Spam Protection

We built SmartFormify to keep forms open and easy for real people, while filtering out automated and abusive submissions. Below is a clear look at how we protect forms and what you can do to keep your data clean.

1. What we check by default

Every submission includes lightweight signals that help us identify automation without slowing down real users.

• 

  Time-to-submit checks plus interaction/focus signals that help flag unrealistically fast or scripted submissions.

• 

  Client metadata (like browser, device, viewport, and language signals) to help spot automation patterns.

• 

  Layered rate limits per IP, per fingerprint, and per form with independent thresholds to slow abusive traffic.

• 

  Access tokens with privacy-aware expiry windows, including longer public/embed sessions for better reliability and strict limits for protected forms.

• 

  Server‑issued visitor tokens bound to fingerprint and short TTL to reduce replay abuse.

• 

  Progressive proof‑of‑work challenges for suspicious traffic, with server-tracked expiring challenges.

• 

  Idempotency keys and duplicate payload hashing to prevent replay submissions.

2. Access controls that reduce abuse

Forms can be configured as public, limited, or private. Limited forms use strict, time-bound access tokens and can enforce single submission to reduce sharing and replay. Public forms keep a smoother experience by allowing safe token refresh when sessions are open for a long time. Private forms are blocked from public access entirely.

3. What happens to suspicious activity

If a submission looks suspicious, we may delay, block, or flag it for review. This helps keep your results clean without adding friction for legitimate users.

4. What you can do to keep forms clean

• 

  Keep sensitive forms in limited or private mode and share them only with the right audience.

• 

  Use clear field labels and add consent or verification steps when you need higher-quality responses.

• 

  Review your responses periodically and report suspicious activity so we can improve protections.

5. Submission integrity

We verify each submission with access-token checks, fingerprint-bound visitor tokens, and bot-guard payload validation. Idempotency keys and payload hashing reduce duplicates and replay attempts while keeping legitimate submissions reliable.

6. Embed-specific protections

Embeds can be controlled independently. Each embed type can be published or disabled, and you can restrict embeds to an allowlist of domains to prevent unauthorized reuse.

Bot-guard signals are enforced at submission time, with additional backend controls to keep long-open embed sessions usable for real users while still blocking suspicious activity.

7. Need help?

If you notice unusual activity or want advice on tightening form access, reach out to us at Contact Us.