Integrate
Rate limits and spam
The honeypot, per-IP and per-email limits, what happens to a caught response, and how to restore one.
Honeypot
Hosted forms include a hidden field named sweetidentity; your own markup should too. People never see it. Automated submitters fill every field they find, so a non-empty value marks the response as spam: it is stored in the Spam tab, never emailed and never sent to webhooks, and the endpoint still answers 200.
Limits
| Limit | Scope | Effect |
|---|---|---|
| 20 requests per minute | Per IP address, all forms | Further requests get 429 |
| 5 responses per hour | Per email address, per form | Further responses are stored as spam; the sender is told once |
| 100 KB body | Per request | 400 |
The per-email limit is what stops a visitor (or a script using their address) from flooding you. The first time it trips, the address receives one short notice. Enterprise plans can raise both limits.
Restoring a response
Open the form's Responses → Spam tab, select the response and choose Not spam. It moves back to the inbox as unread. Emails and webhooks are not re-sent.
No captchas
These measures catch the automated junk that makes up almost all form spam without making visitors solve puzzles. If a specific form attracts targeted abuse, close it, change its slug, or contact support for stricter limits.
Something missing or wrong? Email us and we will fix it.