How FormCrab Blocks Spam Bots From Contacting You

FormCrab blocks spam bots by never exposing your real email address in the first place. Instead of publishing your address, you share a private form link (formcrab.com/f/your_link). Messages submitted through that link are screened before they reach your inbox: automated bots are "instantly tested and turned away at our door," while only real entries written by real visitors pass through. You don't configure filters or blocklists yourself — the screening happens on FormCrab's side.

The two layers of protection

FormCrab's anti-spam approach works in sequence, and each layer addresses a different failure mode.

Layer 1: Your address is never published

The most common way spam finds you is scraping. Bots crawl websites, social bios, and code pages looking for anything that looks like an email address, then sell or reuse those addresses for spam lists. FormCrab's site describes this directly: "Bad computer programs quickly scan websites to steal written email addresses."

Because your real address stays "private in our backend system," there is nothing on your page for a scraper to collect. This layer doesn't filter spam — it removes the input spam depends on.

Layer 2: Submissions are screened before delivery

Hiding your address stops scrapers, but it doesn't stop someone (or something) from filling out the form itself. That's what the second layer handles. According to FormCrab, "Automated spam bots are instantly tested and turned away at our door," and "Only real entries written by real visitors pass through safely to your clean inbox."

The site frames this as a "Smart Bot Blocker" that runs automatically. There is no mention of a user-facing rule builder, keyword blocklist, or CAPTCHA configuration — the screening is presented as built in.

What this actually protects you from

The phishing and scam row is worth noting: FormCrab's argument is that "Hackers find your real address easily" when it's public, so hiding it removes you as an easy target. That's a reduction in exposure, not a guarantee that no malicious message ever reaches you.

What you don't have to do

FormCrab's pitch is explicitly low-effort. The site says the setup is "Ready in 30 seconds" and that the links are "Ready-To-Use" with "No code or setup needed." In practice that means:

• No filter rules to write or maintain
• No allowlists or blocklists to curate
• No spam-folder triage as a routine habit

If you've used a form plugin or a self-hosted contact form before, the difference is that spam handling isn't a task you own — it's part of the product.

Where the link can go

The same link works anywhere you'd otherwise paste an email address. FormCrab lists GitHub Readmes, social bios, Linktree links, Notion public pages, static blogs, and personal sites. In each case the trade is the same: visitors get a working way to reach you, and you avoid publishing the address itself.

A realistic example

Say you maintain a small open-source project and want a contact method in your README. The usual move is to write [email protected] in the file. Within days, scrapers can pick that up and your inbox starts collecting marketing mail and fake "your account has been suspended" phishing attempts.

With FormCrab, the README instead contains formcrab.com/f/your_link. A real user with a genuine question fills out the form and the message reaches you. A bot that crawls the README finds a form URL, not an address — and if it tries to submit through the form, the bot screening rejects it.

What to verify before relying on it

The mechanism described is credible for the two problems it targets (scraping and automated form submissions), but a few things are worth checking yourself rather than assuming:

• Delivery reliability. The site promises "Safe Mail Delivery Protection," but the only way to know messages actually arrive is to send a test submission and confirm it lands.
• What "tested" means. FormCrab doesn't publish the specifics of how bots are detected. If your use case attracts targeted (human) spam rather than automated spam, screening designed for bots may not catch it.
• Retention. Messages live in the panel for 30 days before deletion. If you need a longer archive, forward or export them yourself.
• Pricing and account requirements. The site links to a pricing page, so check current terms before assuming any tier is free.