Spam protection

Formstork runs server-side spam heuristics on every submission and quarantines anything that scores too high. It lands in your Spam tab instead of your inbox, and no email is sent. On top of that, you can add two layers.

Honeypot

The cheapest, most effective trick. Add a hidden field named botcheck. Real users leave it empty; bots fill it in. Any submission where botcheck is filled is silently dropped.

<input type="checkbox" name="botcheck" style="display:none" tabindex="-1" autocomplete="off">

CAPTCHA

For a stronger guarantee, add Cloudflare Turnstile (recommended), hCaptcha, or reCAPTCHA v3. Formstork verifies the token server-side and rejects failed challenges.

Cloudflare Turnstile:

<form action="https://api.formstork.com/submit" method="POST">
  <input type="hidden" name="access_key" value="YOUR_ACCESS_KEY">
  <input type="email" name="email" required>
  <textarea name="message" required></textarea>

  <div class="cf-turnstile" data-sitekey="YOUR_TURNSTILE_SITEKEY"></div>
  <button type="submit">Send</button>
</form>
<script src="https://challenges.cloudflare.com/turnstile/v0/api.js" async defer></script>

The widget adds a cf-turnstile-response field automatically. hCaptcha (h-captcha-response) and reCAPTCHA (recaptcha_response) work the same way, and Formstork detects whichever token is present.

Domain restriction

In your form’s settings you can whitelist the domains allowed to submit. Requests from anywhere else are rejected, so even if someone copies your access key, they can’t use it from their own site.