Spam protection
Catch the bots. Never lose a customer.
Three layers, in front of every form. A hidden field crawlers fill in, a Cloudflare Turnstile challenge you can switch on per form and rate limits a script hits long before a person does.
The rule that shapes all three: a check may label a submission and it may never refuse one.
On every plan, including the free one
How it works
Six things that are true of every form
Two of them are on before you have configured anything. The third is one switch and two keys.
Cloudflare Turnstile, checked on our server
The widget is optional per form and off until you switch it on. The token it produces is verified against Cloudflare from our own server, so a token forged in a browser is worth nothing.
A honeypot on every form
A field a person never sees and a crawler fills in anyway. It costs nothing, it needs no configuration and it catches the cheapest half of the traffic before anything else runs.
Rate limits per form and per address
Twenty submissions a minute from one address to one form. Separate ceilings on views, starts and uploads. A script pointed at your form runs into a wall your customers never touch.
No vendor script inside the form
The challenge runs on the hosted page we serve. Your site loads our loader and nothing else, so switching this on adds no third-party script to your own pages.
Every verdict is on the record
Passed, failed or could not be checked, the result is written onto the audit row for that submission. You can read what happened rather than guess why a lead looks odd.
A three second ceiling
The check is given three seconds. If Cloudflare is slow or down, the submission is captured and the verdict is recorded as unverified, because a customer waiting on somebody else at their moment of intent is the worse failure.
The rule
A failed challenge does not lose the lead
A CAPTCHA that blocks submissions blocks customers. Somebody on an office VPN, somebody with a privacy extension, somebody on a train with two bars of signal: every one of them fails a challenge sometimes. Every one of them is worth more than the spam.
So PopzIQ captures the submission whatever the verdict says and records the verdict beside it. A rejected token, a missing token and a Cloudflare outage all keep the lead. You get to decide what a failed check means, with the answer already in your hand.
The honeypot is the one exception. It is not a judgement call: a field no human can see, filled in, is a crawler. That submission is dropped and the page thanks it exactly the way it would thank anybody, so a crawler learns nothing about why it failed.
| Verdict | What happens |
|---|---|
| Passed | Captured. The audit row says passed. |
| Failed | Captured. The audit row says failed, so you can look. |
| Could not be checked | Captured. The audit row says unverified. Cloudflare was slow, unreachable or the deployment has no keys. |
| Honeypot filled | Dropped. Nothing is stored, nothing is counted and the ordinary thank-you page is returned. |
The ceilings
What a script runs into
Per form and per address, on a one minute window. A person filling in your contact form will never meet one of these.
| Route | Ceiling | Counted per |
|---|---|---|
| Submitting a form | 20 a minute | Form and address |
| Viewing a form | 600 a minute | Form and address |
| Starting a form | 30 a minute | Form and address |
| Uploading a file | 10 a minute | Form and address |
| The public API | 300 a minute | API key |
Where this stops
There is no spam score. PopzIQ records what each check said and does not blend them into a number and a threshold. A number that quietly deletes leads is the thing this page exists to avoid.
Turnstile needs its own keys. It is a Cloudflare product and you switch it on per form. A form with it off renders a page identical to the one it rendered before, byte for byte.
Nothing is quarantined. A submission that failed a check lands in your submissions like any other, labelled. There is no second inbox to remember to check.
The form still works with JavaScript off. Which is also why a challenge cannot be the thing standing between a visitor and your business.
Switch it on for one form and see
The honeypot and the rate limits are already running on every form you publish. Turnstile is a toggle on the form you worry about.
No card to start. No trial clock. The free plan runs the whole loop.