Turnstile
Connect your widget in form settings, add the generated markup to your website, and verify a real submission before enforcing the check.
ExploreContact form spam protection
Contact form
spam protection.
Filter unwanted submissions with Turnstile, honeypots, rate limits and allowed origins. Review held messages and restore legitimate enquiries. Included in Free and Pro.
250 submissions/month free. No credit card required.
Included in Free and Pro
A few checks. A clearer inbox.
- Check the interactionValidate a Turnstile token when protection is enabled.
- Look for spam signalsA filled honeypot or many links can send a message to Spam.
- Let you make the callReview held messages and restore the ones you need.
Protection at more than one layer.
Honeypot and rate limits
Keep an invisible field empty for real visitors. Rate limits constrain request volume; spam signals can hold a message without notifying your recipients.
Allowed origins
Limit accepted website origins to the domains you intend to use. Origin checks are one layer of protection, not a replacement for the rest.
Try the decision
See where a message goes.
Use the sample form below. Turn on its honeypot test or add more than five links to the message, then inspect the Spam and notification decisions. This is a browser-only simulation, not a live Turnstile or rate-limit test.
Your website · contact formDEMO · NOTHING IS SENT
Browser-only demo with made-up recipients. Turnstile, attachments, webhooks and email sending are not simulated.
Review spam and restore legitimate submissions.
Review the original message
Open Spam to inspect held submissions. No filter catches everything, so review that folder when you are expecting a message.
Restore a legitimate enquiry
Restoring a message queues its owner notification. It does not send the visitor an automatic reply retroactively.
ExploreFollow the notification
Check the recipient and delivery state after restoring. Keep the distinction between stored messages and delivered email visible.
ExploreFrequently asked questions
Contact form
questions.
Is spam protection available on Free?
Yes. Form Koi includes Turnstile support, the honeypot, rate limits, allowed origins and spam review on Free. You still need to configure the widget and website integration to use Turnstile.
Will it stop every spam message?
No. Filtering reduces unwanted submissions, but no filter is perfect. Review your Inbox and Spam folders and adjust the supported settings for your website.
Will every rejected request appear in Spam?
No. Some requests are rejected before storage, such as invalid submissions or requests blocked by a limit. The Spam folder contains submissions that were accepted and held by spam checks.
What happens if Turnstile cannot load?
An enforced check needs a valid token. Test the widget on your deployed website, show helpful feedback when it fails, and give visitors another contact option. Use the generated integration to handle expired or failed challenges.
For exact configuration steps, see the spam-protection guide.
Start with Form Koi Free