Settings reference
Every setting in the FormFence admin, what it does, what the default is, and when to change it.
Every setting in the FormFence admin lives on a single Settings page in the embedded app. Open the app from your Shopify admin and click Settings in the top nav.
Sensitivity
Controls how strict every layer of detection is. The honeypot and per-IP rate limit are always active across all levels; this setting controls which content-pattern rules fire on top AND scales the weighted-vocabulary scoring threshold.
| Level | Weighted threshold | What it does |
|---|---|---|
| Low | × 1.5 | Blocks high-confidence spam only: honeypot hits, disposable emails, obvious crypto and SEO pitches. Vocabulary scoring needs strong, distinctive evidence before blocking. Lowest chance of a real message getting caught. |
| Medium (default) | × 1.0 | Adds pattern-based blocks like URL floods and cold web-design outreach. Vocabulary scoring fires at a balanced threshold. A handful of legitimate edge cases may get caught. |
| High | × 0.5 | Catches the most spam. Vocabulary scoring fires at a much lower threshold (single weight-4 term blocks alone), and subtle signals like very short bodies and shouty capitals start triggering. Expect more false positives. |
You can change this any time. The next submission is classified at the new level. Earlier submissions stay where they are.
AI classifier for borderline cases
When the rule-based layers can't decide, FormFence asks an AI classifier (Anthropic Claude Haiku via Vercel AI Gateway) for a second-opinion verdict. The toggle on the Settings page lets you opt out per shop.
- On (default): borderline submissions are sent to the AI classifier (zero data retention; AI provider doesn't store the message). The classifier blocks only when it's at least 70% confident the message is spam. Submissions clearly caught or cleared by the rules never reach the AI.
- Off: only rule-based detection runs; no submission text is ever sent to the AI provider.
Every submission's detail pane shows whether the AI was consulted, what it said, and at what confidence, so you can audit per row.
Business name
Shown as the sender name when you reply to a passed submission from inside the app (Pro plan only).
Leave blank to use a name derived from your shop handle. If your shop is called Anchor Coffee Co. but your Shopify domain is anchor-coffee.myshopify.com, set the business name to Anchor Coffee Co. so replies come from the name customers recognise.
Maximum length: 80 characters.
Support email
Used as the reply-to address when you send a reply to a passed submission (Pro plan only).
Any response from the customer lands in this inbox, not ours. We recommend a shared inbox like support@yourstore.com rather than a personal address, so replies don't go to one person on holiday.
Plan
Read-only display of your current plan: Free or Pro.
- Free: Honeypot and rate limiting are active. No dashboard, no logs.
- Pro: Adds full detection pipeline (content patterns, weighted scoring, AI classifier), dashboard, both logs, CSV export, reply composer, move-to-passed and delete tools.
To upgrade, click Upgrade to Pro anywhere it appears in the app. To cancel, manage your subscription from inside the Shopify admin under Settings → Apps and sales channels. See Billing for the full picture.
What isn't configurable
These are intentional design choices, not omissions:
- The per-IP rate-limit threshold is fixed. The default catches burst-style spam without affecting normal customer traffic.
- The honeypot field name is randomised per shop so bots can't learn to skip it across stores.
- The disposable-email list and the content-pattern catalogue are maintained centrally and updated for every customer at once.
- Per-form selection doesn't exist. FormFence protects the Shopify contact form via the theme block; you enable it once per theme and it covers every contact page.
If you have a use case that needs any of the above to be adjustable, email formfence@harbourlabs.app and we'll consider adding it.