{"slug": "i-tested-spam-protection-on-formspree-vs-formgrid-the-results-were-surprising", "title": "I Tested Spam Protection on Formspree vs Formgrid. The Results Were Surprising.", "summary": "In a test comparing spam protection on free plans, Formspree allowed a cryptocurrency scam submission containing emojis, a disposable email, and gibberish to reach the inbox, while Formgrid automatically blocked the identical submission. Formspree’s free plan lacks spam filtering, requiring a $15/month paid plan for protection, whereas Formgrid applies automatic spam checks—including emoji, disposable email, and URL detection—on all plans, including free. The results highlight that Formgrid’s built-in filtering prevents disruptive spam from ever reaching users, while Formspree’s free users remain vulnerable to increasingly sophisticated bot submissions.", "body_md": "If you use Formspree to handle your HTML form submissions, you may have noticed something frustrating lately.\nSpam is getting worse. And Formspree is not stopping it.\nI ran a simple test last week that confirmed what many Formspree users are already experiencing. Here is exactly what happened.\nI set up two identical contact forms. One pointing to a Formspree free plan endpoint. One pointing to a Formgrid free plan endpoint.\nThen I submitted this spam to both:\nName: 💰 Top Up 36,824.92 USDC ⇒⇒ graph.org/BALANCE-3682444-USD-04-21-3?hs=a4973c2d49735de24405dc4e9935f590& 💰\nEmail: oijm2lwwnxhwqn@wshu.net\nMessage: dxospb\nThis is a real spam submission. Not something I made up. It was submitted to a real business contact form on 20 May 2026 at 8:26 AM.\nThe submission went straight to the inbox. No filtering. No blocking. The business owner received the full spam email notification with the cryptocurrency scam content, the disposable email address, and the random gibberish fields.\nThis is a Formspree free plan limitation. Spam filtering is not included on the free plan. Every submission, regardless of content, goes directly to your inbox.\nFor a solo developer or small business owner, this is annoying. For a team like a counselling service or a professional services firm, receiving this kind of content in a shared inbox is genuinely disruptive.\nNothing arrived.\nThe submission was silently blocked before it ever reached the inbox. No email notification. No lead created in the dashboard. The spam never existed as far as the form owner was concerned.\nFormgrid detected multiple red flags in the submission automatically:\nEmoji in the name field:\n💰 symbols are not legitimate names\nCryptocurrency content:\nUSDC and balance transfer patterns are known spam signals\nDisposable email address: wshu.net is a known throwaway email domain\nURL in the name field: graph.org link embedded in what\nshould be a name field\nGibberish fields:\nyp574z, uujdgc, and dxospb are random\ncharacter strings not legitimate data\nArrow patterns:\n⇒⇒ is a common spam formatting pattern\nused in crypto scam submissions\nAll of these checks run automatically on every Formgrid form on every plan, including free. The form owner never configured anything.\nThe spam was blocked without any action required.\nMost contact forms collect inquiries from real people with real problems your business can solve. When spam floods your inbox, it buries those real inquiries.\nA counselling service receiving cryptocurrency scam content in their team inbox is not just annoying. It is inappropriate and disruptive to their workflow.\nA small business owner checking their form submissions and seeing spam instead of genuine leads is wasting time and losing confidence in their tools.\nForm spam is not a minor inconvenience. It directly affects your ability to respond to real customers quickly.\nFormspree has been around since 2012. Their free plan has always had limited spam protection. As bots become more sophisticated, the gap between what Formspree filters and what actually gets through continues to widen.\nTheir paid plans at $15 per month include reCAPTCHA and additional spam filtering. But that means paying $15 per month just to stop obvious spam that should never reach your inbox in the first place.\nFormgrid runs platform level spam checks on every single submission across every form on the platform automatically. These checks cannot be disabled and apply to every plan, including free.\nThe checks include:\nEmoji detection in name fields. Legitimate names do not contain cryptocurrency symbols or emoji.\nDisposable email domain blocking. A database of known throwaway email services like wshu.net, yopmail.com, and mailinator.com is blocked automatically.\nURL detection in name fields. Real names do not contain links. If a name field contains a URL, it is spam.\nHTML injection blocking. Any submission containing HTML tags like anchor links or script tags is silently filtered.\nGibberish field detection. Random character strings in fields that should contain readable text are flagged automatically.\nCryptocurrency and casino keyword filtering. Known spam content patterns are matched and blocked before reaching your inbox.\nArrow pattern detection. Spam formatting patterns like ⇒⇒ used in crypto scam submissions are detected and blocked.\nAll of this runs silently. The spammer receives a successful response, so they never know they were blocked. You never see the submission. Your team never sees the content.\nSwitching takes about 5 minutes.\nYour existing form HTML does not change. Your fields stay the same. Only the action URL changes.\nFrom this:\n