Skip to content

Spam protection that keeps the record

Spam is a label you can review, not a bin you can never open.

A quiet trap for bots

Add one hidden field to your form. People never see it; many bots fill it. Those messages are kept aside while the bot receives the same polite response as anyone else.

What your agent adds to the form 
<input type="text" name="_gotcha" tabindex="-1" autocomplete="off" style="position:absolute;left:-10000px" aria-hidden="true">

A little breathing room

Set a sensible pace for each form and say which sites are allowed to post. A sudden rush or a post from somewhere else is kept aside with a reason instead of landing in your inbox.

A stronger check when you need it

Turn on Cloudflare Turnstile for a form that is getting extra attention. If the check cannot be completed, Postbag keeps the message aside rather than throwing it away.

Useful labels, not permanent verdicts

You can review what was caught and mark a real message as not spam. Your inbox never sees the noise by default; a full record can include everything when it truly needs to.

Questions, answered

Will spammers know they were caught?
No. A caught message gets the same outward response as a normal one.
Can I recover a real message marked as spam?
Yes. It is still there with a label. Change the label and send it on when you are ready.
Do I have to use a CAPTCHA?
No. The hidden field and sensible limits are on by default. Turnstile is optional for a form that needs it.

Give the form job to your agent.

It can build, wire and test the form before you even sign up. Claim it when it's worth keeping.

Create a form Read the quickstart