#Spam and abuse controls

FormRoost applies layered controls without requiring every customer to configure a challenge. Origin validation and short-lived network/form/project/account rate limits are always active. The default _gotcha honeypot, optional minimum-completion timing, repeated-content detection, and configurable email/domain/content blocklists add low-friction signals.

Customers may enable Cloudflare Turnstile per form by storing a site key and secret. The secret is application-encrypted, never returned by the API, and sent only to Cloudflare's verification endpoint when a token is supplied.

Suspicious submissions enter a 14-day quarantine. They do not consume allowance, appear in the explicit Spam inbox, and do not produce webhooks. Restoring a production submission consumes one production unit and emits submission.restored; restoration stops with the same hard allowance limit as ordinary ingestion.

Duplicate-content detection uses a bounded HMAC-derived fingerprint and time window. FormRoost does not store raw submitter IP addresses for rate limiting.

Deployments behind a reverse proxy must set TRUSTED_PROXY_CIDRS to the proxy's IP addresses or CIDR ranges. Direct deployments leave it empty. The supplied Compose setup assigns Nginx 172.30.0.10 and trusts only that address; Nginx replaces incoming forwarding headers with the visitor's address. Adapt the network and trusted address together when deploying on a different network.