Advanced spam controls
Configure Qubeforms Pro spam protection with CAPTCHA, scoring, rate limits, and content rules. Review Trust Passport signals, quarantine settings, and false positives.
1. Start with the defaults
All plans have origin checks, a honeypot, content scoring, and per-form/IP rate limits. Pro and Business add configurable spam controls under Settings → Delivery & spam. As the owner, begin with Balanced sensitivity and Quarantine in Spam, save, and inspect representative submissions before tightening the rules. Downgrading below Pro returns new submissions to the standard policy; do not rely on premium settings remaining active.
2. Choose sensitivity and action
Suspicion scores run from 0 to 100. Relaxed classifies scores of 70 or more as spam, Balanced uses 50, and Strict uses 30. Quarantine in Spam keeps suspicious submissions for review and suppresses their normal delivery; spam does not consume the monthly accepted-submission allowance. Reject without storing returns HTTP 422 and stores no submission, so you cannot recover it from the inbox. Scores and Trust Passport grades are related but not identical to the threshold selected for your form.
3. Configure timing, links, and rate limits
Minimum completion time accepts 2–30 seconds; it adds suspicion when a submitted start timestamp shows a faster completion. Add _cf_started_at as Unix seconds when the visitor starts the form, not just before sending. Without that timestamp, the completion-time signal is unavailable. Maximum links accepts 0–20 and adds suspicion when exceeded rather than acting as an unconditional rejection. Attempts per window accepts 3–100, and Rate-limit window accepts 60–3,600 seconds. The defaults are 20 attempts per 600 seconds. Exceeding velocity limits returns HTTP 429 regardless of quarantine mode.
<input type="hidden" name="_cf_started_at" id="form-started-at">
<script>
document.querySelector('#form-started-at').value = Math.floor(Date.now() / 1000);
</script>4. Add phrases and email-domain rules
Enter one Blocked phrase per line, up to 50 phrases of 2–100 characters. Matching is case-insensitive against submitted scalar values and adds to the score; a phrase match is not necessarily rejected on its own. Allowed and blocked email-domain lists accept up to 50 domains, such as example.com, with no scheme or path. A listed domain includes its subdomains. The domain check uses the field selected by Reply-To field, normally email. A valid blocked domain adds suspicion even if also allowed; a nonempty allowlist adds suspicion for other valid domains. These lists do not validate a missing or malformed email address or require the visitor to complete an email field.
5. Connect CAPTCHA
Choose hCaptcha, reCAPTCHA, or Turnstile only after the matching public site key and server secret are configured. Expand Configured CAPTCHA site keys to find available public keys; contact the operator if none are present. Add the provider’s widget to your form and ensure its site configuration accepts your website hostname. Native h-captcha-response, g-recaptcha-response, and cf-turnstile-response fields are accepted. A JavaScript integration may instead send the response as _cf_captcha_token. Send the response token, never the secret. Missing or failed CAPTCHA verification returns HTTP 422 before storage, even in quarantine mode.
6. Read the Trust Passport
Open a submission and inspect its score, grade, signals, and recorded policy. Signals identify causes such as honeypot_completed, completed_too_quickly, excessive_links, blocked_keyword, email_domain_blocked, or velocity_elevated. Compare legitimate and unwanted submissions to decide which setting to change. A high score explains suspicion; it is not proof that a sender is malicious. Privacy-notice and consent-field metadata are also recorded with the passport; see Privacy notice and consent fields.
7. Review false positives
Use the Spam folder to review quarantined submissions and move legitimate entries back to Inbox using the available inbox actions. This corrects the record’s classification; do not assume it automatically resends previous notifications. Rejected submissions have no stored record to restore. Adjust one setting at a time and test with real field names, file uploads, mobile completion times, and the CAPTCHA widget. Keep the honeypot empty and hidden from ordinary visitors.
8. Understand storage safeguards
Quarantined spam remains subject to retention and daily storage ceilings: defaults are 500 records on Free, 2,500 on Starter, 10,000 on Pro, and 25,000 on Business per form/day. Reaching a storage ceiling returns HTTP 429 rather than storing more spam. A 429 response is not a broken CAPTCHA or a CORS error. Follow Retry-After when present and inspect the form’s traffic before loosening controls.
Public form keys can appear in browser code. Read keys, management credentials, and webhook signing secrets must stay on the server.