# Spamo

> Spamo is invisible form spam protection. It blocks cheap, fast, automated bots
> on contact and signup forms with no CAPTCHA and no friction for real people.

Spamo is a hosted service at https://spamo.net. A website owner registers a
"site", gets a public site key, and either points their raw HTML form at Spamo's
submit endpoint (no backend needed) or calls Spamo's verify API from their own
backend for an allow/block decision.

## What Spamo checks

Every submission is checked server-side, in this order:

1. Honeypot — a hidden field with a random per-site name, hidden with clip-path
   (never display:none, which bots detect and skip). Any value means a bot.
2. Timing — at least 2 seconds must pass between the challenge token being
   issued and the form arriving.
3. Signature — HMAC-SHA256 over `site_key|issued_at|nonce` using the site's
   private key, compared in constant time.
4. Expiry — tokens last 12 hours. This is the only check that returns a visible
   failure, so a real person who left a tab open is told to retry.
5. Dotted Gmail — three or more literal dots in a gmail.com local part is
   treated as alias spam. A `+tag` suffix is ignored as normal.
6. Rate limit — global per-site, per-IP ceiling in a rolling 10-minute window.
   IPs are hashed before storage; raw IPs are never kept.

## What Spamo explicitly does NOT do

This list is part of the product's positioning, not a disclaimer:

- Does not stop a patient bot that loads the real page, waits a few seconds, and
  uses a normal-looking email. It blocks cheap, lazy spam — it is not a wall.
- A challenge token can be reused by the same bot many times within its 12-hour
  window; only the site's own rate limit slows that down.
- No CAPTCHA, no puzzle, no IP blocking — Spamo ignores IP reputation by design.
- Does not verify email deliverability or existence, does not block disposable
  email providers, does not block plus-alias tricks.
- Does not stop a human manually filling junk data.
- Does not touch login forms, password resets, admin pages, or the site owner's
  own APIs. Spamo is scoped to public lead, contact and signup forms only.

## Pricing

- Free — $0/month, 500 submissions/month, 1 site
- Pro — $9/month, 10,000 submissions/month, unlimited sites, webhook forwarding
- Business — $29/month, 100,000 submissions/month, custom rate-limit tuning

## Endpoints

- GET  https://spamo.net/api/v1/challenge/{site_key} — issues a signed token
- POST https://spamo.net/api/v1/submit/{site_key} — hosted proxy mode
- POST https://spamo.net/api/v1/verify — developer API mode, Bearer private key

## Pages

- Home: https://spamo.net/
- Docs: https://spamo.net/docs.php
- FAQ: https://spamo.net/faq.php
- Pricing: https://spamo.net/pricing.php