Docs

Last updated October 19, 2026. SpamFlip is operated by MLN Learning LLC.

This page describes the embed, the event the snippet fires, and the same privacy model as the privacy notice. It does not describe how a score is calculated.

Install

Add the snippet and mark each form you want protected with data-spamflip. The snippet only attaches to form[data-spamflip]. Other forms on the page are left alone. The form's action stays as the fallback if the proxy cannot be reached.

<script src="https://spamflip.app/sf.js" data-site-key="YOUR_SITE_KEY" defer></script>

<form data-spamflip action="https://example.com/your-handler" method="POST">
  <input name="email" type="email" />
  <textarea name="message"></textarea>
  <button type="submit">Send</button>
</form>

Replace YOUR_SITE_KEY with the key from the dashboard. Ingest accepts that key and rejects any other. The forward address is the URL saved on the site, not a value taken from the browser.

The snippet sends the submission to SpamFlip and, if that request fails, tries once more. Each try waits up to 12 seconds. If both fail, it removes the honeypot fields it added and submits the form to its original action.

Handlers

The pages below follow the same snippet. They do not add a promise about the handler.

• HTML forms
• Formspree
• Netlify Forms

Badge

A “Protected by SpamFlip” link is off unless you opt in. The link points to https://spamflip.app and opens in a new tab.

• Add data-badge="true" on the snippet to show the link as soon as the snippet runs.
• Or turn the badge on for that site in the dashboard. The setting is off by default. When it is on, the install snippet includes the attribute, and the challenge response includes badge: true so a snippet that is already on the page can show the link after the visitor first focuses the form.

Events

After the proxy responds, the snippet dispatches spamflip:submitted on the form. The event bubbles and can be cancelled. event.detail is { ok, body }. ok is true when the response status is successful. body is the response text.

Call preventDefault() to keep the form in place and handle the result yourself. If you do not, a failed response shows “Couldn't send that. Please try again in a moment.” A successful response replaces the form with “Thanks — your message was received.”

Customer sites receive a neutral response with a status and a reference. The homepage demo is the exception: a same-origin submission on the store-only demo key also includes that submission's score and verdict, and the page shows them. Signal names are not included.

Privacy

The privacy notice is the full description. In short:

• The visitor IP used for scoring is stored as a hash, not as the raw address.
• A submission may be kept so the site owner can review a quarantined message and release it. That copy is encrypted when payload encryption is configured, and submission records expire after about 30 days.
• An email address a visitor types into a form may be in that stored copy and in the forwarded message. It is not limited to a hash.
• Account emails are stored to send a one-time sign-in link. The contact form collects the name, email, and message the person submits.
• Quarantine email alerts are off unless the site owner opts in. When they are on, and mail delivery is configured, Resend sends the owner the site key, the score, the verdict, and a dashboard link. The notice does not include the visitor's message.
• Payment details are collected by Stripe when checkout is available. SpamFlip does not sell personal information. A customer site is responsible for its own notice to its visitors.