# Spam and honeypot

Reduce bot submissions with FormsReach honeypot and time-trap fields.

## Built-in signals

FormsReach supports lightweight anti-spam fields recognized by the public submit API:

| Field | Purpose |
|---|---|
| `_gotcha` | Honeypot - must stay empty for humans |
| `_ts` | Time trap - timestamp set on page load; too-fast posts are treated as spam |

Spam submissions can be recorded separately so they do not flood primary workflows the same way as legitimate leads.

## HTML example

```html
<form action="https://api.formsreach.com/submit" method="POST">
 <input type="hidden" name="api_key" value="YOUR_ACCESS_KEY" />

 <input
 type="text"
 name="_gotcha"
 value=""
 tabindex="-1"
 autocomplete="off"
 aria-hidden="true"
 style="position:absolute;left:-9999px;height:0;width:0;overflow:hidden"
 />
 <input type="hidden" name="_ts" id="fr-ts" value="" />
 <script>
 document.getElementById("fr-ts").value = String(Date.now());
 </script>

 <input type="text" name="name" required />
 <input type="email" name="email" required />
 <textarea name="message" required></textarea>
 <button type="submit">Submit Form</button>
</form>
```

## Also use

- [Domain allowlist](/docs/submit-api/domains/)
- Dashboard spam tools on individual submissions

## Related

- [HTML form POST](/docs/submit-api/html/)