Invisible form protection
Stop the cheap, fast, dumb spam.
Most form spam is not clever. It is a script that fills every box in under a second and moves on. Spamo catches that — invisibly, with no CAPTCHA and nothing for your real visitors to solve.
We are also straight with you about the rest: Spamo is a first line of defence, not a wall.
Free plan: 500 submissions a month. No card needed.
The five checks
What Spamo catches
Every submission runs through these, in this order, on our server. None of it can be faked from the browser.
The empty box
We add a hidden field with a random nonsense name. A person never sees it. A bot fills every box it finds. Anything typed in there is spam.
The instant post
Nobody reads a form and fills it in under two seconds. If the submit arrives faster than that, it was not a person.
No page load
Real visitors load your page first, which fetches a token. A script that posts straight at your form never gets one.
The forged timestamp
The token is signed with your site's private key. Edit the time inside it and the signature stops matching.
The dotted Gmail trick
Gmail ignores dots, so one mailbox becomes endless "unique" addresses. Three or more dots in the name is a spam signature.
And the bot never knows
A blocked bot gets the exact same "thanks" a real person gets. If it could tell it had been caught, it would adapt.
No spin
What Spamo does not do
Everyone else on this page would bury this bit. We put it up front, because knowing the edge of the tool is how you decide if it fits.
Three steps
How it works
Paste one script tag
Add the Spamo script to your page and one attribute to your form. That is the whole install. No backend, no build step, no npm.
Bots get silently trapped
They fill the hidden box, or post too fast, or never fetched a token. They see a normal thank-you and never learn they were caught.
Real leads land in your inbox
Genuine submissions are stored, emailed to you, and pushed to your webhook if you use one. Nothing for your visitor to solve.
Why forms get hit
Most of your form traffic is not human
Automated traffic now makes up around half of everything hitting the web, and cheap scripted form spam is the bulk of what reaches a small site.
Automated-traffic share reflects widely reported industry bad-bot figures. Spamo's own numbers are measured from this widget.
Early users
What people say
Spamo is new. These are placeholder quotes and will be replaced with real ones as they come in — we are not going to invent customers.
"Swapped out reCAPTCHA on the contact form. Spam went to near zero and I stopped getting emails from people who could not read the little pictures."
"The honest limits page is what sold me. Everyone else promises to stop everything. I would rather know what I am actually buying."
"One script tag on a static site and the leads just started arriving by email. I do not have a backend at all."
Pricing
Start free. Pay when it matters.
$29 / month
- 100,000 submissions a month
- Priority support
- Custom rate-limit tuning
Questions
Straight answers
Does Spamo replace a CAPTCHA?
Yes, for the spam most small sites actually get. Spamo runs invisibly — no puzzle, no image grid, nothing for a real visitor to solve. It stops cheap automated bots. It will not stop a determined attacker who loads your real page, waits a few seconds and types like a person, so if you are under a targeted attack you still want a CAPTCHA or a manual review step.
Will Spamo block real customers?
Almost never, by design. There is no puzzle to fail and no IP blocking, so a real person cannot be shut out by a bad score or a shared office address. The one message a genuine visitor can see is "this form expired", which happens if they leave the tab open more than 12 hours. Spamo fetches a fresh token automatically so their next attempt goes through.
Does Spamo store my form data?
Only for submissions that pass. Blocked attempts keep metadata only — a hashed IP, the user agent, the reason and a timestamp — so a spam flood cannot fill your account with junk. Raw IP addresses are never written to disk; they are hashed before storage.
Do I need a backend to use Spamo?
No. In hosted mode you point your form action at Spamo, and we store the lead, email you, and optionally forward a webhook. If you already have a backend, call POST /api/v1/verify from your own server and Spamo returns a plain allow or block decision for you to act on.
One script tag. No CAPTCHA. No excuses.
Create a free account, register your site, and paste the snippet. Most people are done in under five minutes.