37. Custom Anti-Spam Rules

Fillin Forge has two filters for the origin check, and nothing else in the anti-spam system can be extended. The rate limit is fixed at 10 submissions per 60 seconds per IP address.

formforge_allowed_origins

Submissions are accepted from the site itself. This filter starts from an empty list; return the host names of other sites that embed your form, for example in an iframe.

add_filter( 'formforge_allowed_origins', function ( $hosts ) {
    $hosts[] = 'partner.example.com';
    return $hosts;
} );

formforge_allow_empty_origin

Requests that carry no origin header are refused. Return true to accept that case, and no other:

add_filter( 'formforge_allow_empty_origin', '__return_true' );