Spam protection for booking pages and forms

Your booking pages and public intake forms are open to anyone who has the link, which also makes them a target for spam and automated tools. Esqase checks every booking and every form submission before it reaches your calendar, your leads, or anyone's inbox. Real clients almost never notice.

This page explains what Esqase checks, what happens to a submission that looks automated, and every message a visitor can see when a submission is refused, so you can help a client who gets stuck.

Before you begin

• There is nothing to turn on. The checks run on every booking page and every public lead-intake form, including forms embedded on your own website. They cannot be switched off for a firm.
• Accepting a held submission needs a firm owner, or a role with Update access for leads. See Roles and permissions.
• The same protection covers the emailed sign-in links on meeting and form pages, and your own team's sign-up and password reset pages. See Signing up and signing in.

What Esqase checks

Each booking or submission goes through these checks, in this order:

1. A hidden trap and the time on the page. The page carries a field that people cannot see. Automated tools tend to fill it in, or to send the page a moment after it opens. Either one gets the submission refused. A page left open for more than a day asks the visitor to reload it first.
2. The email address. It has to be a complete address, it cannot come from a temporary (throwaway) email service, and its domain has to be able to receive email.
3. Addresses Esqase no longer sends to. If email to the address has bounced or the person reported an Esqase email as spam, the booking page and the form refuse it. See Addresses Esqase no longer sends to.
4. How often. Only a few bookings or submissions are accepted from the same network within a few minutes, and only a few from the same email address to your firm in one day.
5. An invisible automated-traffic check. Esqase scores how likely it is that a person, rather than a tool, sent the submission. There is no puzzle to solve and nothing to click. This is the Google reCAPTCHA check described in the Esqase Privacy Policy.

Names are cleaned too. Web addresses, email addresses, numbers, and symbols are taken out of the name fields before the contact is saved, so a name cannot carry a link into your dashboard, a notification, or an email. On an intake form, the submitted answers still show exactly what was typed.

What happens to a submission

Every booking or submission ends one of three ways.

• Accepted. This is almost every real booking and submission. It works exactly as described in How clients book meetings and How clients fill intake forms.
• Held for review. The automated-traffic check was unsure. Esqase saves the booking or submission and creates the lead, but nothing goes out to the visitor and no workflow starts until someone on your team accepts it. See Submissions held for review.
• Refused. The submission looked automated, came too often, or used an address Esqase cannot accept. Nothing is saved: no contact, no lead, no calendar event, and no email. The visitor sees a short message telling them what to do (see the next section).

What a held booking does and does not do

• The time is held on the host's calendar as a tentative meeting, even when the event type auto-confirms bookings. The meeting is not confirmed until a member approves it.
• The client sees Your request was received on the confirmation page, with "The firm will confirm by email." (or "The firm will contact you to confirm." when they gave only a phone number).
• The client gets no email yet, and no meeting link is created.
• The meeting page's emailed sign-in link is not available. A client who asks for one sees "This meeting is not available yet. The firm will confirm it by email."
• Workflows for new leads do not start.

Approving the meeting request confirms the meeting, accepts the lead, starts the workflows, and sends the client the Meeting confirmed email. See Submissions held for review.

What a held form submission does and does not do

• The lead, the contact, the answers, and any attached files are saved, as for any submission. The visitor sees your usual confirmation page.
• Workflows for new leads do not start, so no workflow email, form, or reminder goes to the address that was typed.
• The emailed sign-in link is not offered for this lead's forms. A client who asks for one sees "Sign-in links are not available for this form. Please contact the firm directly."

What your team is told

Instead of the usual New lead, firm owners and colleagues whose role can see leads get Booking request held for review or Intake submission held for review, with the line "Lead [number] looked automated. Open it to review and accept it." It names no one, because the name may not be real. See Notifications.

Why a public form can refuse a submission

A refused visitor sees one of the messages below, either at the top of the form or under the field it is about. None of them saves anything, so the visitor can fix the problem and send again.

On a booking page

On a public intake form

Sending a form again from its own link. When a form allows more than one submission, a visitor can send it again from the link of their earlier submission. That goes through the same checks, and the same messages apply. A submission held for review cannot be sent again this way: the visitor sees "We could not accept this automatically. Please contact the firm directly." until a member accepts the lead.

File uploads. Each file a visitor adds to a File upload question is checked too:

On the sign-in links of meeting and form pages

How the checks protect your calendar and inbox

• A refused submission leaves nothing behind. No contact, lead, tentative meeting, or notification is created, and no email is sent.
• A held booking sends nothing and creates no meeting link until a member approves it, so a tool cannot use your booking page to send email or create meetings on your host's own Google, Zoom, or Microsoft account.
• The booking confirmation carries no text the visitor typed, apart from a cleaned first name in the greeting. The email and its calendar invite are titled with your event type and your firm's name, for example "Initial consult with Smith & Co", so nobody can use your booking page to send a message of their own.
• Your bell is protected from a flood. When more than five leads arrive from your booking pages, or from your intake forms, within the same ten minutes, the rest are grouped into one New booking requests or New intake submissions notification that says how many arrived. See Notifications.
• Addresses that bounce or report spam stop getting email, and Esqase sends a limited number of sign-in and confirmation emails to one address each hour, so a booking page or form cannot be used to flood someone's inbox. See Addresses Esqase no longer sends to.

Common questions

A client says the booking page will not take their booking. What should I check? Ask which message they see and look it up in the tables above. The usual causes are a typo in the email address, a temporary email address, or a page left open since the day before. If they see "We could not accept this automatically", book the meeting for them from your calendar.

Why was a real client's booking held? The automated-traffic check is cautious with traffic that looks like a tool, for example some privacy browser settings or shared networks. A browser extension that blocks the invisible check also gets a booking or submission held rather than refused, a few times; after that, the page asks the visitor to contact your firm. Approve the meeting request (or accept the form submission) and everything carries on as normal.

Can my firm see refused attempts? No. A refused attempt is not saved for your firm, so it does not appear in your leads, your calendar, or your audit log.

Can I turn the checks off for my firm? No. They protect your calendar and your clients' inboxes, and they keep Esqase's email trusted by mail providers for every firm that uses it.

Related

• Managing leads
• How clients book meetings
• How clients fill intake forms
• Public lead-intake forms
• Sending email
• Notifications