Form spam protection without captcha puzzles.
Stop form spam without puzzles: single-use form tokens, spam scoring, verified search crawlers let through and rules to block or rate-limit the rest, with no cookies on forms.
Kort gezegd
Bot protection is form spam protection, plus optional whole-site rules, without image puzzles. Browsers earn a one-time token your server verifies; spam signals score submissions; legitimate search and AI crawlers pass after a two-way network address check. Block or throttle by country, network, path or score. Bot traffic stays out of Analytics, and attack spikes trigger alerts. Copy-paste guides cover common website setups.
Why Bot protection
How it works
From setup to results, step by step
Screens from our demo workspace, showing sample data.
- 01
Add the form check
Add the small script to your form pages. It works in the background while the form is filled, with no puzzles.
- 02
Verify on your server
Your server checks the single-use token with your site secret and gets a spam score back.
- 03
Add rules if you need them
Block, check, rate limit or allow by country, network, browser, IP range, path, crawler status or bot score.
- 04
Watch and get alerted
See checks, blocks and spam in the event log, and get an alert when attacks spike.
Features
Inside Bot protection
Invisible, puzzle-free check
Lightweight work in the browser while the form is filled, with no image grids. Screen readers get a short status line.
Tokens your server confirms
Each form carries a single-use token that expires in five minutes. Your server checks it with your site secret, so replayed or forged tokens are rejected.
Spam scoring
Hidden trap fields, how fast the form was filled, throwaway email domains, link stuffing and common spam wording add up to a spam score you can act on.
Verified search crawlers
Crawlers from major search engines and AI search tools are confirmed by a two-way network address lookup and let through. Fakes using their name are blocked.
Rules
Block, check, rate limit or always allow by country, network, browser, IP range, page path, crawler status or bot score. Rules run in order and the top match applies, with hit counts on every rule.
Whole-page protection
Optional server middleware checks every request against your rules, sends suspicious visitors to a one-second check page and remembers the result for 30 minutes.
Works with Serpfull SERP clicks
Whole-page protection recognises Serpfull’s own click runs from a signed, short-lived pass tied to your website, and lets them through while bad bots are still blocked. No allow-list to maintain.
Clean analytics
Bot and crawler visits are detected and kept out of your visitor numbers, and counted separately so you can see how much automated traffic you get.
Attack alerts
When failed, blocked or spam requests jump well above normal, your team gets an email, an in-app notification and a webhook.
Geleide rondleidingen
Een rondleiding laat je Bot protection zien
Klik in het dashboard op het toverstaf-icoon in de header en kies de Bot protection rondleiding, of kies “Deze pagina rondleiden”. Het markeert elk deel van de pagina en legt stap voor stap uit wat het doet.
Hoe rondleidingen werkenUse cases
Who uses Bot protection
Plan limits
Bot protection on each plan
Limits apply per website. Every plan includes Bot protection.
| Limit | Starter | Growth | Scale | Pro | Enterprise |
|---|---|---|---|---|---|
| Form verifications per month | 50.000 | 250.000 | 1.000.000 | 10.000.000 | 30.000.000 |
| Whole-page checks per month | 250.000 | 1.000.000 | 5.000.000 | 50.000.000 | 150.000.000 |
| Rules | 10 | 25 | 50 | 250 | 500 |
| Event log kept (days) | 7 | 14 | 30 | 60 | 90 |
Questions
Bot protection FAQ
Will my visitors see a puzzle?
No. There are no images to pick and nothing to click. The check runs in the background, usually in well under a second, and works with keyboards and screen readers.
Does it set cookies or collect personal data?
Form protection sets no cookies and stores nothing on the device. We keep a short-lived anonymous score per request; IP addresses are hashed with a per-site key before anything is logged. The optional whole-page check sets one strictly necessary security cookie after a visitor passes it.
How many checks are included?
Form verifications and whole-page checks per website per month, the number of rules and how long the event log is kept depend on your plan, as shown in the table on this page.
What happens if I go over?
Your forms keep working and visitors are never locked out: checks pause until next month and your server is told protection is paused, so you decide whether to accept the form.
Will it block my Serpfull click runs?
No. Whole-page protection recognises Serpfull’s own SERP click runs and lets them through. Each run carries a signed pass tied to your website and to that run, which expires within minutes and is checked on our servers, so it can’t be reused by anyone else.
Will it block search engines?
No. Verified search and AI search crawlers are let through unless you add a rule that says otherwise.
Which websites are supported?
Any website with an HTML form. There are copy-paste guides for plain HTML, script-driven forms, popular server languages and content management systems, and server middleware.
Stop spam without puzzles.
Add the form check, verify tokens on your server and let real visitors and verified crawlers through.