Security and anti-spam
GiveFlow includes multiple layers of protection against spam, abuse, and data breaches. Every measure works out of the box with no configuration required.
Anti-spam measures
GiveFlow uses five complementary techniques to block spam submissions. Together, they stop bots and abuse without adding friction for real donors.
Honeypot field
Every donation form includes a hidden field that real donors never see. Bots that fill in all fields will populate this hidden field and get blocked automatically.
The field name rotates randomly from a pool of realistic names (such as website, url, homepage, company, web, company_url, and your_site). This rotation prevents bots from learning to skip a single known field name.
Form token
When a donation form loads, GiveFlow generates an HMAC-signed token and includes it in the form. The token carries a whole-day bucket rather than a per-render timestamp, so a form served from a page cache still submits successfully.
On submit, GiveFlow checks two things:
- The signature matches. It is recomputed with the form id that was submitted, so a token minted on one form cannot be replayed against another.
- The token is not dated in the future, and is no more than 30 days old.
If a submission fails either check, GiveFlow rejects it before processing any payment.
IP rate limiting
GiveFlow limits each IP address to 10 submission attempts per 15 minutes. This prevents a single source from flooding your forms with spam.
When organization-wide test mode is on, this limit is relaxed so you can submit multiple test donations without being blocked.
Email rate limiting
Each email address is limited to 3 submission attempts per hour. This stops attackers from using a single email to generate large numbers of fraudulent donations.
Like IP rate limiting, this restriction is relaxed in organization-wide test mode.
Minimum donation amount
GiveFlow enforces a minimum donation of 100 cents in your organization currency, for example $1.00. This prevents micro-donation spam attacks that some fraudsters use to test stolen credit cards.
You can adjust this minimum with the giveflow.spam.min_amount_cents filter if your organization needs a different threshold.
Donor data encryption
GiveFlow encrypts the most sensitive donor fields at rest using AES-256-GCM encryption. This is the same encryption standard used by banks and government agencies.
Encrypted fields are stored as ciphertext, so nothing readable sits in the donor table. GiveFlow generates the encryption key on first use and keeps it in its own system settings table, separate from the donor records.
What is encrypted
These donor fields are encrypted with AES-256-GCM: email address, postal address, phone number, tax ID, and staff notes. A copy of the donor table on its own reveals none of them.
Donor first name, last name, and company are stored in plain columns so the admin can list and search donors.
What is hashed
Donor email addresses are also stored as a one-way hash, an HMAC-SHA-256 digest keyed with a secret generated for your install. The hash is what GiveFlow matches on to recognize a returning donor, so it never has to decrypt every record to find one.
The hash is one-way. You cannot reverse it to recover the original email address.
No configuration needed
All security measures are active from the moment you install GiveFlow. You do not need to enable, configure, or maintain any of these protections.
Organization-wide test mode relaxes the IP and email rate limits so you can test freely. When you turn test mode off, full protection is restored.