A guardrail for your
existing forms.

1. Add a protected site

Sign in, open Form Guard and choose Add protected site. The guided setup collects the client and form context, identifies the website platform, explains its actual support level, configures destinations, and shows the complete numbered installation. Use one protected site for each client website.

2. Save, then submit

For observation copy, keep the original form validation, abuse controls, storage and delivery. Save the original submission before calling this API. For managed delivery, the server connector must retry a failed intake until Form Guard confirms that it stored the submission. Use a stable identifier from 8 to 100 characters. Repeating the same identifier and content returns the original record without another destination delivery.

const response = await fetch(process.env.GUARDRAIL_URL + "/api/forms/submit", {
  method: "POST",
  headers: {
    "Content-Type": "application/json",
    Authorization: "Bearer " + process.env.FORM_GUARD_SOURCE_KEY,
  },
  body: JSON.stringify({
    idempotencyKey: savedSubmission.id,
    name: savedSubmission.name,
    email: savedSubmission.email,
    message: savedSubmission.message,
    honeypot: savedSubmission.website || "",
    isTest: false,
  }),
});
if (!response.ok) {
  // Keep the original in YOUR durable queue. Retry with the same ID.
  throw new Error("Submission requires retry: " + response.status);
}
const decision = await response.json();
// Every accepted response includes an ID for the saved submission.
// Never show internal spam judgments to the person filling the form.

Messages may contain up to 12,000 characters. Source intake is limited to 60 new submissions per minute. Retry transient failures and HTTP 429 after at least one minute. A 409 with changed content requires a new identifier. Never silently discard a lead on an API error.

3. Handle every disposition

Observation copy does not create Form Guard destination delivery. Managed delivery creates durable destination jobs automatically.

4. Use verified destinations

Managed delivery supports verified email recipients and signed outbound webhooks. Email uses the verified Agency Guardrail sender. Webhooks include a stable delivery identifier, a timestamp, and an HMAC SHA 256 signature over the timestamp and exact request body. Receivers must durably accept the request before returning success and must deduplicate on the delivery identifier.

Form Guard records every attempt and retries with increasing delays. A released submission creates any missing destination jobs and starts real delivery. Observation copy never performs that release delivery, which prevents a duplicate of the website's original email or CRM action.

5. Review before enabling protection

Send a published website test whose message begins with [FORM GUARD TEST]. The setup diagnostic verifies the installed connection, classification, delivery when applicable, idempotency, and health. Collect at least five real observations, including brief inquiries, nonnative writing, customer complaints and unwanted traffic. Review every unwanted and uncertain result before protection becomes available.

AI assessments, rule decisions and service outages are labeled separately. Model confidence is not an independently measured accuracy guarantee.