Automatic spam protection

ContactFire filters spam before it reaches your inbox. Three independent layers catch bots without ever showing a CAPTCHA to real visitors.

How it works

Rate limiting

Requests are rate-limited per IP address. Cloudflare provides an additional edge layer that absorbs floods before traffic reaches the server.

Honeypot trap

A hidden field that no real user sees or fills in. Automated bots that fill all fields indiscriminately are silently discarded.

Server-side heuristics

Submissions that do not match natural human behaviour are flagged for review rather than passed to your inbox.

Honeypot trap

ContactFire embeds a hidden field that real users never see or interact with. Automated bots that blindly fill every input are caught and discarded at this step.

No action required. When you use the JS embed snippet or Form Studio, the honeypot is injected and managed automatically. You do not need to add anything to your HTML.

Rate limiting

ContactFire enforces rate limits at two layers: Cloudflare blocks flooding attempts at the network edge before they reach the server, and the application server applies its own per-IP limits for an additional layer of defence.

Rate limiting	Per IP address, at both the network edge and application layer
Enforcement	Cloudflare edge + application server (two independent layers)
Response to blocked IPs	HTTP 429: try again later

Heuristic checks

Submissions that pass rate limiting and the honeypot check are analysed server-side. Patterns inconsistent with a real human filling in a form are flagged automatically.

Flagged submissions are not deleted. They are stored with a spam flag and excluded from your default inbox view. You can review and recover them any time from Inbox → Spam.

Flagged submissions

When a submission is flagged as spam:

The API returns a normal success response: the submitter is never told they were flagged
The submission is stored with a spam flag
No email notification is sent
The submission appears in the Spam inbox tab in your dashboard

To review spam: open Inbox → Spam. You can mark any submission as "not spam" to move it to your main inbox.

Avoiding false positives

Legitimate submissions are rarely flagged, but here is what can cause a false positive and how to prevent it:

⚠ Automated test scripts submitting forms

✓ Use a server-side API key for automated testing. API-key submissions skip browser-behaviour checks designed to catch bots.

⚠ High-volume burst from a backend integration

✓ Space out rapid-fire submissions with a short pause between requests, or contact support to discuss your volume needs.

⚠ Email field contains multiple URLs

✓ Reduce the link count in the message field, or contact support to review your account settings.

Manual review

You can always access spam submissions from your dashboard:

Go to Inbox
Click the Spam tab
Open any submission to view its full content
Click Not spam to move it to your main inbox

Previous: API Reference Next: Notifications