissions
Per IP, all forms, per hour
When rate limits are exceeded, the API returns a 429 Too Many Requests status with a retry_after value in seconds.
Each submission is assigned a spam score based on triggered checks:
Submissions with a score of 100 or higher are marked as spam.
Spam submissions are stored but notifications are not sent.
These two fields catch 95% of spam with zero user friction.
CAPTCHA adds friction. Start without it and add only if you see spam.
Check your spam folder in the dashboard for false positives.
Use display:none, not visibility tricks that might confuse screen readers.
Keep an eye on submission patterns and adjust protection as needed.