How spam is kept out
The short answer
Every form has two spam checks: a bot test from Cloudflare, and a hidden box that only bots fill in. If the bot test itself is down, the lead still comes through, because losing a real customer is worse than one spam message.
Two checks, both invisible
A bot test from Cloudflare. Cloudflare is one of the biggest security companies on the internet. Its test runs quietly in the background and tells real people from bots, almost always without asking anyone to click pictures of traffic lights. A test passed on one website can't be reused to send a lead to another.
A hidden box only bots fill in. Every form has a box people can't see. Bots fill in every box they find. When that box is filled in, the lead is thrown away, and the bot is told it worked, so it learns nothing.
Why a real lead is never refused because of a hiccup
Spam checks can fail too. Cloudflare can be slow to answer, or not answer at all. If that happens, we take the lead anyway and make a note of it.
That's a deliberate choice. If a spam check fails, one spam message might get through, and you delete it in two seconds. If we refused leads whenever the check failed, a real customer with a burst pipe would press send, and you'd never know they tried.
The only lead we refuse is one that Cloudflare actually looked at and said came from a bot.
See what Rule & Form would build for your business.
Free to build and look at. $299 a month when you want it live. No setup fee, no contract.
Questions first? Talk to us.