Spam protection

Waitlark checks every signup in four ways:

1. Allowed sites. Signups are only accepted from the sites on your project's list.
2. Cloudflare Turnstile. A bot check that most people never notice.
3. Limit per visitor. At most 20 tries a minute per visitor and project.
4. Honeypot (optional). A hidden website field. People don't see it; bots fill it in, and then nothing is stored.

"We couldn't check you're human"

This is verification_failed. Usually one of these:

• Turnstile didn't load. Check your Content Security Policy and any ad blockers.
• The site isn't on the Turnstile widget. The bot check only works on the domains it was set up for.
• The form was sent twice. Each check can be used once. The embed handles this itself; with your own form, reset Turnstile after an error.