> ## Documentation Index
> Fetch the complete documentation index at: https://docs.useorbitcrm.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Spam Protection

> How OrbitForms protects your forms from bots and spam submissions with multiple layers of defense.

OrbitForms protects every form with multiple layers of defense that work automatically — no setup required.

## Protection Layers

> [card] Google reCAPTCHA v3
>
> Invisible behavioral scoring that flags bot traffic with no friction for real users.

> [card] Honeypot Fields
>
> Invisible traps that catch simple bots without affecting humans.

> [card] Rate Limiting
>
> Per-IP limits backed by Redis that block abusive submission bursts.

## How It Works

When a user submits your form, OrbitForms applies protection layers in sequence:

1. **Rate limiting** — Obvious spam bursts are rejected before any database work happens. If the same IP exceeds the limit within the time window, the submission is blocked.
2. **Honeypot** — Honeypot fields are invisible to humans but bots often auto-fill every field. When a honeypot is filled, the submission is silently discarded — the bot gets a fake success response so it never learns it was caught, and no submission is stored.
3. **reCAPTCHA v3** — Google scores the user's behavior; low-scoring submissions are rejected.

Submissions that pass all checks are processed normally.

## Publish-Time Abuse Checks

Spam protection extends beyond individual submissions. When you publish a form, OrbitForms runs an abuse pipeline:

* **Field-label denylist** — Blocks forms impersonating well-known brands or requesting credentials
* **Heuristic scoring** — Flags phishing-shaped forms before they go live
* **AI review** — An asynchronous review that can automatically unpublish forms flagged as phishing

This keeps the `orbitforms.ai` domain trustworthy for everyone and protects your form links from being flagged by browsers and email providers.

## Best Practices

* **Use email verification (Pro)** — Verify email addresses at entry to keep fake leads out of your CRM. See the form's **Integrate** tab for providers like ZeroBounce, Emailable, and NeverBounce.
* **Watch your analytics** — Sudden submission spikes with low conversion often indicate bot traffic.
* **Test after changes** — Submit a test entry after publishing to make sure real users can still submit successfully.

## Next Steps

> [card] [Account Settings](https://docs.useorbitcrm.ai/guides/settings.md)
>
> Manage your account and security

> [card] [Analytics](https://docs.useorbitcrm.ai/guides/analytics.md)
>
> Monitor form performance


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.