Form Security – Spam Protection & Access Control | Uplup
Protect your forms from spam and fraudulent submissions. Cap the number of times each person can submit, choose a spam-protection level, and (on Business plans) restrict by country or U.S. state.
Table of Contents
- Opening Security Settings
- Submission Limits
- Spam Protection
- Country Restrictions
- U.S. State Restrictions
Opening Security Settings
- Open your form in the builder (the Create tab).
- In the left sidebar, scroll past the field-type groups (Text, Contact, Selection, Feedback, Uploads, Content) and the Design accordion.
- Click Security to expand the accordion. The four sections appear inline below: Submission Limits, Spam Protection, Country Restrictions, and U.S. State Restrictions (the last one appears only when relevant).
Settings save automatically as you change them — there is no separate save button inside the Security panel.
Submission Limits
Cap how many times the same person can submit your form. The limit is enforced server-side using device and IP signals.
Under Each person can submit… pick one option from the dropdown:
- once – one submission per person.
- twice – up to two submissions.
- 3 times
- 5 times
- 10 times
- unlimited times (default) – no per-person cap.
- a custom amount… – reveals a number input where you can set any value from 2 to 9999.
Spam Protection
Choose one of three protection levels using the segmented picker (Off / On / Strict). Click What does each level block? to expand the per-level details panel.
Off
No spam protection. Every submission is accepted.
On (recommended)
Blocks Tor users and known abusers. Balanced protection that works for most forms.
- Tor exit nodes
- IPs flagged for malicious activity
Strict
Maximum protection. Also blocks VPNs, proxies, and data-center traffic.
- Everything from “On”
- VPN connections
- Proxy servers
- Data-center IPs (non-residential)
Heads-up: Strict mode may block legitimate users on corporate networks or privacy tools.
Allow VPN connections
A separate toggle below the level picker. When the level is Off or On, this toggle controls whether users on a VPN can submit (default: on, VPNs allowed). When the level is Strict, the toggle is locked off because Strict always blocks VPNs — switch back to On to allow them again.
Country Restrictions
Limit which countries can submit your form. Country and U.S. state restrictions require the Business plan. If you are on a lower plan the radio buttons are disabled and a Business badge appears next to the section heading.
Pick one mode:
- Allow all countries (default) – no geographic filtering.
- Only allow specific countries – submissions are accepted only from the countries you check.
- Block specific countries – submissions are accepted from everywhere except the countries you check.
When you pick Only allow or Block, a search box and country checklist appear below. Type to filter and tick the countries you want to include or exclude.
U.S. State Restrictions
This section appears only when it is relevant to your country selection — specifically when:
- You picked Only allow specific countries and the United States is on your allow-list, or
- You picked Block specific countries, you have at least one country on your block-list, and the United States is not on it (so U.S. traffic is still arriving).
Within U.S. State Restrictions, choose:
- Allow all (default) – no state-level filtering.
- Allow some – only selected U.S. states can submit.
- Exclude some – all U.S. states except the selected ones can submit.
The list covers the 50 states plus D.C., Puerto Rico, Guam, American Samoa, U.S. Virgin Islands, Northern Mariana Islands, Marshall Islands, Federated States of Micronesia, and Palau. A search box helps you filter the list quickly.
What Uplup forms do not include
To save you time hunting for them: Uplup’s form Security panel does not currently expose CAPTCHA / reCAPTCHA, password protection, email-verification on submit, or per-IP allow-lists. Spam control is handled by the three-level picker above; access control is handled by the country and state restrictions.