Spam protection
Keep bots and junk answers out of your forms
Bots are caught quietly, with no puzzle for real people to solve. Typed answers that are just keyboard mashing get flagged so you can hide them. Free on every plan.
Free forever, with unlimited responses. No credit card.
Every public form attracts junk sooner or later. Some of it comes from scripts that fill in anything with a Submit button. Some of it comes from people mashing the keyboard to get past a required question. Both leave rows in your responses that you have to spot and delete by hand. The usual fix, a CAPTCHA, makes every real respondent prove they're human to stop a few who aren't. hootform deals with both without asking anyone to click on traffic lights.
How it works in hootform
- Bots fall into a trap. Every step has a field people can't see or reach, so only an automated script fills it in. The script is shown the form's normal ending, and nothing is stored, emailed or sent on. It can't tell it was caught.
- Steps are signed. Each step carries a token proving the page came from hootform recently, so a script posting straight to the form without loading it is turned away. A real person whose tab sat open for a day just presses Next again, with their answer still there.
- Floods are capped. One network address can start at most 100 responses to a form per hour. That's room for a whole office on one connection, and not much for one machine.
See spam and bot protection for the details.
Answers that are just keyboard mashing
Short text, long text and "Other" answers are checked as they arrive. When one clearly isn't an attempt to answer, like "asdfgh", the respondent is asked once to look again. Sending it again always goes through, so a real answer that was misjudged is never blocked. Doubtful answers that get through are marked Possible spam in your responses, where Hide possible spam takes them out of the way. See possible spam.
What's free, and what's Premium
| Free | Premium, $19/month | |
|---|---|---|
| Bot traps and signed steps, with no CAPTCHA | ✓ | ✓ |
| A limit on new responses per network address | ✓ | ✓ |
| Typed answers checked for spam, and marked for you | ✓ | ✓ |
| A Cloudflare bot check on new respondents, marking or blocking | ✓ | ✓ |
| Hiding possible spam and duplicates in Responses | ✓ | ✓ |
Premium is one price for the whole organization. See plans.
In the docs
Questions people ask
Is spam protection free?
Yes. Every part of it is on for every form, on every plan, with nothing to set up.
Will a real person ever be blocked?
No. Trapped bots never see an error, an expired page only asks for Next again, and an answer flagged as spam goes through the second time it's sent.
Can I turn the answer check off?
Yes. Open the form's Settings tab, choose Spam answers and clear the switch. It applies straight away. The bot protection stays on.
What's sent to be checked?
Only the question's title and what was typed into a text answer. If the check is slow or unavailable, the answer goes through unchecked rather than holding the respondent up.
More features
- Conversational forms Build conversational forms that ask one question at a time, with keyboard shortcuts, logic and answer recall. Free, with unlimited forms and responses.
- Conditional logic Add conditional logic to any form: skip questions, branch on any answer or hidden field, recall answers, and finish on different endings. Free.
- Quiz maker Make a scored quiz online: points per answer, a result screen that shows the score, and a different ending for each score band. Free, with unlimited responses.
- Multi-step forms Build multi-step forms that save every answer as it's given, so people can stop and resume, and you can see exactly where they stopped. Free.
- File upload forms Let people attach CVs, photos, screenshots and documents to any form. Files are stored with each response and encrypted at rest. Free up to 10 MB a file.
- E-signature forms Collect signatures on any form, drawn with a finger or a mouse, with consent checkboxes that record the exact wording agreed to. Free, and encrypted at rest.