FAQ
Questions, answered straight.
Spamo is invisible spam protection for public contact and signup forms. It blocks cheap automated bots using a hidden trap field, a minimum fill time, a signed timestamp and a dotted-Gmail check — with no CAPTCHA, no cookies on your visitors and no IP blocking. It does not claim to stop a patient, well-crafted attack.
Does Spamo replace a CAPTCHA?
For the spam most small sites get, yes. Spamo runs invisibly — there is no puzzle, no image grid and nothing for a real visitor to solve. It stops cheap automated bots. It will not stop a determined attacker who loads your real page, waits a few seconds and types like a person, so if you are under a targeted attack you still want a CAPTCHA or manual review as well.
Will Spamo block real customers?
Almost never, by design. There is no puzzle to fail and no IP blocking, so nobody gets shut out by a bad reputation score or a shared office connection. The only message a real visitor can see is "this form expired", which happens if they leave the tab open more than 12 hours. Spamo fetches a fresh token automatically so their next attempt goes through.
Does Spamo store my form data?
Only submissions that pass. Blocked attempts keep metadata only — a hashed IP address, the user agent, the block reason and a timestamp. Raw IP addresses are never written to disk. In developer API mode Spamo stores no payload at all, because your form data never leaves your own server.
Is Spamo GDPR-friendly?
It is built to be. Spamo stores no cookies on your visitors, hashes IP addresses before storage rather than keeping them raw, and keeps no payload for blocked attempts. You remain the data controller for the leads you collect, and deleting a site deletes its submissions immediately.
What is the difference between the widget and the API?
The widget is hosted mode: one script tag, no backend, and Spamo handles storage, email and webhooks. It always answers "success" so a caught bot never learns it was caught. The API is developer mode: your backend POSTs to /api/v1/verify with your private key and gets the real verdict, {allowed, reason}, to act on however you like.
Do I need to change my form HTML?
Only to add one attribute, data-spamo-site, with your site key. The hidden trap field and the signed token are injected by the script at run time. Do not add the trap field yourself — its name is random per site, and a hard-coded name is one a bot could learn.
Why is the hidden field not display:none?
Because bots check for that. A field hidden with display:none or visibility:hidden is skipped by any spam script worth worrying about, which would make the trap useless. Spamo hides it with clip-path instead, plus aria-hidden and tabindex -1 so screen readers and keyboard users never reach it either.
What counts against my monthly limit?
Every submission Spamo processes, passed or blocked, because processing it is the work. The free plan allows 500 a month, which is far more than a typical small site sees.
Can I use Spamo on more than one website?
The free plan covers one site. Pro and Business allow unlimited sites, each with its own key, its own trap field name and its own statistics.
Does Spamo work on a static site with no server?
Yes, that is exactly what hosted mode is for. Point your form at Spamo and we store the lead, email it to you and optionally call your webhook. No backend, no serverless function, no build step.
What happens if Spamo is down?
Your page still loads and your form still displays. If the widget cannot fetch a challenge it stays out of the way rather than blocking a real person from submitting.
Can I see why something was blocked?
Yes. Your dashboard shows every submission with its reason: honeypot, timing, signature, expired, gmail dots or rate limit. The person submitting never sees any of that.
Still deciding?
The free plan needs no card. Add it to one form and watch the blocked count for a week.