Every public form attracts the odd bot. OneForm screens submissions before they reach you, on every form and every plan, with nothing to set up. Clients never see a puzzle to solve.
What OneForm does for you
- A trap only bots fall into. Each form has a hidden box people never see. Bots that fill it in are shown a normal thank-you screen, and nothing is saved: no response, no report, no emails.
- Limits on fast repeat sending. Too many submissions from one connection in a short time are refused. The person sees "Too many submissions. Please wait a minute and try again."
- Every answer is checked again on our side. OneForm re-checks required questions, formats and your logic when a form is sent, so a script can't skip questions or send answers your form doesn't ask for.
- No double submissions. If someone taps submit twice, or their connection drops and the form tries again, you get one response, one report and one set of emails.
- Only the details you expect. Links and website code can only pass in the hidden fields you set up, plus campaign tags. Everything else is ignored. See Pass details into a form.
- Limits on follow-up emails. Emails to someone who left a form unfinished go out at most once a week per address, so nobody can use your form to make you email a stranger over and over.
Spot junk on the Leads page
Your lead score already marks what looks like junk as Red flags:
- Throwaway email address, from known disposable inbox services.
- Finished in under 15 seconds, faster than a person can read the questions.
- Email bounced or marked as spam, when your emails to that address didn't arrive.
Each takes points off, so junk sinks to the bottom of the list as Cold. You can change how many points each takes off in Settings → Lead scoring.
Remove a fake response
- Go to Responses and open the response.
- Click Delete, then confirm.
The response and any report drafted from it are deleted. If a bot left many responses under the same email address, erase that person from the Leads page in one go instead. See Delete a response or a client's data.
Good to know
- Deleting needs an admin or owner.
- Reports cost OneAI Tokens. Bots caught by the trap get no report, so they don't use any. A fake response that does get through drafts a report like any other. That report waits for review unless the form sends reports automatically, so delete the response before anyone approves it.
Why did a real client see "Too many submissions"?
Several people sent the form from the same connection in a short time, such as a shared office network, or one person tried many times. Ask them to wait a minute and submit again. Their answers stay in the form while they wait.