Stop contact form spam, without a puzzle
Antisy stops contact form spam by checking that a message comes from a browser and not from a program. The visitor sees nothing: no checkbox, no puzzle. Your server receives a verdict, allow or deny, before recording the message.
Why does a contact form get spam?
A contact form is a door open to the whole Internet: programs find it and send messages through it in bulk. Sorting them afterwards takes time, and a puzzle to solve puts the effort on your real visitors.
How do you block contact form spam?
- A tag in the
<head>of the page that carries the form, with the public key of your site. - At submission, the script puts a short token in the hidden field
antisy-tokenof the form: you write no JavaScript. - Your server sends this token to
POST /v1/siteverify, with your secret, and reads the answer:allowordeny.
The measurement of the browser and the decision happen at Antisy. The call can be made from any language: it is an HTTP request.
See: Documentation: quick start · Documentation: verifying a token
What to do with the verdict?
allow: record or send the message. deny: refuse it, without saying why. There are only these two outcomes, and the answer never gives the reason: each reason given would teach whoever is getting round the check what stopped them.
What if the script is blocked, or Antisy does not answer?
If the script is blocked (an ad blocker, an incomplete CSP policy, a visitor without JavaScript), the form is still sent, without a token: without an antisy-token field, or with this field empty if the page already carries one, and your server reads it with an empty value by default; the same goes for a form the script does not cover (one sent with fetch, for instance) whose page does not call antisy.token(). What follows depends on the “Browser collection” setting of your site: on, a submission without a token does not pass; off, a missing token is not held against it.
If Antisy does not answer within 3 seconds, let the submission through and log it: an outage at Antisy must not block your visitors.
Which data is processed?
In the browser, the script measures the capabilities the browser declares, the languages and the time zone of the browser, the graphics rendering and the fingerprint of the device, signs of automation, the behaviour of the JavaScript engine and the course of the interaction: the fingerprint as digests salted per site, the interaction as counters and aggregates. Antisy’s server reads the order of the HTTP headers, the IP address, the User-Agent and the request context. The script never reads the content of keystrokes or fields. The home page names each piece of data kept and how long it is kept, written in advance.
What this path does not cover
This call suits low-stakes forms: contact, newsletter. It does not tie the token to an account: a login or a sign-up goes through another call.
Antisy is spam protection for forms, not an e-mail filter: it does not sort the mail your inbox receives.
See: Use case: protecting a login · Use case: protecting a sign-up
Is it available today?
Not yet. Access is by waiting list. The API and the dashboard (in French) have been in service since 27 October 2026, hosted at Infomaniak in Geneva; no customer is in production yet.