Spam Protection

OrbitForms protects every form with multiple layers of defense that work automatically — no setup required.

​

Protection Layers

​

How It Works

When a user submits your form, OrbitForms applies protection layers in sequence:

1. Rate limiting — Obvious spam bursts are rejected before any database work happens. If the same IP exceeds the limit within the time window, the submission is blocked.
2. Honeypot — Honeypot fields are invisible to humans but bots often auto-fill every field. When a honeypot is filled, the submission is silently discarded — the bot gets a fake success response so it never learns it was caught, and no submission is stored.
3. reCAPTCHA v3 — Google scores the user’s behavior; low-scoring submissions are rejected.

Submissions that pass all checks are processed normally.

​

Publish-Time Abuse Checks

Spam protection extends beyond individual submissions. When you publish a form, OrbitForms runs an abuse pipeline:

• Field-label denylist — Blocks forms impersonating well-known brands or requesting credentials
• Heuristic scoring — Flags phishing-shaped forms before they go live
• AI review — An asynchronous review that can automatically unpublish forms flagged as phishing

This keeps the orbitforms.ai domain trustworthy for everyone and protects your form links from being flagged by browsers and email providers.

​

Best Practices

• Use email verification (Pro) — Verify email addresses at entry to keep fake leads out of your CRM. See the form’s Integrate tab for providers like ZeroBounce, Emailable, and NeverBounce.
• Watch your analytics — Sudden submission spikes with low conversion often indicate bot traffic.
• Test after changes — Submit a test entry after publishing to make sure real users can still submit successfully.

​

Next Steps