Browser validation improves legitimate completion but an automated client can bypass it. A server-processed contact form needs layered controls at the endpoint; a client-app handoff needs different expectations because there is no hosted FormToInbox submission endpoint.
Validate again on the server
Treat every received value as untrusted. Check expected fields, types, lengths, formats and allowed choices at the processing endpoint, then reject malformed or oversized requests without reflecting unsafe content into a response.
Limit automated volume
Apply rate limits by a combination of endpoint, client signals and time window. A visually hidden honeypot can be one low-friction signal, but it should not be the only control and must not trap keyboard or assistive-technology users.
Verify challenge tokens server-side
If you add Cloudflare Turnstile or another human-verification service, validate every token at the server. A client-side widget alone is not protection. Turnstile tokens are short-lived and single-use, and the secret key must stay out of HTML and JavaScript.
Match controls to the submission mode
Email, SMS and messaging handoffs do not post to a FormToInbox server. They can reduce direct endpoint exposure, but public recipient addresses, numbers or usernames remain visible in exported code. Explain the handoff and monitor the destination for unwanted contact.
Frequently asked questions
Does required stop spam?
No. The required attribute helps normal visitors but automated clients can bypass browser validation.
Is a visible challenge enough?
No. Its token must be validated by the receiving server, with failures handled as rejected submissions.
Where should a Turnstile secret key go?
Only in a protected server-side environment. Never include it in exported front-end code or a public repository.
Primary sources
Turn the guide into a working form
Start from a template, change the fields and take the code with you.
Open the free builder