Spam And Abuse Prevention

Protection On Every Form

The Contact Form, Feedback Form and Guided Form are all covered. In the Contact Form editor you will see the line “Spam protection is on for this form.” It is a statement, not a switch. Each submission passes four checks before anything is emailed to you or stored:

• Automated-submission checks. They run out of sight, so there is no CAPTCHA and nothing for a real visitor to solve.
• A limit on rapid repeats. Many submissions in a short time are held back.
• A domain check. A form accepts submissions only from the website domain saved for that widget.
• Validation on the server. Required fields, email format and length limits are checked again after the form leaves the browser, so they cannot be skipped by changing the page.

None of this is explained to visitors. A person filling in your form on your website sees the form and, once it is sent, your success message.

The Website Domain Matters

The domain check compares the page a submission comes from with the Website Domain you entered when you created the website. You can review or change it on the widget’s Settings tab, in the Domain field under Site Settings.

• example.com and www.example.com count as the same domain.
• A different subdomain, such as shop.example.com, is a different domain.
• A staging or preview address is a different domain too.

Protection On Ask AI

Ask AI is protected in two ways.

• Rate limits. How quickly questions can be sent is limited, and the length of a question is capped.
• A hard monthly allowance. Every answered question counts against the AI message allowance of your AI Chatbot plan. On self-serve plans that allowance is a hard limit with no overage charge, so a burst of questions cannot run up a bill.

When either limit is reached, the visitor sees one neutral line, “This feature is temporarily unavailable.” They are not told the reason, and nothing about your plan or limits is shown. They can keep typing, and the Contact channels in the same widget keep working. On AI Chatbot Starter and higher, a conversation in Chat Logs can carry the status Rate limited or Limit reached, which tells you it happened.

The owner Preview has its own limit. If you send preview questions very quickly, you see “Too many previews right now. Please try again in a moment.” Preview questions also count against the monthly allowance. The follow-up form that Ask AI can offer visitors has its own automated-submission checks. AI Chatbot Allowances covers the monthly limits by plan.

Protection On Sign-In

• Sign-in codes work once and expire after 10 minutes.
• Code requests and code attempts are limited. After too many, the page asks you to wait before trying again.
• Sign-in and sign-up requests are checked to confirm they come from a real browser. If that check fails you see “Verification check failed — try again”; reload the page and try once more.

Two-factor protection, passkeys and the Sessions & Devices list are covered in How Flidu Protects Sessions.

What The Protection Does Not Do

The protection on forms is aimed at automated and repeated abuse. It does not read a message and judge what it says.

• Forms have no keyword or content filter. A person who types an unwanted message by hand on your website can still send it.
• There is no list of blocked senders or words for you to manage.
• There is no setting to make the protection stricter, looser or off.

If Unwanted Submissions Still Arrive

1. Open the widget and go to the Channels tab.
2. Use the switch on the form’s row to turn the published form off. Its settings are kept and you can turn it back on later.
3. If the unwanted messages come from Ask AI’s follow-up form instead, open the assistant’s Settings tab and turn off the options under Visitor Capture.
4. Follow I Am Getting Spam Submissions for the remaining checks.

If real submissions seem to be missing instead, start with I Am Not Receiving Form Submissions.