# Spam protection

The four spam defenses in Easerix Forms — honeypot, content filter, AI filter, and Cloudflare Turnstile — and what "marked as spam" means.

Canonical: https://easerix.com/docs/forms/spam

<Answer>
Forms ships four layers of spam protection: a hidden honeypot field, a
zero-setup content filter with four sensitivity levels, an AI filter where
Claude reviews borderline submissions, and Cloudflare Turnstile verification.
Flagged submissions still return success to the bot, but they stay out of your
inbox and are never emailed.
</Answer>

All four are configured per form under **Settings → Spam protection** on the form's page.

| Mechanism | What it does | Needs changes on your page? |
|---|---|---|
| Honeypot field | Hidden field that only bots fill in | Yes — add one hidden input |
| Content spam filter | Scores the submitted text for spam signals | No |
| AI spam filter | Claude reviews submissions the content filter can't decide | No |
| Cloudflare Turnstile | Verifies a CAPTCHA token with each submission | Yes — embed the Turnstile widget |

## Honeypot field

Add an input named `_gotcha` (or `_honey`) to your form and hide it with CSS. Humans never see it; naive bots auto-fill every field. On by default for new forms.

```html
<input type="text" name="_gotcha" tabindex="-1" autocomplete="off"
       style="position:absolute;left:-9999px" />
```

If the field arrives with a value, the submission is **silently** marked as spam — the bot still gets a success response, so it can't learn it was caught. The field itself is stripped and never shows in your inbox.

## Content spam filter

A zero-configuration filter that scores the text of every submission — no CAPTCHA, no keys, works on any domain. It looks for signals like multiple links, known spam keywords, BBCode/HTML link markup, disposable email domains, automated user agents, all-caps shouting, gibberish, and walls of digits. It's deliberately conservative: one weak signal never flags a message; spam has to accumulate several independent signals.

Pick a sensitivity level in the app:

| Level | Behavior |
|---|---|
| Off | No content filtering |
| Low | Catches only obvious spam |
| Medium | Recommended — balanced filtering (the default) |
| High | Aggressive — may flag borderline submissions |

## AI spam filter

Toggle **AI spam filter** on and Claude adjudicates the gray zone. The content filter splits submissions into three bands: obvious spam and obvious clean are decided instantly by the heuristics — only the ambiguous middle band goes to Claude, which weighs whether a real human plausibly wrote the message for your form's purpose.

- Your endpoint stays instant: classification runs after the submission is saved.
- Email delivery for a borderline submission waits for the verdict and only goes out if it's clean — usually a matter of seconds.
- If flagged, the inbox shows the model's stated reason (prefixed `AI:`).
- If the AI check ever fails, filtering falls back to the plain content filter — nothing is lost.

## Cloudflare Turnstile

Toggle **Cloudflare Turnstile** on and every submission must carry a valid Turnstile token: embed the Turnstile widget in your form, and it adds the token (a `cf-turnstile-response` field) automatically on submit. JavaScript clients can send the token in an `X-Turnstile-Token` header instead.

A submission with a missing or failed token is silently marked as spam — again, the bot sees a normal success response. Because of that, **only enable Turnstile if your page actually renders the widget**; otherwise every legitimate submission gets flagged.

## Which should I use?

- **Honeypot + content filter at Medium** is the sensible default for most forms — it requires nothing beyond the hidden field. New forms start with honeypot, a Medium content filter, **and Turnstile** switched on; if your page doesn't render the Turnstile widget, switch Turnstile off.
- Add the **AI filter** when spam that reads almost like a real message keeps slipping through, or when High flags too many real messages.
- Add **Turnstile** when a form is under sustained bot pressure and you control the page enough to embed the widget.

## What "marked as spam" means

A flagged submission is not deleted — it's quarantined:

- It's kept in the form's inbox behind the **Show spam** toggle, tagged with a `spam` badge and a **Flagged:** reason explaining which rule caught it.
- No notification email is sent, no autoresponder goes out, and it doesn't count in the form's submission charts.
- The sender always receives a normal success response, so bots can't probe the filters.

Use the shield button on any submission to retriage it — mark spam as not-spam or vice versa — or delete it outright.

## Frequently asked questions

### Does a blocked bot know it was blocked?

No. Every spam path returns the same success response a clean submission gets. That's deliberate: filters that reveal themselves get worked around.

### A real message was flagged — what do I do?

Turn on **Show spam** in the inbox, find it, and mark it as not spam with the shield button. It's back in your inbox with full contents. Note that retriaging doesn't re-send the notification email — read it in the inbox.

### Can I turn everything off?

Yes: switch the honeypot, Turnstile, and AI filter off and set the content filter to **Off**. Every submission then lands in your inbox untouched. (Endpoint rate limiting still applies — see the [reference](/forms/reference).)