Spam-free contact form, no CAPTCHA.

A spam-free contact form filters out automated and low-quality submissions before they reach you, so your inbox only shows real messages. splitforms does this with a layered server-side defense — honeypot, time-trap, IP rate limiting, and content heuristics — that runs on every POST to splitforms.com/api/submit in under 50ms. Typical sites stop 95–99% of spam at the edge. No form is 100% spam-proof forever, but layered filtering removes the overwhelming majority with no work on your side.

No. There is no CAPTCHA, no reCAPTCHA checkbox, and no "select all the traffic lights" puzzle. The defense is entirely server-side, so your visitors never get challenged and your conversion rate doesn't take the hit that CAPTCHAs cause. If you specifically want a CAPTCHA you can still add reCAPTCHA, hCaptcha, or Turnstile on top, but it isn't required to stop spam.

Typical sites block 95–99% of spam before it ever reaches an inbox or webhook. The honeypot alone catches roughly 85% of the cheap, high-volume bots; adding the time-trap and the content-heuristics layer lifts that to the 95–99% range. It works on the very first submission — there is no training period and no script to load.

Yes — every layer (honeypot, time-trap, IP rate limit, content heuristics, domain allow-list, and the Spam queue) is included on the Free 200-submissions plan, and email notifications to you are free on every plan too. There is no upsell for spam filtering. Paid plans add exports, webhooks/integrations, and an auto-responder, but the filtering itself is identical at every tier.

It's tuned to avoid that, and the edge cases are handled: the honeypot is aria-hidden and tabindex=-1 so screen readers and keyboard users skip it; back-button re-submits and password-manager autofill are accounted for; and slow legitimate forms (job applications, long surveys) can raise the time-trap threshold per form. On the rare occasion something real is filtered, it lands in the dashboard's Spam folder and you recover it — and its notification email — in one click from the Spam queue.

Yes. The filtering is server-side, so it doesn't care what rendered the form. Anywhere you can paste HTML — a WordPress Custom HTML block, a Webflow embed, a Carrd element, a Squarespace code block — the spam-free form works without a plugin. For React, Next.js, Vue, or any SPA that submits via fetch(), send an empty botcheck field and a form_loaded_at timestamp and the same protection applies.

Yes. Because there's no Google reCAPTCHA, there are no reCAPTCHA cookies, no device fingerprinting, and no third-party JavaScript executing in your visitors' browsers — three of the most common GDPR headaches with CAPTCHA-based spam protection. Notification emails are sent from a warmed, SPF/DKIM/DMARC-aligned sender so they land in the inbox rather than a spam folder.

That's exactly why the defense is layered rather than a single trick. A honeypot is blind to headless-browser bots and human-looking, AI-generated messages submitted through the real form — so the content-heuristics layer scores the message text itself (link spam, repeated phrases, banned TLDs, gibberish), and strict-origin mode stops a leaked access key from being replayed on someone else's site. No system stops a determined attacker writing a bot for your specific form, but layered, server-side filtering keeps even that under control — and anything that slips through still lands in the Spam queue for one-click recovery.