Protect an action with GreetProof

In Your sites, open GreetProof protection, enter your exact HTTPS website origin and action names, then choose Protect. Save and copy the server secret into your private server environment.

1. Add verification to your form

Replace YOUR_SITE_ID with your GreetMode site ID. Load the script after the form. The script adds a hidden greetproof_token field when verification succeeds.

<form method="post" action="/contact.php"
      data-greetproof-site="YOUR_SITE_ID"
      data-greetproof-action="contact">
  <!-- Your existing inputs and submit button -->
</form>
<script src="https://www.greetmode.com/greetproof.js" defer></script>

2. Verify on your server BEFORE processing the form

Use this in your PHP form handler before storing a submission or sending email. Set GREETPROOF_SECRET in private server configuration. Never send it to a browser. If verification fails or times out, reject the submission and offer a retry or another contact method.

<?php
$secret = getenv('GREETPROOF_SECRET');
$token = $_POST['greetproof_token'] ?? '';
if (!$secret || !is_string($token) || strlen($token) !== 64) {
    http_response_code(403); exit('Please complete verification.');
}
$curl = curl_init('https://www.greetmode.com/api/proof/YOUR_SITE_ID/verify');
curl_setopt_array($curl, [
    CURLOPT_POST => true,
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_CONNECTTIMEOUT => 3,
    CURLOPT_TIMEOUT => 8,
    CURLOPT_HTTPHEADER => ['Content-Type: application/json',
        'X-GreetProof-Secret: ' . $secret],
    CURLOPT_POSTFIELDS => json_encode(['token' => $token, 'action' => 'contact']),
]);
$raw = curl_exec($curl);
$status = curl_getinfo($curl, CURLINFO_HTTP_CODE);
curl_close($curl);
$result = is_string($raw) ? json_decode($raw, true) : null;
if ($status !== 200 || ($result['success'] ?? false) !== true
    || ($result['mode'] ?? '') !== 'protect') {
    http_response_code(403); exit('Verification failed. Please try again.');
}
// Now validate your form fields, then process the submission.

Custom JavaScript forms

Call await GreetProof.execute('YOUR_SITE_ID', 'contact'), include the returned token in your submission, and use the same server verification. Automatic form installation uses a normal browser POST; applications with their own submit handlers should use this API instead.

Optional traffic reports

Enable traffic reports in your site's GreetProof settings, then add this separate script. Collection honors Do Not Track and Global Privacy Control. It records coarse timing and interaction counts, never typed text, coordinates, URLs, cookies, or storage. Assessments appear after a session closes, at least 32 minutes after its first report. Ratings describe suspicious patterns in untrusted browser reports; they do not prove identity or bypass protection.

<script src="https://www.greetmode.com/greetproof-traffic.js"
        data-site="YOUR_SITE_ID" defer></script>

For custom action reporting, call GreetProofTraffic.createClient('YOUR_SITE_ID').action('contact', 'start'), and report success or failure when your action completes. Supported reporting kinds: contact, quote, signup, login, booking, chat, checkout, and api. These reports are separate from server verification.

Test your installation

A normal submission completes verification and succeeds.
Submitting directly without a token fails.
Reusing a token fails, as does using it for a different action or site.
Expired tokens fail; the visitor must verify again.
Rotating a secret invalidates old credentials and outstanding tokens.

Managed visitor verification

Protect mode opens a GreetMode verification window powered by Cloudflare Turnstile. GreetMode validates the provider result on its server and binds it to your site's action and a short-lived challenge. Your server must still verify the resulting single-use GreetProof token before accepting a submission. If verification is unavailable, the submission fails; offer visitors a retry and another contact method.

Turnstile processes browser and network information under Cloudflare's policies. Disclose this service in your site's privacy notice. If your site uses Content Security Policy, allow https://www.greetmode.com in script-src, style-src, connect-src, and frame-src. The hosted verification window loads Cloudflare's challenge service. Test your own CSP and supported browsers before enabling protection.

Protection mitigates automated submissions at integrated endpoints. It does not establish human identity or protect whole-site traffic, volumetric attacks, or unintegrated endpoints. Keep existing form validation, authorization, spam controls, and request limits.

Tokens expire in two minutes and are single-use. Activity stores only action, outcome, and time, and is deleted after 14 days by the GreetMode worker. Verification does not record typed text, browser fingerprints, or mouse movements. Optional traffic reports store bounded coarse timing and counts and are also removed after 14 days. Request limits use server-side IP-derived hashes in temporary files, cleaned up after 24 hours of inactivity.

A maximum of 120 challenge, solution, and authenticated verification requests per site per minute currently applies. Managed verification requires HTTPS, modal dialog support, and a content security policy allowing the GreetMode script, stylesheet, connection, and frame. Provide another contact method for visitors whose browser cannot complete verification.