Protect the form from spam
How B2B Desk keeps bots and repeat submissions out of your applications, what applicants see when a limit is hit, and how to handle spam that gets through.
B2B Desk protects the form on your store and the hosted page in the same ways. You don’t need to set anything up. Settings › Hosted application page shows which protections are active.
A hidden spam trap
Both forms include a field people can’t see. Bots that fill in every field fill it in too. Those submissions get the normal thank-you message, so the bot moves on, but nothing is saved and you never see them.
Rate limits
| Limit | Counted |
|---|---|
| 20 submissions | Per network address, per hour |
| 5 submissions | Per email address, per 24 hours |
| 60 submissions | Per store, per hour |
Over a limit, applicants see “Too many attempts. Please wait a while and try again.” on your store, or “Too many attempts” on the hosted page. Network addresses are stored only in scrambled form, and only to count.
Cloudflare Turnstile
When B2B Desk has Cloudflare Turnstile on, applicants see a short verification check above the submit button. Settings shows the badge Turnstile on with “Cloudflare Turnstile checks every submission on this page and the form on your store, along with a hidden spam trap and rate limits.”
Without it, the badge reads Basic: “A hidden spam trap and rate limits stop most bots on this page and the form on your store.” Turnstile isn’t a setting you change in your store.
Spam that gets through
Some spam is typed by people and passes every check. Open it and click Mark as spam, or tick several in the To review view and mark them together. Spam leaves your review queue, triggers no emails or notifications, and is deleted 12 months later. See Manage the applications list.
Requiring a business email and a tax ID format also filters out a lot of low-effort spam. See Set validation rules on form fields.