Spam protection

Hosted pages include it automatically. On your own pages, add the honeypot above, and turn on proof of work under the form's spam rules, then mark the form and load the script:

<form
  action="https://intake.starstorm.dev/api/form/<form id>/submission"
  method="POST"
  data-intake-pow="https://intake.starstorm.dev/api/form/<form id>/challenge">
  ...
</form>
<script src="https://intake.starstorm.dev/pow.js" defer></script>
<!-- with fetch():
     body.altcha = await IntakePow.solve(challengeUrl) -->

Anything caught is stored as spam with the reason, never dropped, and can be released from the inbox.