Spam protection and limits.
Contact layers several cheap, effective defenses so your inbox stays clean and the service stays stable.
Honeypot field
Add a hidden input named _website to your form and leave it out of your schema. Real visitors never see or fill it, but many bots complete every field they find. If a submission includes a non-empty _website value, Contact still returns 202 — so the bot believes it succeeded — but marks the submission as spam and does not send any delivery messages.
<input type="text" name="_website" tabindex="-1" autocomplete="off" hidden aria-hidden="true" />If you change the honeypot field name, update the form’s honeypotField setting to match.
Origin allowlist
Every form has an allowlist of origins. Requests from a browser origin that is not listed are rejected with 403 before validation. Add your production origin and any development origin, including scheme and port and without a path. This blocks other sites from posting to your public form key.
Rate limits
Submissions are limited per form and per client IP. By default a form accepts 20 submissions per 60 seconds from the same client; the window and maximum are server-configurable. Exceeding the limit returns 429 with a Retry-After header. Uploads have their own limiter.
Workspace submission allowance
Each workspace has daily and total submission allowances. When either is reached, further submissions return 429 (“This workspace has reached its submission allowance.”). Contact your administrator or review your plan to raise the limit.
CORS behavior
Contact answers preflight requests for allowed origins and permits the Content-Type, Idempotency-Key, and Turnstile-Token headers. Because a blocked origin returns 403, a browser will surface a CORS error in the console — the real cause is almost always a missing or mistyped origin in the allowlist. See Troubleshooting.
Account and site forms
The sign-up, password-reset, and site contact forms are protected with Cloudflare Turnstile and dedicated rate limits in addition to the controls above.