Security & Spam Protection
Honeypot, CAPTCHA, double opt-in, IP/keyword restriction, disposable-email blocking, and compliance data deletion — all free.
Every tool on this page is free on every plan, with no license required.
Honeypot
An invisible-to-humans spam trap, on by default for every form — no configuration needed to get baseline protection.
CAPTCHA
Global Settings → Security: pick one of reCAPTCHA, hCaptcha, or Cloudflare Turnstile, add your site and secret keys, then add the matching field to any form that needs it.
Double opt-in
Global Settings → Email → Double Opt-in: require email confirmation before a submission counts — useful for newsletter or lead-gen forms where a confirmed, real email address matters more than raw submission volume.
IP-based and keyword-based restriction
Block a form from specific IP addresses, or reject any submission containing a banned word, with a custom message shown to whoever gets blocked.
Disposable email blocking
Reject submissions using a known temporary-inbox domain (mailinator, 10minutemail, and similar services) — useful anywhere a real, reachable email address matters, like account signups or payment receipts.
Compliance: Delete Entry Data
An option to wipe a submission's actual field values immediately after its notifications and integrations have run, keeping only the entry row itself for counting purposes — for sites that specifically don't want to retain visitors' personal data after processing it once.
File upload storage
Uploaded files are stored outside the public uploads folder and served through an authenticated route rather than a guessable direct URL — a File Upload field doesn't hand out a public link to whatever was uploaded.