New: submit to send.webforms.tosend.webforms.toRead the docs →
Blog
Real bugs found, real decisions made, real tradeoffs taken, with the actual reasoning, not the announcement-post version of it.
Honeypot, time trap, rate limits, domain lock, content signals, reputation, an AI classifier and, last of all, a captcha. What each one catches, what still gets through, and why we hold suspected spam instead of deleting it.
A honeypot costs your visitors nothing and stops the laziest bots. A captcha costs every visitor something and still lets people through. How to choose, with every vendor's pricing checked on 24 October 2026.
The legal question is less about Google than about consent: what a captcha reads from your visitor's device, and who uses it for what. The sources, the April 2026 change, and the options, each with its trade-off.
Most Webflow form spam stops once two settings are on. What gets past them is usually typed by a person, and catching that takes a filter that reads the message.
Framer's own help says spam that gets past its protection was probably sent by a person. A captcha cannot fix that. Here is what can, with and without leaving Framer's forms.
Shopify's spam filter tags messages instead of removing them, so some spam is meant to reach you. How to get the most from the built-in protection, and what you give up by replacing it.
Nearly every case comes down to whose address is on the message and who is allowed to send it. How to read the headers, fix the cause, and what we decided for our own notifications.
"The form isn't sending" describes four different failures. Work out which hand-off broke first, because each fix only repairs its own layer.
Adding a second address is easy everywhere. Deciding whether those people should see each other, reply to each other and fail independently is the part worth thinking about.
The prompt is the browser stopping your visitor from sending the same order twice. The fix belongs on the server, and it comes down to one status code.
Change one attribute, rename a few hidden inputs, and keep everything your form already does. The full mapping, including the fields that behave differently.
The honeypot field keeps its exact name, the subject field gains an underscore, and the redirect moves out of the paid tier and into your markup.
FormSubmit put your email address in the form's action attribute. Moving off it means mapping nine underscore fields: four rename, five move into a dashboard.
Netlify Forms works by scanning your HTML at deploy time. Untangling from that means deleting attributes, not adding them. And framework forms get simpler, not harder.
A real spam incident, the threshold math that let it through, and the design rule that came out of it: never destroy a submission on a machine's say-so.
Half the searches for this add Zapier out of habit. You don't need it. And depending on what you're building, you may not need Typeform either.
Half the advice about Netlify Forms online is about a pricing cliff that no longer exists. Here is the current state, verified against their pricing and docs, and the limits that remain.
Every stored referrer was the bare origin, never the page. Here's why, and the one-line fix that isn't really about form backends at all.
Two very different kinds of email were sharing one sending reputation. Splitting them was a fifteen-minute change with an outsized effect on deliverability risk.
A longer integration list is an easy feature to announce and a genuinely weak one to actually use. Here's what we built instead and why.
A schema column can describe a promise perfectly and still not keep it. Here's the bug, and the boring-on-purpose fix.
Your form, your styling, and still a spreadsheet at the end. The Apps Script route, start to finish.
One of these is free and broken, one is a part-time job, one is what we sell. Here is the honest version of that sentence.