Spam protection
Honeypot, rate limiting, and optional Cloudflare Turnstile on your public form.
Public support forms attract bots. SupportPage layers several defenses so legitimate customers can submit while automated abuse is blocked or slowed.
Open Support page → Settings → Spam protection in the dashboard. Settings apply to the customer-facing form — your team is not challenged when logged into the dashboard.
Defense layers
SupportPage combines multiple techniques:
| Layer | Visibility to customers | Purpose |
|---|---|---|
| Honeypot | Hidden | Traps bots that fill every field |
| Rate limiting | None when under limit | Blocks burst submission from one IP |
| Turnstile (optional) | Checkbox or challenge widget | Stronger bot detection when enabled |
Layers stack — a request must pass all enabled checks.
Honeypot field
A honeypot is a form field that humans never see (hidden with CSS). Bots often auto-fill it.
- If the honeypot has a value, the submission is silently rejected or discarded.
- Customers experience no extra steps.
- Always leave honeypot enabled — there is no meaningful downside for real users.
If you use aggressive browser extensions that auto-fill all inputs, rare false positives are possible. Disable extensions on your support URL when testing.
Rate limiting
Rate limiting caps how many submissions can come from the same source in a short window.
- Protects against floods and scripted attacks
- Legitimate users submitting one ticket are unaffected
- Heavy testers hitting the form repeatedly may temporarily hit the limit
When rate limited, customers may see a generic error or a "try again later" message. Wait a few minutes and retry.
If your team runs automated smoke tests against production, space out runs or use a staging page.
Cloudflare Turnstile (optional)
Turnstile is a privacy-friendly CAPTCHA alternative. When enabled on your support page:
- You connect Turnstile from the spam protection settings (site key provided in the UI).
- Customers complete a lightweight challenge on submit — often invisible or a single click.
- Failed challenges block submission with a clear error.
When to enable Turnstile
Enable when:
- You see spam in the inbox despite honeypot and rate limits
- The page is linked from a high-traffic marketing site
- Bots target your industry heavily
Skip Turnstile when:
- The form is behind login in your app and low traffic
- Accessibility requirements discourage any challenge widget — honeypot alone may suffice
Customer experience
From the customer's perspective:
- The widget appears near the submit button
- They interact once per session in most cases
- Failure shows inline — they can retry without losing other field values (browser permitting)
See FAQ — Turnstile.
What operators see
Blocked spam does not create inbox noise — rejected submissions never become requests. You will not get a notification per blocked bot.
If legitimate submissions fail:
- Check FAQ — silent form failures
- Temporarily disable Turnstile to isolate the issue
- Review rate limit timing if only burst testers are affected
Recommendations by traffic
| Traffic profile | Suggested settings |
|---|---|
| Internal / low volume | Honeypot + rate limit (defaults) |
| Public marketing site | Add Turnstile |
| Repeated bot waves | Turnstile + review form fields for unnecessary public exposure |
Related topics
- Publishing — only published pages need spam protection in production
- Submitting a request — customer-side errors
- FAQ