The Problem with Traditional CAPTCHAs
Nobody likes solving puzzles just to send a contact message. Traditional CAPTCHAs hurt conversion rates and frustrate users. FormBox takes a multi-layered, invisible approach to spam protection.
1. Invisible Honeypot Fields
Every FormBox endpoint automatically checks for honeypot fields. By simply adding a hidden input field to your form, you can trap automated bots that blindly fill out every field they see. If the honeypot is filled, the submission is silently dropped—no annoying errors for the user, and no spam in your inbox.
<input type="text" name="_honeypot" style="display:none" tabindex="-1" autocomplete="off" />
2. Privacy-First Altcha (Built-in)
We natively support Altcha, a brilliant cookie-less, proof-of-work CAPTCHA. It runs a quick cryptographic challenge in the user's browser in the background. It's completely GDPR compliant and requires zero interaction from your real human visitors.
3. Cloudflare Turnstile (BYOK)
If you prefer Cloudflare's Turnstile, FormBox lets you Bring Your Own Key (BYOK). Just enter your Turnstile secret key in the FormBox dashboard, add the Turnstile script to your frontend, and we'll automatically validate the tokens on our secure backend before accepting the submission.
4. Endpoint Rate Limiting
To prevent malicious brute-forcing or automated floods, every endpoint has aggressive, dynamic rate limiting applied. This protects your quota and ensures your endpoint remains available for legitimate users.