Every public form eventually gets hit by bots. The classic fix is a CAPTCHA puzzle, which annoys real patients and causes accessibility problems. Formisoft uses three layers instead, all on by default.
Rate Limiting
Each form accepts up to 20 submissions per minute from a single IP address. A real patient never gets close. Bots sending hundreds of submissions get stopped. Anyone who does hit the limit sees a clear message and can resubmit after the 60-second window resets.
Honeypot Fields
A honeypot is a hidden field patients never see. Bots fill in every field they find, so a filled honeypot gets the submission silently dropped. The bot receives a normal-looking response and has no signal to adapt.
Invisible Bot Check
Formisoft also verifies each submission with Cloudflare Turnstile. For nearly every patient it runs in the background with nothing to click. Only a suspicious visitor is asked to confirm they're human.
Why It Matters
- Notifications: 500 spam submissions means 500 junk emails burying real ones.
- Data: spam makes real responses harder to find.
- Webhooks: blocked submissions never fire your webhooks, so connected tools only receive real data.
Edge Cases
Shared networks: the limit is per IP, so an office where everyone shares one connection shares one counter. At 20 per minute this rarely matters.
Password-protected forms: bots can't get past the password prompt, and the other layers still apply.
There's nothing to configure. Protection starts the moment you publish a form.
Related: patient intake software | intake form templates | dental practices
Get every patient ready before they walk in.
- Forms, consents, and signatures before the visit
- Your paper forms converted by AI
- BAA included