Spam protection

Forms stops automated spam without puzzles for your visitors, without outside services and without cookies, so it also works on pages served from a cache.

• A trap field, hidden from people, that robots fill in. Those messages look sent to the robot but are thrown away.
• A signed token with the time the page was opened. A form sent within three seconds is not accepted: the visitor sees a message and presses the button again. Pages left open for more than two days ask to send again too.
• A limit per hour for each address, five by default (Forms > Settings). The address is remembered for one hour as a fingerprint, never in clear.