Availability and spam

By the end of this page you will know how to control when a form accepts responses and how it stops spam without ever showing a CAPTCHA.

These settings are under Form → Availability. When a form is closed, visitors see its message instead of the form, and submissions are also rejected on the server, so nobody can get around it by sending the form directly.

When the form is available

• Require the person to be logged in, with a Message for people who are not logged in.
• Open and close the form on specific dates, with a Message before opening and a Message after closing. Dates use the site’s time zone.
• Limit the number of responses, with a Message when the maximum is reached. Only active entries count: spam and entries in the trash do not use up the limit.

Spam protection

TrazoForms does not use CAPTCHA, so people never have to solve a puzzle to send a form. Every form is protected from the start, and you can add more rules:

• A hidden trap field, always on. People never see it, it cannot be reached with the keyboard and screen readers skip it, but bots that fill in every field they find fill it in too.
• Minimum seconds to submit (under Form → Spam protection): a form completed faster than that is almost always a bot. The time is cryptographically signed, so it cannot be faked — a submission with no timestamp, or a forged one, is also treated as spam. It is 3 seconds by default, enough to stop bots without affecting people, even when their browser fills in the form for them. Set it to 0 to turn it off; the trap field still applies either way.
• Reject the field if it contains links: a rule for each field. See Field settings.
• Do not allow duplicate values across entries: also per field. It stops the same invoice or ID number from being registered twice. Only active entries count, so spam cannot reserve a number.

Submission rate limit

To stop a flood of automated submissions rather than a single bot, TrazoForms also limits how many times the same connection can submit the same form in a short window: 30 submissions every 10 minutes by default. Change it in Settings to 10, 30, 60, or no limit. Each step of a multi-page form counts. No IP address is stored — only a fingerprint that cannot be reversed — and a logged-in administrator is never limited. Someone stopped by this sees a clear message instead of a generic error.

What happens to spam

A submission caught by the trap field, the minimum time, or the rate limit is not rejected: it is saved in the Spam view of Entries, with an automatic note that says why, and no notification is sent — not even the default ones. The visitor sees the usual confirmation, so a bot cannot tell that it was caught.

If a real person was caught by mistake, open the entry and choose Not spam. Restoring an entry does not send the notifications that were skipped, and an entry in Spam is never counted for duplicate-value checks — a spam entry can never “reserve” a value a real person needs.

Edge cases

• A cached page still works correctly. The minimum-time check relies on a signed timestamp, not on how fresh the page is — an old but genuinely signed timestamp is accepted the same as a fresh one, so page caching does not break real submissions.

Next step

Continue to Privacy and data to see what is stored and how personal data requests are handled.