formtoDashboard

Spam and allowed origins

formto stops most spam without a CAPTCHA:

  • The honeypot. The hidden _gotcha field is empty for people and filled by bots. formto drops filled ones silently.
  • Allowed origins. List your site's hostnames on the project and posts from anywhere else are refused with 403 origin_not_allowed. Subdomains of an allowed host are allowed too.
  • Rate limits. Each project accepts a set number of posts per minute; bursts above it are refused.
  • Triage. Responses that look like spam are labelled so they do not clutter your inbox.

Allow only your site

Create the project with its origins. formto init does this for you from package.json homepage.

sh
curl -fsS https://api.formto.io/v2/projects \
  -H "Authorization: Bearer $FORMTO_TOKEN" -H 'content-type: application/json' \
  -d '{"name":"Marketing site","allowedOrigins":["example.com"]}'

You can change allowed origins later in the dashboard under Projects. A project with no allowed origins accepts posts from any site.