---
title: "Avoiding Form Spam Submissions"
slug: "avoiding-form-spam-submissions"
updated: 2026-08-25T16:27:51Z
published: 2026-08-25T16:27:51Z
canonical: "knowledge.technolutions.net/avoiding-form-spam-submissions"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://knowledge.technolutions.net/llms.txt
> Use this file to discover all available pages before exploring further.

# Avoiding Form Spam Submissions

Slate uses CAPTCHA protections and submission rate limits to reduce bot submissions and fraudulent submissions. These protections also reduce the number of confirmation emails that bot submissions generate. Some submissions can still pass these protections.

Spam bots often target Slate forms by submitting entries with URLs that contain `http` or query strings that contain `?` in name fields. These patterns rarely appear in legitimate submissions. Use submission conditions to block these submissions, and use retention policies to remove spam records that get through.

## Blocking spam with submission conditions

> [!WARNING]
> 📝 Note
> 
> Completely eliminating spam submissions is difficult because bad actors continuously adapt their methods. These filters reduce exposure, but might not catch every case.

Add a [submission condition](/v1/docs/access-and-submission-conditions) filter to your form to deny entries from anyone whose name contains `http` or `?`.

1. On a form, select **Edit Form** → **Edit Conditions**.
2. Select **Subquery Filter** and configure the following settings:
  - **Name**: `Not Like 'http'` or `Not Like '?'`
  - **Type**: **Dependent subquery**
  - **Aggregate**: **Formula**
  - **Formula**: `@first NOT LIKE '%http%'` or `@first NOT LIKE '%?%'`
  - **Export**: Select the form's name field. Rename the export `first`.
3. Select **Save**.
4. In the **Submission Denied** field, enter a generic error message, such as *"You are not permitted to submit this form at this time."* Avoid specific language that reveals your filter logic to bad actors.
5. Select **Save**.

![Subquery filter formula using NOT LIKE](https://cdn.us.document360.io/cd8ea7a6-07f3-4846-a554-627ac016d3e3/Images/Documentation/NOT LIKE(2).png?sv=2026-02-06&spr=https&st=2026-10-12T12%3A30%3A41Z&se=2026-10-12T13%3A30%3A41Z&sr=c&sp=r&sig=xEGGLlKelhDmXD3LknwsU%2FOr6aebzYNpyosrlQNsDrs%3D)

![Submission condition and submission denied error message](https://cdn.us.document360.io/cd8ea7a6-07f3-4846-a554-627ac016d3e3/Images/Documentation/Form submission condition & error message(2).png?sv=2026-02-06&spr=https&st=2026-10-12T12%3A30%3A41Z&se=2026-10-12T13%3A30%3A41Z&sr=c&sp=r&sig=xEGGLlKelhDmXD3LknwsU%2FOr6aebzYNpyosrlQNsDrs%3D)

## Deleting spam records

If spam records make it through, use a [retention policy](/v1/docs/retention-policy-editor) to remove them in bulk.

Filter for known spam patterns, such as records where the name contains `?`, or records where you added a flag or interaction to mark the record as spam. Then configure a retention policy to delete matching records.

**📖 Further reading:** [Retention Policy Editor](/v1/docs/retention-policy-editor)