IP-level rate limiting — 'max 5 submissions per IP per hour' — catches the bottom half of unsophisticated bots without impacting real users. It's a zero-cost first-line defense.
Why the problem compounds
IP rate limiting is a problem with exponential dynamics — one piece of spam that works breeds dozens more, each tried at scale against similar targets. The right defense is similarly layered: no single technique catches everything, but stacking them leaves almost no uncaught spam.
The Cal Clear default stack
Cal Clear ships with reCAPTCHA v3 and per-IP rate limiting on by default for every booking link (reCAPTCHA can be turned off per link), plus optional email verification per link. All of it is on the free tier.
What to turn on for public-shared links
If you share your booking link on LinkedIn, your website, or Twitter — enable email verification and keep reCAPTCHA v3 on. For private, invite-only links, the lighter defaults suffice.
Frequently Asked Questions
Does Cal Clear's anti-spam affect legitimate clients?
reCAPTCHA v3 is invisible, rate-limiting only affects clearly abusive patterns, and email verification adds a short extra step (clicking a link) that clients routinely complete.
Can I customize the anti-spam configuration per link type?
Yes (Pro plan). Configure stricter rules for your public link (e.g., LinkedIn profile booking) and lighter rules for private client-only links.
Scheduling built for modern work
Cal Clear is free forever with unlimited multi-calendar, anti-spam, and privacy-first defaults.