Form Spam & Privacy

Forms face the internet unfiltered, so the defenses are built in rather than added: rate limits (previous page) plus Turnstile, country blocking, honeypot, and a content spam filter — and on the privacy side, per-form switches for IP storage and data retention, plus a disclosure field for GDPR-style transparency.

Cloudflare Turnstile (human check)

• Optional per form (checkbox in the form settings, enabled by default it only actually challenges when Turnstile site/secret keys are configured site-wide in Settings → Security).
• Challenges appear on the form embed; the CMS verifies the token server-side, non-blocking. Network hiccups on the Cloudflare verification call fail open (the submission is allowed) so an outage never swallows legitimate leads; a parseable “no” from the challenge fails closed and the submission is rejected.
• In air-gap mode Turnstile verification is skipped and the widget is removed regardless of stored keys.

Country blocking

• A form can list ISO country codes (comma-separated) to reject; requires the front proxy to supply a country header (Cloudflare’s CF-IPCountry). Without that header, nothing is blocked — the setting is harmless noise on other stacks.
• Blocked visitors get a region-not-accepted message with an HTTP 403.

Honeypot and silent defenses

• Forms include a bot trap: submissions that fill the honeypot are discarded silently — the bot sees a normal-looking success and never learns anything was wrong.
• A malicious probe of the form’s own file area is logged as a honeypot hit in the security-event trail.

Content spam filter

Text fields get a plain-English heuristic: real people don’t paste HTML or BBCode into a contact form. A free-text field containing markup, BBCode, or more than one URL is silently discarded (success-like response, nothing stored). Email, tel, URL, and structured field types are exempt from the scan.

Privacy switches (also listed on the Submissions page)

• Store submitter IPs — per form, off means never written.
• Browser privacy signals (DNT / Global Privacy Control) suppress stored IPs and campaign attribution even when storage is on.
• Submission retention days — auto-delete after N days; 0 keeps forever.
• Webhook recipient disclosure — an optional public line shown on the form: “Your data will be shared with: [value]” — for GDPR-style transparency when submissions feed an external system.
• Notification IP line — can omit the submitter’s IP from the admin notification email.