Spam protection

Every form has a hidden honeypot and a time check built in, with no extra step for people. Entries they catch go to Spam, without emails. You can add more:

• Spam score (Settings → Spam protection): a local score from links, pasted or rushed text, repeated answers, spam phrases and more. Entries over the threshold go to Spam, and each one says why. Press Not spam on a mistake and your site learns from it. Nothing is sent to a cloud service.
• Akismet: when Akismet is active on your site, FillKite can ask it too. If Akismet cannot be reached, the entry is kept as normal.
• Rate limit (Settings → Spam protection): how many entries one visitor can send in a number of minutes. Visitors over the limit are asked to try again later.
• Duplicate flag (Settings → Spam protection): the number of minutes in which a second entry from the same email is flagged. 0 turns it off.
• Block temporary email addresses (on an email field): refuses throwaway inboxes from a built-in list of nearly 9,000 domains.
• Check the domain can receive email (on an email field): asks your server’s DNS whether the domain has a mail server.
• Captcha (Settings → Spam protection): choose Cloudflare Turnstile, hCaptcha or Google reCAPTCHA v3 (invisible), then paste the site key and secret key from that service.

Tip: start without a captcha. The honeypot and time check stop most bots, and people never see them.