Bot check
The bot check is one script on the page with the form. A post without its proof, such as one from a server, a webhook or curl, is held in your Spam folder.
The script
Load it once on every page that has the form. The dashboard’s code and every example in these docs already include it.
Example form address. Use yours from the dashboard.
<script src="https://f.formparcel.live/f/formparcel.js" async></script>It is served from the form endpoint host at /f/formparcel.js. It sets no cookies and shows nothing. How it works, step by step, is on Spam protection.
| Part | What it is |
|---|---|
GET /f/formparcel.js | The script. It finds each form whose action is a form address on the same host and adds the proof when the form is sent. |
FormParcel.proof(address) | For a page that sends with fetch. Resolves to one proof for one submission. Send it as the _fp_proof field. |
_fp_proof | The hidden field that carries the proof. FormParcel checks it and never stores it with the lead. |
GET /f/{formId}/challenge | The challenge the script asks for. You never call it yourself. |
Without the proof
A post without a valid proof is not refused. It is saved, held in your Spam folder, and not delivered or counted. It gets the same answer a lead gets, so a bot learns nothing.
Your dashboard shows Bot check not installed for the form under Needs action. Release a real lead with Not spam: it is then delivered and counted.
Who cannot send the proof
Only a visitor’s browser can make the proof. These posts never carry one, so their leads wait in Spam:
- Your own server, a serverless function or an API route that forwards the form.
- A site builder’s webhook: Framer’s webhook, Wix Automations, Elementor Pro’s Webhook action, the WPForms Webhooks addon, or a plugin that sends Contact Form 7 to a webhook.
- A test with
curl, Postman or a script. Use Send a test lead in the dashboard instead: it skips the check. - A page that does not load the script, or whose Content-Security-Policy blocks it.
- Server key for webhooks and server posts Coming soon: A per-form key for a site builder's webhook or your own server, so a lead posted from a server is delivered instead of held in Spam. Until it ships, post from the visitor’s browser.
Fix it
- Plain form: keep the script line on every page with the form. See the HTML guide.
- fetch: load the script, then send
_fp_prooffromFormParcel.proof()with each lead. See the fetch guide. - Content-Security-Policy: allow
https://f.formparcel.liveinscript-srcandconnect-src. - A builder that only posts from its server: put the form in an HTML embed on the page instead. Each builder’s guide says how: Choose your platform.