Spam protection & bot defence

propform forms are publicly accessible — and therefore a potential target for spam bots that indiscriminately fill in forms to leave advertisements or flood the database. Here’s what propform does automatically, and what you can add yourself.

Honeypot protection (automatically active)

Every propform form contains an invisible field that real people cannot see and therefore do not fill in — but bots certainly do, because they fill in everything they find.

What happens: If the honeypot field is filled in when a form is submitted, the process is aborted, the IP address is logged in our spam statistics, and the data does not end up in onOffice.

You don’t need to configure anything — this protection is enabled by default in every form.

CSRF Token & Signature

When a form is called up, it is provided with an encrypted CSRF token. When the form is submitted, the token is checked for validity — bots that do not access the form normally will fail here.

In addition, the form signature and timestamp are checked to block replay attacks and manipulated submissions.

Expiry date for forms

If you only want to make a form available for a specific period (e.g. a job application or a limited-time offer), you can set an expiry date in the form settings. Once the form has expired, propform displays a corresponding notification page and the form can no longer be submitted.

Email reputation of the sender domain

If your form sends confirmation emails, the spam score of your sender domain is crucial. Emails sent directly from generic domains are more likely to end up in spam folders or be automatically deleted by email providers (see section “Link is deleted by email providers”).

Recommendation: If you frequently experience issues with email delivery or wish to achieve a more professional brand image, set up your own external domain for your forms. For more information, please contact us at hello@propform.io.

Additional steps you can take as a form operator

Set mandatory fields sensibly — bots often only fill in standard fields, leaving special fields blank
Apply validations to fields (e.g. phone number format, minimum length)
Use conditional fields — e.g. a subsequent field that only appears if a specific preceding field has a certain value. Bots struggle with JavaScript-driven logic
If you receive a lot of spam submissions despite the honeypot: Drop us a quick line; we can block IP ranges on the server side

How can I tell if my form is blocking spam bots?

In the statistics for your form in your propform account, you can see both regular submissions and blocked spam attempts. If the number of spam submissions is unusually high, please feel free to contact us — we’ll look into it.