Spam filtering
Stop form spam without making real visitors solve a puzzle
A visible CAPTCHA filters bots by annoying humans first. PostTo's baseline defense is invisible: a honeypot field plus a heuristic scorer run on every submission, on every plan, entirely first-party — no data ever leaves PostTo for this layer, and it costs nothing extra.
For higher-volume or higher-value forms, an optional AI classifier steps in only when the baseline verdict is ambiguous, and Cloudflare Turnstile is available if you do want a visible challenge. Nothing is ever silently discarded — flagged submissions are held in your dashboard for review, not deleted.
Free plan, no credit card required.
How PostTo handles it
Honeypot, always on
A hidden _hp field that humans never see and bots reliably fill in. Honeypot hits are the one case PostTo discards silently — they're not persisted, because they're not real traffic.
First-party heuristic scoring
Every submission is scored by rules that run entirely inside PostTo — no third-party API call, no data leaving the system, free on every plan including Free.
Custom blocklists on Starter and up
Add your own blocked phrases and sender domains per endpoint, layered on top of PostTo's curated baseline lists, for spam patterns specific to your form.
Optional AI classification
Off by default. Enable it per endpoint — included on Pro and Scale, a $5/month add-on on Starter — and it only runs when the baseline verdict is ambiguous, keeping cost and latency down.
Fail-open, always
If the AI classifier errors or times out, the submission scores as unscored and is delivered anyway. A spam-filtering outage should never mean a lost customer inquiry.
Held, never dropped
Anything flagged as spam becomes a held submission — visible in your dashboard, retained per your retention setting, and deliverable manually with one click if it turns out to be legitimate.
From the docs
Frequently asked questions
- Do I need to add a CAPTCHA to stop form spam?
- Not to get started — the honeypot field plus heuristic scoring run automatically on every submission and catch most automated spam without showing visitors anything. Cloudflare Turnstile is available per endpoint if you want a visible challenge for a heavily targeted form.
- What happens to a submission that gets flagged as spam?
- It becomes a held submission — stored and visible in your dashboard, never silently deleted. You can review it and release it for delivery with one click if it was flagged incorrectly.
- Does spam filtering send my form data to a third party?
- The baseline layer — honeypot and heuristic scoring — is fully first-party; nothing leaves PostTo. Optional AI classification is opt-in per endpoint, and only sends the specific ambiguous submission to Anthropic, a sub-processor covered by a DPA.
- Does a spam-filtering failure ever block a real submission?
- No. The AI classifier is fail-open: on any API error or timeout, the submission is marked unscored and delivered anyway rather than held or dropped.
- Does blocked spam count against my monthly quota?
- No — the monthly quota counts submissions actually delivered to your inbox. Spam that's blocked or held never counts against it.
- What does it cost?
- Baseline honeypot and heuristic filtering are included on every plan, including Free. AI classification is included on Pro and Scale, and available as a $5/month add-on on Starter.
See it working in a few minutes
Create an endpoint, point your form at it, and see your first submission in the dashboard — all on the free plan.
Try PostTo free