A public sign-up form is a public write endpoint, and bots find those quickly. HappenBoard ships several defences that are always on, plus two you can switch on when the always-on layers are not enough.
What is protected without any setup
These apply to every submission of the RSVP Form block. There is nothing to configure and no setting to find.
- A security token. Every rendered form carries one, and a submission without a valid one is refused. This ties each sign-up to a real page view.
- A honeypot field. An invisible input that a human never sees and never fills. Bots that fill every field in the form give themselves away.
- A minimum fill time. The form is stamped when it is rendered, and the stamp is signed so it cannot be forged. Anything submitted within two seconds is treated as automated.
- A maximum age. A form left open for more than six hours has to be reloaded before it can be submitted, which also closes the door on replayed submissions.
- Rate limits. Five sign-ups per minute from one address, and three per hour for one email address.
- One active sign-up per email per event, which stops a bot flooding a single event under one identity.
Two of these reject silently. A submission caught by the honeypot or by the two-second rule receives a normal-looking success response but is never stored, so an attacker cannot tell which of their tricks was spotted. The others answer with a plain message, because a real person can hit them: someone reloading a stale tab is told to refresh the page, and a household sharing one connection is told to wait a minute.
Cloudflare Turnstile
A captcha that most visitors pass without doing anything. It sets no cookies and does not involve Google, which matters if your visitors are in Europe.
- Create a Turnstile widget in your Cloudflare account and note the site key and the secret key.
- Open HappenBoard → Integrations and press Configure on the Cloudflare Turnstile card.
- Turn on Enable Turnstile on RSVP forms, paste both keys, then press Save changes.
Both keys are required. The screen refuses to save an enabled Turnstile with a missing key, because a form showing an empty widget would block every legitimate sign-up. The secret key is stored on the server and never sent back to your browser, so the field looks empty when you return to it; leaving it empty keeps the stored key, and typing a new value replaces it.
Once on, the challenge appears in the form and the visitor has to clear it before submitting. If Cloudflare cannot be reached at that moment, the check is skipped rather than blocking the sign-up, and the always-on layers still apply.
Akismet
Akismet judges each submission against the same spam service used for comments across WordPress.
- Open HappenBoard → Integrations and press Configure on the Akismet card.
- Turn on Enable Akismet on RSVP forms.
- Enter your API key, then press Save changes.
If the Akismet plugin is already active on your site with a key configured, a green notice says so and a Use Akismet plugin key button lets you reuse it. The key field then stays empty and HappenBoard borrows the plugin’s key at send time, so you never retype it.
Submissions Akismet flags are dropped silently, exactly like the honeypot. If Akismet cannot be reached, or is enabled with no usable key, the submission is allowed through rather than lost.
What blocked submissions leave behind
Nothing. A rejected sign-up creates no attendee record, no email and no queue for you to review. That keeps the Attendees screen clean, but it also means a misconfiguration is invisible. After enabling Turnstile or Akismet, submit your own form once and confirm the row appears.
Two privacy points worth knowing before you enable either. Turnstile runs a Cloudflare script on the pages holding a sign-up form. Akismet sends the submitted name, email address, IP address and browser details to Automattic for scoring. Both are third-party processing and belong in your privacy policy, alongside the rest of what HappenBoard stores about attendees.
Notes for specific setups
- The per-address rate limit reads the connecting address and does not trust proxy headers by default. Behind a reverse proxy or some CDN configurations, every visitor can appear to share one address, which makes that limit far stricter than intended. A developer can correct this with a filter.
- The same protections cover the visitor event submission form in Pro, so letting visitors submit events does not need a second anti-spam setup.