Spam Protection

Nobody wants spam in their CRM. SkunkForms includes built-in spam protection to keep your submissions clean.

Built-in protection

Honeypot field

SkunkForms automatically adds an invisible honeypot field to every form. Bots fill in all fields they find, including hidden ones. If the honeypot field has a value, the submission is silently rejected.

This catches the majority of simple bots with zero user friction — your visitors never see or interact with the honeypot.

Token verification

Each form includes a unique token that's verified on submission. This prevents direct POST requests from bots that don't render the page.

Time-based checks

Submissions that happen too quickly (under 2 seconds after page load) are flagged as suspicious. Real humans don't fill out forms that fast.

reCAPTCHA (Pro)

For additional protection, Pro users can enable Google reCAPTCHA:

reCAPTCHA v3 (invisible)

The recommended option. Runs in the background, scores each visitor, and blocks submissions below a threshold. No puzzles, no friction.

1. Get reCAPTCHA v3 keys from Google
2. Go to SkunkForms → Settings → Spam Protection
3. Enter your Site Key and Secret Key
4. Set the score threshold (0.5 is recommended)

reCAPTCHA v2 (checkbox)

The classic "I'm not a robot" checkbox. More visible friction but very effective.

1. Get reCAPTCHA v2 keys from Google
2. Enter keys in SkunkForms settings
3. The checkbox will appear above the submit button

Blocked submissions

Spam submissions are blocked silently — the bot sees a success message, but no data is stored. This prevents bots from knowing they were detected and adapting.

Blocked submission counts are tracked in your form analytics so you can see how much spam is being filtered.

Tips for reducing spam

1. Avoid generic form URLs — Bots target common form endpoints
2. Use specific field labels — "What's your project about?" catches fewer bots than "Message"
3. Enable honeypot + token — These two together catch 95%+ of automated spam
4. Add reCAPTCHA for high-traffic forms — If you're getting targeted spam, reCAPTCHA v3 adds another layer
5. Review blocked submissions periodically — Make sure legitimate submissions aren't being flagged

CRM integration

Spam-blocked submissions never create CRM contacts. Only verified, legitimate submissions flow into SkunkCRM. This keeps your contact database clean from day one — important when you're using forms for lead generation.