IP-level rate limiting — 'max 5 submissions per IP per hour' — catches the bottom half of unsophisticated bots without impacting real users. It's a zero-cost first-line defense.
Why the problem compounds
IP rate limiting is a problem with exponential dynamics — one piece of spam that works breeds dozens more, each tried at scale against similar targets. The right defense is similarly layered: no single technique catches everything, but stacking them leaves almost no uncaught spam.
The Cal Clear default stack
Cal Clear ships with honeypot + IP rate-limiting enabled on every booking page, with optional reCAPTCHA v3 and optional email verification per link. The free tier includes the core protections; Pro unlocks granular control over reCAPTCHA thresholds and custom blocklists.
What to turn on for public-shared links
If you share your booking link on LinkedIn, your website, or Twitter — enable email verification, enable reCAPTCHA v3, and set the reCAPTCHA threshold conservatively (0.5-0.6). For private, invite-only links, the lighter defaults suffice.
Frequently Asked Questions
Does Cal Clear's anti-spam affect legitimate clients?
In our testing, <1% of real bookings trigger any anti-spam challenge. Honeypot is invisible, rate-limiting only affects clearly abusive patterns, and email verification adds a short extra step (clicking a link) that clients routinely complete.
Can I customize the anti-spam configuration per link type?
Yes (Pro plan). Configure stricter rules for your public link (e.g., LinkedIn profile booking) and lighter rules for private client-only links.
Scheduling built for modern work
Cal Clear is free forever with unlimited multi-calendar, anti-spam, and privacy-first defaults.