Spam protection
A hidden trap, a minimum time and an optional human check keep bots out.
Public forms attract bots. Mikxx keeps them out of your responses without making real people do anything.
Always on
| Check | What it catches |
|---|---|
| A hidden trap field | A field people never see. Bots that fill in every field fill it in too. |
| A minimum time on the page | Bots send the moment a page loads, or post without opening it at all. A response that reaches Mikxx within 3 seconds of the form opening is dropped. Someone who really answers that fast isn't affected: the form waits out the rest of the 3 seconds ("Sending…") before it sends. |
| Limits per visitor | Too many responses or uploads from one visitor in a short time are refused. |
Spam is dropped quietly: the bot gets the same answer as a real response, so it learns nothing and keeps nothing to tune against. Nothing is saved, emailed or sent to your automations.
Ask for a human check
For forms that still get spam, turn on a human check (Cloudflare Turnstile):
- Open the form's page → Settings → Spam protection.
- Switch on Ask for a human check.
It applies straight away, without publishing. Most people never see it: it checks in the background and only shows a small box when it isn't sure. If the check doesn't pass, the person is told and can try again.
The switch is only available when Mikxx's server has Turnstile keys. If it says the check needs keys, it isn't set up on this server yet.
See what was blocked
Settings → Spam protection shows how many responses were blocked in the last 30 days.
Good to know
- People who take their time are never blocked, however long the form stays open.
- Mini apps are protected the same way as forms.
- Responses sent straight to the API (not through the form page) skip the trap and the timer but are still limited per visitor, and need the human check when it's on.