Protect your Kit form from bots
In short: To stop spam on a Kit (formerly ConvertKit) form, copy its HTML embed code into the SpamKill Setup Wizard, delete Kit's ck.5.js script line, then paste the protected code on your page. SpamKill checks every signup without a CAPTCHA and real subscribers still reach Kit; afterwards, visitors see Kit's own success page. It takes about 10 minutes.
Bots are signing fake addresses up to your Kit list. Protect your Kit form with SpamKill and real subscribers keep landing in Kit. One limitation to know first: you delete one Kit script line from the code, and after signing up, visitors see Kit's own success page instead of a message in the form.
- About 10 min
- 6 steps
- Copy and paste one snippet
Last verified on Kit Free (inline form, HTML embed) with the SpamKill Setup Wizard
What changes, and what doesn't
- Subscribers still arrive in Kit, with your confirmation email
- Your subscribers and existing forms
- Your form's fields and look
- Every signup is checked before it reaches Kit
- Visitors see Kit's success page instead of a message in the form
- Undo it anytime by putting your old form code back
Before you start
Have these ready so nothing stops you halfway.
- A SpamKill accountNo account yet? Start a free trial.
- A Kit inline formIn Kit, under Audience growth › Landing pages & forms, on the Forms tab.
- A way to edit your page's HTMLYou'll paste HTML code, so use an HTML or code block in your site editor.
Quick setup
For returning users. Each line links to its full step.
- In Kit, open Landing pages & forms, click your form, click Embed, choose the HTML tab and click Copy. Step 1
- In the SpamKill Console, open Setup Wizard, click No to the WordPress question and paste the code. Step 2
- In the wizard's box, delete the first line, <script src="https://f.convertkit.com/ckjs/ck.5.js"></script>. Step 3
- Click Generate Protected Code, check the email field is email_address, then click Yes, protect my form. Step 4
- Copy the protected code, paste it where the Kit code was, publish the page, then click Next. Step 5
- Submit [email protected] and expect an error, then submit a real address and check Kit's Subscribers. Step 6
Copy your form's HTML code
Where: KitLanding pages & forms
In Kit, click Audience growth › Landing pages & forms in the sidebar (1), open the Forms tab and click your form (2). In the form editor, click Embed. Choose the HTML tab (3), not JavaScript, and click Copy (4).
You should see: Your form's code on your clipboard. It starts with <script src="https://f.convertkit.com/ckjs/ck.5.js"></script>.
Paste it into the Setup Wizard
Where: SpamKill ConsoleSetup Wizard
In the SpamKill Console, click Setup Wizard in the sidebar. If your site isn't on WordPress, click No under Is your website developed in WordPress?. Paste the Kit code into the box (1).
You should see: Tips under the box, then Please select the email field input showing email_address.
Is this form already live on your site?
Create a new inline form in Kit and paste its code instead. You can delete the old form once the new one is set up.
Delete Kit's script line
Where: SpamKill ConsoleSetup Wizard
Still in the wizard's box, find the first line: <script src="https://f.convertkit.com/ckjs/ck.5.js"></script> (1). Select the whole line and delete it. Leave everything from <form onwards in place.
You should see: The code in the box now starts with <form action="https://app.kit.com/forms/.
Why delete it?
Kit's script sends the form in the background. SpamKill needs the browser to submit it normally, so with the script on the page the signup is lost and the form shows Failed to fetch.
Generate the protected code
Where: SpamKill ConsoleSetup Wizard
Click Generate Protected Code. SpamKill asks you to check the email field: it should be email_address (1). Click Yes, protect my form (2).
You should see: Replace the existing code with this code on your website, above your protected code. Searching it for ck.5.js finds nothing.
Swap the code on your page
Where: Your website editor
Copy the protected code. Open the page with your Kit form in your website editor. Delete the Kit form code and paste the SpamKill code in its place. Save and publish the page. Then click Next in the wizard.
You should see: Your page shows the same signup form as before.
Does your site style the form by field name?
SpamKill renames the email field, and the wizard lists the old and new names. Update any CSS or scripts that point at the old name.
Test it twice
Open your page in a private window. Submit the form with [email protected] (1). Then submit it again with an address you can recognise. Kit shows its success page (2), and the address appears in Kit as a new subscriber (3).
The first try shows That email address doesn't look right.
The second try appears under Subscribers as Unconfirmed (4) until the confirmation email is clicked.
Back in the wizard, click Both Tests Passed.
You should see: Success! Now check your email to confirm your subscription. after the second try.
Your Kit form is protected
- Bots are stopped before they reach Kit.
- Real leads arrive exactly as before, with no extra steps for them.
- Every block is logged in your SpamKill dashboard.
Something not working?
Find what you're seeing.
The form says "Failed to fetch" and no subscriber appears in Kit
Kit's ck.5.js script is still on the page. Check the live page's code for ck.5.js, delete that script tag as in step 3, and test again.
A real visitor was told their email doesn't look right
SpamKill checks for missing @ symbols, extra spaces and common typos. The visitor can click Go back to the form, fix the address and send again.
There's no success message in the form
That's expected. Without Kit's script, the success message shows on Kit's own page instead.
My test subscriber says Unconfirmed
That's Kit's double opt-in: Kit emailed a confirmation link to the address. The subscriber becomes Confirmed once that link is clicked.
Changed your mind? Undo in under a minute
- Open the page in your website editor.
- Delete the SpamKill code and paste your original Kit form code back.
- Save and publish the page. Your form is back to how it was.
Thanks! Glad your form is protected.
Sorry about that. Tell us which step tripped you up and we'll fix the guide.
Stuck? We'll set it up with you.
Free setup help for every plan. Send us a message and we'll walk through your Kit form with you.
Get setup help