MetaLocator contact forms use several layers of protection against automated spam and high-volume abuse. These controls are designed to stop scripted submissions at the platform level, throttle repeated requests, validate that a form submission originated from a recently-generated MetaLocator form, and add friction when one sender manually attempts to contact many locations.
Automated bot protection
MetaLocator currently uses the following protections on its forms:
AWS WAF and bot controls. Incoming requests are screened at the network edge so known, poor reputation or suspicious automated traffic can be monitored, challenged, throttled, or blocked before it reaches the contact form.
Request throttling. Repeated requests are rate-limited to reduce high-volume automated submissions.
Signed, time-limited HMAC form tokens. MetaLocator generates a signed token when the form is rendered. The server validates that token when the form is submitted. Because the token is signed and valid only for a limited period, a bot cannot reliably manufacture valid submissions or reuse an old form indefinitely.
Lead Verification. MetaLocator supports Lead Verification that prevents delivery of the lead until the sender verifies authenticity by clicking on an emailed link.
Lead Blocklists. MetaLocator maintains customer-specific block lists that allow for blocking senders by email, domain, IP and more.
Additional measures include the following:
Block profane submissions
Enable Block Leads with Profanity? in Contact Form Settings to block leads that match the built-in US English profanity filter.
Ask MetaLocator Support to block an abusive IP source
If abusive traffic has a consistent source, MetaLocator can block specific IP addresses. Contact MetaLocator Support with examples that include timestamps, sender addresses, and the affected interface so the traffic can be investigated.
Recommended response to spam
If an interface begins receiving spam:
Review several unwanted leads to identify repeated sender email addresses, domains, IP addresses, message patterns, and submission times.
Check the behavior of the Visitor ID in analytics by clicking the "View Profile" link in the Lead Details. View the source, analytics actions and other behavior to understand the source of the spam.
Add narrowly targeted Lead Blocklist rules for confirmed abusive senders, domains, or IP ranges.
Configure Lead Verification when the abuse involves repeated manual submissions from the same sender.
Enable the profanity filter if the unwanted submissions contain abusive language.
Contact MetaLocator Support if the traffic is distributed, unusually persistent, or appears to bypass normal controls.
Avoid overly broad domain or CIDR blocks unless you are confident they will not affect legitimate visitors.
Related documentation
Lead Verification - sender thresholds, verification, delays, expiration, and profanity filtering
Lead Blocklist Configuration - supported block types and rule management
Strategies to avoid automated and manual content scraping - WAF, IP blocking, and broader locator protections