Spam and bot protection

Public forms attract bots. hootform filters them out quietly, so there's no CAPTCHA for your respondents to solve and nothing for you to set up. It's on for every form, on every plan.

What hootform does

• A trap only bots fill in. Every step has a field that people can't see or reach, so only an automated script fills it in. When that happens, the script is shown the form's normal ending, but nothing is stored, emailed or sent to webhooks. It can't tell it was caught.
• A signed token on every step. Each step carries a token that proves the page came from hootform recently. A script posting straight to the form without loading it is turned away. A real person whose tab sat open for more than a day just sees "This page was open for a while. Press Next again to continue." with their answer still filled in.
• A limit on new responses. Any one network address can start at most 100 responses to a form per hour. That leaves room for a whole office or classroom sharing one connection, and stops a single machine flooding a form.

Uploads are checked before anything is stored, so files from a bot are never kept either.

Bot check

When someone starts a response, Cloudflare Turnstile checks their browser in the background. Most people never see anything; if Cloudflare isn't sure, they're asked to tick a checkbox. Only the start of a response is checked, never the steps after it.

Open the form's Settings tab and choose Bot check to pick what happens when someone can't be confirmed as a person:

• Mark as possible bot (the default) keeps the response and marks it Possible bot in Responses, where you can hide it. Nobody is turned away. See Possible bots.
• Ask to confirm they're a person shows "Confirm you're a person, then press Next again." with Cloudflare's checkbox, and starts the response only once it's ticked. This stops more bots, but someone whose browser or ad blocker blocks Cloudflare can't respond.
• Don't check turns it off for the form.

It applies right away, without publishing, on every plan.

Answers that look like spam

People can be the problem too: someone mashing the keyboard to get past a required question leaves answers like "sdsdsd" or "asdfgh". hootform checks typed answers as they arrive and catches these.

• Which answers are checked. Short text, long text and the text typed beside "Other". Everything else is picked from your options or already has a shape it must fit, like an email address or a date.
• Asked once, never stuck. When an answer clearly looks like spam, the respondent sees "That doesn't look like a real answer. Change it, or send it again to keep it." in their own language. Sending it again goes through, so a real answer that was misjudged is never blocked.
• Marked for you. Answers that get through but still look doubtful are marked Possible spam in Responses, where you can hide them. See Possible spam.

On a single-page form answers are checked when the respondent presses Submit; in a group of questions, when they press the step's button.

The check is on for every form, on every plan. To turn it off, open the form's Settings tab, choose Spam answers and clear Check typed answers for spam. It applies right away, without publishing.

If you still see junk

No filter catches everything. If unwanted responses get through:

• Delete them from the Responses tab. Insights stop counting them.
• Add a password if the form is only for people you know.
• Use a response limit for sign-ups with a fixed number of places.
• Mark duplicates out of the way with Hide duplicates. See Duplicates.
• Hide nonsense answers with Hide possible spam. See Possible spam.