Spam is one of the most frustrating parts of running an open form endpoint. We built TorchWarden to handle it automatically, without requiring you to add CAPTCHAs or maintain blocklists.

How it works

Every submission is scored against five detection signals:

• Keyword filtering: flags common spam phrases and link-spam patterns
• Honeypot traps: catches bots that fill hidden fields humans never see
• Duplicate detection: uses Redis to identify repeated identical submissions
• Rate limiting: enforces per-IP and per-form submission caps
• Behavioral signals: detects suspiciously fast or bot-like form fills

Submissions with a combined score above 60 are marked as spam. They're stored in your dashboard (with their score and signals visible) but excluded from email notifications and quota counts.

What's visible in the dashboard

You can see every spam submission alongside legitimate ones, with a breakdown of which signals fired and the total score. This makes it easy to spot false positives and tune your confidence over time.

Enabling it

TorchWarden is on by default for all forms. You can toggle it per form in Form Settings → Spam Protection.