Rate limits

One person submitting twice is normal. Hundreds of requests in a few seconds are not.

Rate limits control sustained traffic and short bursts for each form. Form Plume uses a soft client fingerprint so one abusive source cannot consume the entire form's allowance.

What the limits are

Form Plume applies two sliding-window estimates per form and submitter, configured by default with a limit of 1 submission over 30 seconds and 20 submissions over 10 minutes. The key combines the form, IP address, user agent, and accepted language. Both windows can be configured per form. The current limiter is in memory, so limits apply per running API process and reset when that process restarts.

A limited request is rejected before storage or spam scoring. Use the time trap as a separate timing signal for requests that remain within the traffic limits.

When a request is limited

A request that asks for JSON receives 429 Too Many Requests with Retry-After. Native HTML submissions receive a 303 See Other redirect to the form's configured error page or Form Plume's hosted error page with fp_error=rate_limited.

JavaScript clients should request JSON and wait before trying again:

const response = await fetch(form.action, {
  method: "POST",
  headers: { Accept: "application/json" },
  body: new FormData(form),
});
 
if (response.status === 429) {
  const wait = response.headers.get("Retry-After");
  showError(`Too many attempts. Try again in ${wait} seconds.`);
}

Do not retry immediately in a loop. That creates more traffic and keeps the client limited for longer.