{
  "name": "Filter spam from webhook form submissions using honeypot and timing checks",
  "nodes": [
    {
      "id": "4c475285-00b7-41e5-8877-edd7036ecdfd",
      "name": "Sticky Note",
      "type": "n8n-nodes-base.stickyNote",
      "position": [
        -608,
        1200
      ],
      "parameters": {
        "width": 800,
        "height": 736,
        "content": "## Filter Spam from Webhook Form Submissions\n\nThis workflow acts as a **spam filter backend** for your website contact forms. It receives form submissions via webhook, runs three automated checks, and"
      }
    },
    {
      "id": "2acb5cb6-da99-404d-beea-ef7f4b41c695",
      "name": "Sticky Note1",
      "type": "n8n-nodes-base.stickyNote",
      "position": [
        208,
        1200
      ],
      "parameters": {
        "width": 436,
        "height": 544,
        "content": "### Step 1: Receive Form Data\nPOST request with JSON body:\n```json\n{\n  \"name\": \"Max Mustermann\",\n  \"email\": \"max@example.com\",\n  \"message\": \"Hello!\",\n  \"website_url\": \"\",\n  \"_timestamp\": \"2026-03-13T1"
      }
    },
    {
      "id": "21c713a0-fcfd-4f7f-ab24-cb6a9b1d1c46",
      "name": "Sticky Note2",
      "type": "n8n-nodes-base.stickyNote",
      "position": [
        656,
        1408
      ],
      "parameters": {
        "width": 300,
        "height": 336,
        "content": "### Step 2: Configure Spam Rules\nEdit the **Configure Spam Rules** node to match your form:\n- `honeypotFieldName`: name of the hidden honeypot field\n- `timestampFieldName`: name of the hidden timestam"
      }
    },
    {
      "id": "7675c649-41ef-4d76-bfb9-ae99dbeee604",
      "name": "Sticky Note3",
      "type": "n8n-nodes-base.stickyNote",
      "position": [
        976,
        1408
      ],
      "parameters": {
        "width": 300,
        "height": 336,
        "content": "### Step 3: Detect Spam\nThe Code node runs three checks:\n1. **Honeypot**: Is the hidden field filled? → Bot\n2. **Timing**: Was the form submitted in < 2 seconds? → Bot\n3. **Disposable email**: Is the "
      }
    },
    {
      "id": "4f20e385-5e53-4839-a1dd-f0e366e97d67",
      "name": "Sticky Note4",
      "type": "n8n-nodes-base.stickyNote",
      "position": [
        1296,
        1408
      ],
      "parameters": {
        "width": 276,
        "height": 336,
        "content": "### Step 4: Route Result\n**Spam branch** (top): Returns `200 OK` with a generic thank-you message. The bot thinks the form worked, but nothing is forwarded. This prevents bots from retrying.\n\n**Legit "
      }
    },
    {
      "id": "1b7ee11a-ec19-41d4-a8b4-d28504af34ff",
      "name": "Receive Form Submission",
      "type": "n8n-nodes-base.webhook",
      "position": [
        400,
        1760
      ]
    },
    {
      "id": "255cb5b9-9be7-4eb9-a1b7-2b13b062dabb",
      "name": "Configure Spam Rules",
      "type": "n8n-nodes-base.set",
      "position": [
        736,
        1760
      ]
    },
    {
      "id": "f25639b5-66d6-4fc8-9771-23396e0d657c",
      "name": "Detect Spam",
      "type": "n8n-nodes-base.code",
      "position": [
        1072,
        1760
      ]
    },
    {
      "id": "34dd9237-5fe1-4822-ac72-024e9a8f47b8",
      "name": "Is Spam?",
      "type": "n8n-nodes-base.if",
      "position": [
        1392,
        1760
      ]
    },
    {
      "id": "f6806a95-9a26-40df-acfa-76bbc8031c7f",
      "name": "Silent OK (Spam Blocked)",
      "type": "n8n-nodes-base.respondToWebhook",
      "position": [
        1712,
        1616
      ]
    },
    {
      "id": "4148a064-fbb2-412a-bed1-e5d668dd931f",
      "name": "Forward & Respond (Legit)",
      "type": "n8n-nodes-base.respondToWebhook",
      "position": [
        1712,
        1904
      ]
    },
    {
      "id": "f3cbeef8-a7b1-47d8-904c-cfcc47f43f44",
      "name": "Sticky Note5",
      "type": "n8n-nodes-base.stickyNote",
      "position": [
        656,
        1136
      ],
      "parameters": {
        "width": 384,
        "height": 256,
        "content": "## **Why this works:**\n- `position:absolute; left:-9999px` hides the field visually but bots still see it in the DOM\n- `aria-hidden` keeps screen readers from reading it\n- `tabindex=\"-1\"` prevents key"
      }
    }
  ],
  "connections": {
    "Is Spam?": {
      "main": [
        [
          {
            "node": "Silent OK (Spam Blocked)",
            "type": "main",
            "index": 0
          }
        ],
        [
          {
            "node": "Forward & Respond (Legit)",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Detect Spam": {
      "main": [
        [
          {
            "node": "Is Spam?",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Configure Spam Rules": {
      "main": [
        [
          {
            "node": "Detect Spam",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Receive Form Submission": {
      "main": [
        [
          {
            "node": "Configure Spam Rules",
            "type": "main",
            "index": 0
          }
        ]
      ]
    }
  }
}