Bot protection
When a bot floods your form, Ascue blocks the bot, not your customers.
Most days, spam trickles in. Then a bot finds your form and sends hundreds of messages in an afternoon.
Ascue notices, switches on attack protection, and blocks the bot’s addresses and every copy of what it sends, while real customers keep coming through. Blocked messages don’t use your checks, and you get one email about it. Nobody solves a CAPTCHA.
Included on every plan, the free one too. Blocked spam is never counted.
Three layers, and none of them is a puzzle.
- 01
An invisible browser check.
WordPress plugin
When a visitor starts filling in your form, their browser quietly solves a tiny puzzle served by your own site, in a fraction of a second. Scripts that post forms without a browser, or faster than a person could fill one in, don’t have the answer. Visitors never see it, and their browser never contacts Ascue.
- 02
Quick checks.
Every form
Before Ascue asks its model anything, cheap rules catch the obvious: empty messages, walls of links, links to programs and a sender’s sixth message in an hour. With the WordPress plugin, so are messages sent by scripting tools instead of a browser, and forms sent faster than a person could fill them in.
- 03
The attack shield.
Every form, strongest with the plugin
Ascue watches for addresses that keep sending spam and for sudden bursts of it. When it sees one, it blocks the source on sight, and copies of what it sends, until the attack stops.
An attack, minute by minute.
An illustration of the rules Ascue follows, on a site using the WordPress plugin. The thresholds are the real ones.
-
A bot finds your form. Its first two messages are labeled spam, and its address is blocked at your site for as long as it keeps sending.
-
It switches addresses and speeds up. Your form has had 20 messages in 10 minutes, most of them spam, so attack protection switches on. You get one email saying so.
-
Now a single spam blocks an address, no address gets more than 3 messages an hour, a network that sends 3 spam is blocked, and copies of the bot’s messages are blocked whoever sends them.
-
A customer asks for a quote. Their browser passed the check and their address has no spam behind it, so their message is checked and delivered as usual.
-
The bot gives up. Everything it sent is in your spam folder. The messages the shield blocked, nearly all of them, are in your Blocked tab and didn’t use a check.
-
After 30 quiet minutes, attack protection switches off by itself.
Built so real people still get through.
- Real senders are trusted. An address or network that sent your site a real message in the last 24 hours is never blocked, so a customer on the same office or mobile network as a bot still gets through.
- Nothing is deleted. Blocked messages wait in your dashboard’s Blocked tab and spam folder for 30 days. Release any of them with a click.
- Corrections teach it. Release a blocked message and Ascue trusts its address and network, at your site and across Ascue, and stops treating its wording as part of the attack.
- No flood of unsorted mail. While an attack lasts, Ascue spends at most 30 checks an hour on messages that get past the shield. Anything beyond that waits as Not checked and is tried again over the next day. It’s never dumped into your inbox unsorted, and you can release any of it yourself.
Blocked bots are free.
A check is used only when Ascue asks its model about a message. An attack shouldn’t eat your month.
See the plansCaught by a quick check
Empty messages, walls of links, scripts and failed browser checks. Labeled spam, free.
Blocked by the shield
Known spam sources, and copies of an attack’s messages. Held as spam, free.
A repeat
The same message twice within a day, from a double click or a bot sending it again. It reuses the first answer, free.
Even past your limit
If you run out of checks, these are still sorted. Only messages that need the model are delivered unsorted until the month resets.
One bot, many forms.
Bots rarely attack one form. When an address has sent spam to three or more other Ascue sites in the last hour, it’s blocked at yours too, before it gets going, unless it sent any of them a real message in the last day.
Ascue compares keyed hashes of addresses, never the addresses themselves, and no site learns where else a bot was seen.
What each setup gets.
Every way of connecting a form gets sorting and attack protection. The more Ascue knows about the visitor, the more it can do.
WordPress plugin
- Invisible browser check
- Quick checks
- Blocking by address and network
- Blocking copies of spam
- Attack check budget
REST API
- Quick checks
- Blocking by address and network, if you send the visitor’s IP
- Blocking copies of spam
- Attack check budget
- Not included:Browser check (add your own)
Email forwarding and form webhooks
- Quick checks
- Blocking copies of spam
- Attack check budget
- Not included:Browser check
- Not included:Blocking by address (an email doesn’t say where the visitor was)
Questions about bot protection.
Could attack protection block a real customer?
It’s built hard against it. Anyone who sent your site a real message in the last day is never blocked, blocked messages are kept for 30 days, and releasing one trusts that address from then on. The weekly digest lists what was held, so you can skim it.
Do blocked messages use my checks?
No. A check is used only when Ascue asks its model about a message. Messages its quick checks catch, messages the shield blocks, and repeats of a message your site got in the last 24 hours are all free. Your dashboard shows how many it sorted for free this month.
Do I need to do anything during an attack?
No. You get one email when protection switches on, at most once a day per site, and it switches off by itself after 30 quiet minutes. Your site’s page shows how many messages were blocked in the last hour.
What about visitors with JavaScript turned off?
Their message arrives without a browser check answer. Most of the time that’s fine, and it’s sorted like any other message. During an attack, messages without a valid answer are blocked, so check your Blocked tab after one.
Does it work without the WordPress plugin?
Partly. With email forwarding and form webhooks, Ascue doesn’t know the visitor’s address, so it blocks copies of spam and limits how many checks an attack can use, but can’t block the bot by address. The REST API gets address blocking when you send the visitor’s IP. See the API docs.
What happens to visitors’ IP addresses?
Each one is turned into a keyed hash the moment it arrives and is never stored itself. Hashes and browser user agents are deleted within 7 days. WordPress sites can turn sending them off, and the browser check, with one line each. Read the privacy policy.
Let Ascue watch the door.
Sign up, connect your form, and the next bot that finds it gets blocked without you lifting a finger. Free for your first 50 messages a month, and blocked spam doesn’t count.