Seven checks, on every submission.
Spam, copies of your form and floods are stopped before anything reaches your inbox, and you can see which check stopped them.FormRoute runs the same seven checks, in the same order, on every submission your form sends. The first check that fails decides the result. Nothing that fails a check is emailed.
The checks, in order
- 1
Form
Does this form exist, and is it switched on?
Every submission carries your form's key. An unknown key, or a form you have disabled, is refused straight away.
If it fails: Form disabled
- 2
Account
Can this account send right now?
The subscription must be active and the sending domain verified. If billing lapses, submissions are refused and listed; nothing is emailed.
If it fails: Not sent: account cannot deliver
- 3
Website
Did it come from a website you listed?
Browsers say which website a request comes from. Only the websites you list, up to 10, are accepted, so a copy of your form on another site gets nowhere.
If it fails: Rejected: website not allowed
- 4
Fields
Is it the form you set up?
Only the fields you configured are kept; anything else is dropped. Required fields must be filled in, values must fit the length you set, and the whole submission must be under 20 KB.
If it fails: Rejected: invalid fields
- 5
Honeypot
Did it fill in the field nobody can see?
Your form carries a hidden field called hp. People never see it, so they leave it empty; bots that fill in everything give themselves away. The bot is told the submission went through, so it learns nothing.
If it fails: Filtered as spam
- 6
Rate limit
Is someone sending again and again?
At most 20 submissions a minute from one visitor, 8 a minute from one visitor to one form, and 300 an hour to one form. Visitors are counted by IP address, in counters that expire after about a minute.
If it fails: Rate limited
- 7
CAPTCHA
Was it too fast for a person?
Your form reports how long it was open before it was sent. A submission sent in under 1.2 seconds is treated as automated and must pass a Cloudflare Turnstile challenge before anything is sent.
If it fails: CAPTCHA required
Passed all seven?
The submission is emailed to you from your own domain, and listed as Sent.
Five real kinds of submission.
Each stops at the check that catches it.- Form
- Account
- Website
- Fields
- Honeypot
- Rate limit
- CAPTCHA
- A visitor on your website: passes all seven checks.Sent
Emailed to you from your domain.
- Your form, copied onto another site: stopped at Website.Rejected: website not allowed
It came from a website you haven't listed.
- A bot that fills every field: stopped at Honeypot.Filtered as spam
It filled the hidden field people never see.
- One visitor, sending again and again: stopped at Rate limit.Rate limited
Too many from one visitor in a short time.
- A script that submits instantly: stopped at CAPTCHA.CAPTCHA required
Too fast for a person, so it's asked to prove it.
Passes all seven checks. Result: Sent. Emailed to you from your domain.
Emailed to you from your domain.
What your form sends.
Two small values make the spam checks work.hp. An empty text input hidden from people with CSS. It must stay empty; the snippet sends whatever is in it.
t. The number of milliseconds between showing the form and sending it. Measured in the browser by the snippet; a person always takes longer than 1.2 seconds.
What happens to refused submissions.
Nothing is emailed, and nothing they contained is kept.Listed with the reason. Every refusal appears in your account with the check that stopped it, so a real visitor who was refused is easy to spot.
Contents discarded. FormRoute records the result, the time and the check, never the values. In those records, visitor IP addresses appear only as keyed hashes.
Limits set for you. Rate limits and CAPTCHA are managed by FormRoute and tuned for contact, quote and booking forms. You decide the recipient, websites and fields.
No tracking scripts. The honeypot, timing and rate checks need no cookies and no third-party script on your page.