Spam Protection (_gotcha Honeypot), CORS Setup & HTTP Status Codes
Configure multi-layer bot protection, lock form endpoints to verified production domains via CORS allowlists, and handle HTTP response codes gracefully.
- Add a hidden _gotcha input to quarantine automated scraper bots without degrading human conversion rates with visual CAPTCHAs.
- Quarantined spam submissions are stored in your Spam lane for auditability while suppressing outbound webhooks and email notifications.
- Configure Allowed CORS Domains in Form Studio to reject unauthorized cross-origin submissions with HTTP 403.
- Every endpoint response includes X-RateLimit-Limit, X-RateLimit-Remaining, and X-RateLimit-Reset headers.
1. Honeypot (_gotcha) & Multi-Layer Bot Heuristic Shield
Include a hidden _gotcha field in your HTML or JSON payload. Automated bots that auto-fill all inputs populate this field, causing FormFork to flag the submission as spam (score >= 0.95) and suppress downstream webhooks and emails.
<!-- 1. Hidden Honeypot Input: must remain empty for human visitors -->
<input
type="text"
name="_gotcha"
style="display:none !important"
tabindex="-1"
autocomplete="off"
aria-hidden="true"
/>
<!-- 2. Optional Human Fill-Time Check: Unix timestamp (ms) when form rendered -->
<input type="hidden" name="_ff_t" value="1729624800000" />2. CORS Domain Allowlist & Origin Verification
In Form Studio under Settings -> Security Shield, specify your production hostnames (for example: acmecorp.io, *.acmecorp.io). Requests originating from unlisted Origin or Referer headers are rejected with 403 Forbidden.
Adding *.acmecorp.io permits submissions from app.acmecorp.io, staging.acmecorp.io, and docs.acmecorp.io while blocking third-party domains.
3. HTTP Status Codes & Error Handling Reference
When Accept: application/json is sent, FormFork returns deterministic HTTP status codes and machine-readable error identifiers.
| HTTP Status | Error Code | Description & Recommended Client Action |
|---|---|---|
| 200 OK | submissionId | Submission accepted and stored. Display your confirmation state or redirect. |
| 403 Forbidden | form_inactive / origin_not_allowed | Form endpoint is paused, or the request Origin/Referer is not in the form CORS allowlist. |
| 413 Payload Too Large | payload_too_large | JSON/text request body exceeds the 64 KB metadata limit or file upload quota. |
| 422 Unprocessable | schema_validation_failed | Missing required fields, invalid email format, or constraint mismatch. Inspect errors[] in the response. |
| 429 Too Many Requests | rate_limit_exceeded / quota_exceeded | Per-IP rate limit or monthly plan quota reached. Respect the Retry-After header before retrying. |
Frequently Asked Technical Questions
Are submissions caught by the _gotcha honeypot permanently deleted?
No. Quarantined submissions are placed in the Spam lane of your Kanban pipeline so you can inspect threat scores and restore any false positives with one click ("Not Spam").
Do quarantined spam submissions trigger webhooks or email alerts?
No. When a submission is flagged as spam, FormFork suppresses outbound webhooks and email notifications so your CRM and inbox stay clean.