Receive
Spam and duplicates
Built-in checks, captcha, blocked domains and per-form duplicate rules.
Suspected spam is stored under Submissions, Spam, never deleted silently. No notifications are sent for it. Mark a submission as not spam to move it to the inbox and deliver it.
Built in
- A honeypot field that real visitors never see; anything typed into it marks the submission as spam.
- A timing check: a form completed in under two seconds is flagged.
- Rate limits: 10 submissions per visitor per form every 10 minutes, and a limit per store.
- Validation of every field on the server, regardless of what the browser sent.
Captcha
Settings, Spam protection, choose Cloudflare Turnstile or hCaptcha and enter your site key and secret. The challenge is shown on every form and verified on the server. Available on Pro and Scale.
Blocked domains
Settings, Spam protection:
- Blocked domains: one domain per line. Subdomains of a blocked domain are blocked too.
- Block disposable addresses: rejects common throwaway email providers.
Submissions from blocked addresses go to Spam with the reason shown on the submission.
Duplicates
Per form, in the editor's Form tab under Duplicate submissions:
- Allow several (default).
- One per email address.
- One per email address within a number of days, 1 to 365.
A duplicate is refused on the storefront with a message you can customise, for example for giveaways and registrations.
Something missing? Submit a ticket.