Security
Your Security Center: block IP addresses, review spam caught by the honeypot, protect your forms and keep an eye on sign-ins.
On this page
The Security page is your account’s Security Center. It shows everything Open Leads does to keep your account safe, and gives you the controls to tighten things up: blocking IP addresses, reviewing spam caught by the honeypot, protecting your forms, and keeping an eye on sign-ins.
To open it, go to Settings and click Security (the red shield), or go straight to Settings › Security.
The top of the Security Center: the banner, the five tiles and the Security checkup.
Who can use this page
Only account administrators can see the Security Center, block or unblock addresses, or let caught spam through. Anyone else who opens the page sees a short note that security is managed by their administrators.
The Security Center at a glance
The banner
- Your IP address – the address you are signed in from right now. Open Leads will never let you block this address, so you can’t lock yourself out by mistake.
- Security checks passed – how many of the five checks in the Security checkup are green (for example, “3 of 5”).
The five tiles
Click any tile to jump straight to the matching tab below.
| Tile | What it shows |
|---|---|
| Blocked IPs | How many addresses are kept out of this account. |
| Attempts stopped | How many visits and form submissions from blocked addresses were turned away. |
| Spam to review | How many submissions the honeypot caught that are waiting for you to look at. |
| Forms protected | How many of your forms have the honeypot, Captcha or reCAPTCHA turned on, for example 8 / 12. |
| Failed sign-ins | Wrong-password attempts on this account’s users in the last 30 days, plus any lockouts. |
Security checkup
Every time you open the page, Open Leads checks your account and lists what it found. A green tick means all is well; amber or red means something is worth doing, and comes with a button to fix it.
- Forms with no spam protection – names any form that has none of the honeypot, Captcha or reCAPTCHA. Protect them now turns the honeypot on for all of them.
- Spam waiting for review – Review takes you to the Spam caught tab.
- Failed sign-ins and lockouts in the last 30 days – See them shows only the failed attempts.
- Users who haven’t signed in for 30 days – if someone has left, disable their access from Review users.
- Whether your own IP address is blocked – if it ever is, a red warning appears at the top of the page with an Unblock my IP button.
Blocked IPs
A blocked IP address can no longer submit your forms or open this account. Addresses get here two ways:
- Automatically – when a bot trips the honeypot on one of your forms, its address is blocked right away. These show an Automatic badge and the name of the form that caught them.
- By a person – an administrator blocked it here, or from the Block IP link next to a lead’s Origin IP. The column shows who.
The Blocked IPs tab, with search, Block IP, Unblock selected and Export CSV.
Attempts stopped counts how often each address was turned away, split between form submissions and everything else.
Block an IP address
- Click Block IP (in the bar at the top of the page, or on the Blocked IPs tab).
- Type the address. To block several at once, put each one on its own line or separate them with commas.
- Click Block. Anything that can’t be blocked is listed with the reason – for example, if it isn’t a valid address, it’s already blocked, or it’s your own address.
The Block IP window always shows your own address, which can’t be blocked.
Unblock, search and export
- To unblock one address, click the unlock icon at the end of its row.
- To unblock several, tick their boxes (or the box in the header to tick every row shown) and click Unblock selected.
- Type in the search box to find an address, or the person or form that blocked it.
- Export CSV downloads the whole list, with who blocked each address, when, and how many attempts it stopped.
- The copy icon copies an address so you can paste it elsewhere.
Tip: for form spam, turning on the honeypot usually works better than blocking addresses one by one, because spam bots change addresses all the time.
Spam caught (the honeypot)
The honeypot is a field on your form that people never see. Real visitors leave it empty; spam bots fill in every field they find. When it’s filled in, Open Leads holds the submission here instead of creating a lead, and blocks the sender’s IP address.
The Spam caught tab. When nothing is waiting, it says so.
Each caught submission shows when it came in, which form it was sent from, the name and email it claimed, its IP address (and whether that address is blocked), and why it was caught:
- Filled in the hidden name field
- Filled in the hidden email field
- First and last name were the same – a common sign of a bot.
What you can do with each one
| Action | What happens |
|---|---|
| View (eye icon) | Opens everything that was submitted, plus the page it was sent from and the browser it used. |
| Let through (play icon) | For a real person who got caught by mistake. Creates the lead, runs it through the form’s usual steps (workflow, notifications) and unblocks their IP address. |
| Dismiss (tick icon) | Removes it from the list. No lead is created and the IP address stays blocked. |
| Dismiss selected | Dismisses every ticked submission at once. |
| Clear all | Dismisses the whole list. This can’t be undone. |
The list keeps the newest 200 catches; older ones drop off automatically.
Form protection
This tab lists every form on your account and how it is protected from spam.
The Form protection tab. Each form shows whether it is protected, its honeypot switch, Captcha, reCAPTCHA and how much spam it has caught.
- Status – Protected when the form has the honeypot, Captcha or reCAPTCHA on; Unprotected when it has none.
- Honeypot – flip the switch to turn it on or off for that form. This is the same setting as the honeypot option on the form’s own page, so the two always match.
- Captcha and reCAPTCHA – shown here for reference; they are turned on and off on each form’s own page (click the pencil or the form’s name).
- Spam caught – how many submissions the honeypot has stopped on that form.
- Protect all unprotected forms – turns the honeypot on for every form that has no protection, in one click.
Turning on the honeypot changes nothing for real visitors – the field is hidden from people.
Sign-in activity
Every sign-in and failed sign-in by this account’s users in the last 30 days, with the date, the user, the result and the IP address it came from.
The Sign-in activity tab, with the Team members list on the right.
- Click Failed only to see just the wrong-password attempts and lockouts.
- A failed attempt from an address you don’t recognise has a block button at the end of its row. Make sure it isn’t one of your own offices first.
- Your own sign-ins are marked You.
- Team members shows when each person last signed in. Anyone who hasn’t signed in for 30 days is highlighted – if they’ve left, disable their access from Manage users.
How Open Leads keeps your account safe
The panel at the bottom of the page lists the protection that works for you all the time, whether or not you change anything:
- Encrypted connections – everything between your browser and Open Leads travels over HTTPS.
- Sign-in lockout – after five wrong passwords from the same address, that user is locked out for five minutes.
- Automatic sign-out – when a session ends, the browser is signed out and has to sign in again.
- Every sign-in recorded – each sign-in and failed attempt is logged with its IP address.
- Spam trap on forms – the honeypot stops bots before they become leads and blocks their address automatically.
- Admins only – only account administrators can see the Security Center or change anything on it.
Common questions
A real customer says their form submission never arrived
Open the Spam caught tab and search for their name, email or the form. If you find it, click Let through – the lead is created and their IP address is unblocked.
Can I lock myself out?
No. Your current IP address can’t be blocked from this page. If your address was ever blocked some other way, a red warning appears at the top of the Security Center with an Unblock my IP button.
Should I turn on the honeypot for every form?
Yes, for any form on your website. It’s invisible to visitors and stops most spam bots. Forms with reCAPTCHA are already protected, but you can use both.
Is there a tour of this page?
Yes. Click Help at the top right of the Security page and choose the tour for a one-minute walk through every section.