Browse help docs
Blocks & rate limits
SecureSMTP blocks abuse before it reaches your inbox or your visitors. Three kinds of blocks exist, all reversible — here’s how each one works and how to fix yourself if you get caught by mistake.
3 ways a block can trigger
Every block has a reason attached so you (or support) can tell what happened.
- 1
Per-IP rate limit
Each IP can submit a given form once per minute. Submit faster and the IP gets a 5-minute cool-down on that form. Repeat the burst and the cool-down lengthens (up to 24 hours). Block reason in the dashboard:
rate_limit_ip.Why it exists: stops form-flooding scripts and bots that bypass Turnstile.
- 2
Site auto-disable (abuse cap)
If a site sends a sustained burst of clearly-spam submissions (e.g. 50+ in 10 minutes flagged Spam by the classifier), SecureSMTP auto-disables that site’s submission endpoint for a short cool-down. Block reason:
site_abuse_auto.Why it exists: protects every other SecureSMTP customer from a compromised site flooding shared infrastructure — and protects you from accidentally sending a known-bad URL to all your recipients.
- 3
Manual admin block
A SecureSMTP admin (e.g. responding to an abuse report or a violation of the acceptable-use policy) can place a manual block on an account, site, or IP. These are rare and always come with an email explaining why. Block reason:
manual.Why it exists: for cases where the automated rules don’t catch a clear AUP violation (phishing campaigns, harassment, etc.).
View your active blocks
Blocks are visible in two places — same data, two surfaces.
In WordPress
QCS Forms → Blocks
Shows blocks affecting this site only. Each row lists the IP (or “all visitors”), the affected form, the trigger reason, when the block expires, and an Unblock me button.
In the platform
Shows every block across every site on the account. Filter by site, by reason, by status (active vs expired). Useful when several blocks are interacting at once.
One-click unblock
For any block with reason rate_limit_ip or site_abuse_auto, an Unblock me button clears the block immediately. The button is available to the site owner — visitors can’t self-unblock from the frontend.
- Open QCS Forms → Blocks (or the platform page).
- Find the row. The IP and form will be listed.
- Click Unblock me.
- Done. Refresh the page that was being blocked.
Manual blocks can’t be one-click unblocked — those require a reply to the email that explains the block, or a message to support.
When to contact support
Most blocks resolve themselves in seconds (rate-limit) or hours (auto-disable). Contact support if:
- A site keeps getting auto-disabled even after a clean run — suggests a misconfigured form or a compromised page; we can look at the classifier logs to confirm.
- You got a manual block email and want to dispute it or understand the AUP violation.
- A wide swath of legitimate visitors is being rate-limited — your site may sit behind a NAT that funnels many users through one egress IP, which we can allow-list.
- You think a block is wrong — the “Unblock me” button is the fast fix, but if the block reappears immediately, that points to a config issue worth investigating.
Email [email protected] with your account email, the affected site URL, and (if possible) the block ID from the Blocks page. We usually reply within a few hours during business days.