Request Demo

Books a real half-hour with whichever accepting host it is fairest to hand it to, or answers 409 {"error": "slot_taken"} when the visitor's chosen slot is gone.

ORDER OF CHECKS MATTERS. The honeypot runs FIRST and short-circuits everything else, including Turnstile and even the elapsed-time check: a script that fills every field it finds -- including the hidden one -- is answered as cheaply as possible, with a plausible fake success and nothing written, before a single database query or Turnstile call is spent on it. Real defenses (elapsed-time, then Turnstile) run only for submissions that got past the trap; the rate limiter runs before all of it, since it is the cheapest check and the one that protects the other two from being run at all under a flood.