The RSVP form and the booking page are protected against bots from the start. There is nothing to set up. If spam still gets through, add Cloudflare Turnstile, Akismet, or both, from HappenBoard → Integrations.
The protection already in place
These checks run on every submission:
- A hidden trap field (a “honeypot”): people never see it, but bots that fill in every field fill it too, and give themselves away.
- A signed time stamp: when a visitor starts filling in the form, it fetches a time stamp signed by your site. A form sent less than 2 seconds later is treated as a bot. A time stamp older than 6 hours is refused, and the form fetches a fresh one on its own. It also works on pages served by a cache plugin.
- Rate limits: the RSVP form accepts 5 submissions per minute from one internet connection, and 3 per hour for one email address. The booking page accepts 8 per minute and 5 per hour.
- One active sign-up per email address for each event, or each date of a recurring event.
A bot caught by the trap field or the 2-second rule gets a reply that looks like a success, but nothing is saved. A real person who hits a limit sees a plain message instead, such as a request to wait a minute or to reload the page.
Add Cloudflare Turnstile
Turnstile is a captcha (a test that tells people from bots) that most visitors pass without doing anything. It sets no cookies and does not involve Google.
- In your Cloudflare account, create a Turnstile widget for your domain and copy its site key and secret key.
- Go to HappenBoard → Integrations and click Configure on the Cloudflare Turnstile card.
- Turn on Enable Turnstile on public forms.
- Paste the Site key and the Secret key.
- Click Save changes.
The switch covers the RSVP form and the booking page. Both keys are required: the card will not turn Turnstile on without them.
The secret key is never shown again: when you come back, the field shows “Saved. Leave blank to keep it”. Type a new key only to replace it.
Once Turnstile is on, visitors must pass the challenge before sending the form. If Cloudflare cannot be reached at that moment, the check is skipped rather than blocking the sign-up, and the built-in checks still apply.
Add Akismet
Akismet checks each submission against the spam service many WordPress sites use for comments.
- Go to HappenBoard → Integrations and click Configure on the Akismet card.
- Turn on Enable Akismet on public forms.
- Enter your key in API key. If the Akismet plugin is already set up on your site, click Use Akismet plugin key instead.
- Click Save changes.
The switch covers the booking page too. Submissions that Akismet flags as spam are dropped without a word, like the trap field. If Akismet cannot be reached, the submission goes through.
Check that it works
Blocked submissions leave no trace: no attendee, no booking, no email. After turning on Turnstile or Akismet, send your own form once and check that your name appears on the Attendees screen.
Mention them in your privacy policy
Turnstile loads a Cloudflare script on the pages that show a form, and your site sends the visitor’s IP address to Cloudflare with each check. Akismet sends the name, email address, IP address, browser details and page address to Automattic. Both belong in your privacy policy, with the personal data HappenBoard stores.
Sites behind a proxy or CDN
The per-connection limits read the visitor’s IP address. Behind a proxy or a CDN that hides it, every visitor can appear to come from the same address, and they all share the 5-per-minute limit. If people are told to wait for no reason, ask a developer to pass the real visitor address to HappenBoard (see attendees and sign-up hooks).
With HappenBoard Pro, the same protection covers the form for visitor event submissions and orders of free tickets.
Next steps
- Setting up an RSVP form: the form these checks protect.
- Publishing the booking page: the booking form, protected the same way.
- GDPR, personal data and uninstalling: what you store and share about attendees.