Acceptable Use and Abuse

This document is published in several languages. In the event of any discrepancy between the language versions, the Polish version is binding.

Version 1.0 · Last updated: 16 October 2026

formexposed looks at third-party websites and, on verified domains, sends test submissions to contact forms. A tool like this can also be turned against others. This page sets out what formexposed is for, what is prohibited, how we limit misuse technically and what happens if someone breaks the rules. It applies to everyone who uses formexposed: to customers with an account as well as to visitors who use the free check without an account.

The provider is LW IT Solutions Company Lukas Wójcik, al. Tadeusza Kościuszki 80/82, lok. 301, 90-437 Łódź, Poland. For Customers, this page is part of the contract: the Terms of Service count it among the contract documents. For the free check and the other freely accessible tools, it applies as part of the rules that the Terms of Service lay down for these tools. If this page conflicts with the Terms of Service, the Terms of Service prevail. Examples (“such as”, “for example”) illustrate a rule; they neither extend nor restrict it.

1. What formexposed is for

formexposed checks whether a contact form is protected against automated spam, whether it works reliably and whether it handles data carefully. In particular, it is permitted:

• to check and monitor your own website or a client’s website and to use the results to secure it;
• to use the free check without an account to get a first, read-only impression of any publicly accessible website – as a visitor sees it;
• as an agency on the Business plan, to have a prospect’s website checked passively and to make the findings available to the operator in a lawful manner (see section 3.5);
• to share reports with the people who are responsible for the website or look after it;
• to use the API, the plugin and the extensions within their documentation and limits;
• to display the badge on the domain for which it was issued.

The yardstick is simple: formexposed is meant to help website operators protect their own forms. Anything that harms a third party who has not agreed to it is not part of that.

2. What formexposed deliberately cannot do

So that the service is of no use as an attack tool, we have limited it. These limits apply to all users and cannot be unlocked by users:

• Without proof of control over a domain, nothing is submitted there; the only exceptions are formexposed’s own test and demo domains, which we check internally. The free check, the prospect check and our study read only what a visitor sees.
• Even on verified domains, we submit only to a recognised general contact form, at most five labelled test submissions per check. We never submit order, booking, login, registration, newsletter, support, payment or upload forms, forms with mandatory details such as telephone number or postal address, or forms on websites that we recognise from the domain or page title as a public authority, court, university, school or healthcare institution.
• The header injection check is pure detection: the test value never contains a real recipient. The e-mail validation check uses only an address ending in .invalid, which cannot exist.
• We do not solve CAPTCHAs. On verified domains, we only check whether a form accepts a submission without a CAPTCHA token or with an invented one. If the login form for the scan behind the login carries a CAPTCHA, the check stops.
• The crawler requests only public addresses over the usual web ports. Internal networks, local addresses and other ports are blocked, including for redirects and embedded content.
• The search for exposed files (such as a forgotten configuration file) runs only for verified domains, because requesting such paths on third-party websites amounts to an attack.

These limits describe how the service is built. The scanner recognises whether a form is a general contact form and whether a website belongs to one of the institutions listed from features of the page such as field names, labels, domain and page title; in individual cases, this recognition may be wrong. The description is therefore not a guarantee to Customers or third parties that a particular form will never be covered. Anyone who does not want their website to be checked can exclude it via the opt-out (section 6.1).

3. What is prohibited

3.1 Probing or attacking third-party websites

• Using formexposed to find vulnerabilities in third-party websites and then attack, overload or exploit them – for example deliberately flooding an unprotected form with spam.
• Passing on results, reports or screenshots of a third-party website to people who want to use them for an attack.
• Using the service against websites whose operator has evidently excluded it, for example by switching to a different spelling of the domain.

Anyone who spies on or attacks third-party systems without authorisation may also commit a criminal offence (in Poland, for example, under Art. 267 to 269b of the Polish Criminal Code (Kodeks karny), in Germany, for example, under §§ 202a to 202d and § 303b StGB, the German Criminal Code). The fact that the information comes from a formexposed report changes nothing.

3.2 Circumventing limits and safeguards

• Circumventing the limits of the free check, for example through many browser sessions, changing IP addresses, proxies, VPN chains or multiple accounts.
• Querying the free check, the header check or the opt-out form in an automated way. The API exists for automation.
• Circumventing reCAPTCHA, the timing check and the other protection measures of our own forms.
• Circumventing plan limits by splitting usage across several free accounts.

3.3 Obtaining verification by deception

• Verifying a domain of which you are neither the operator nor engaged by the operator – even if you technically have access to DNS, server or CMS, for example as a former service provider, hosting provider or employee.
• Providing proof via third-party content, for example via a comment function or an upload area of the third-party website that anyone can write to.
• Leaving a domain in the account after the authorisation has ended. When the engagement ends, the Customer removes the domain.

Verification is the gateway to the active checks. Anyone who obtains it by deception has formexposed submit to a third-party form – that is the most serious misuse the service allows, and we treat it as such.

3.4 Misusing test submissions

• Using test submissions as a spam or notification channel, for example by verifying a domain in order to burden its recipients with test e-mails.
• Triggering checks of a domain, in particular manual checks, with the aim of burdening the recipient of the form e-mails rather than checking the form.
• Setting up test submissions on a domain without ensuring that the people who receive and handle the form e-mails there (for example a sales team) know that labelled test submissions may arrive.

3.5 Using the prospect check for unsolicited advertising

The prospect check allows an agency to have the website of a potential client checked passively. We do not write to the operator; the agency passes on the link itself. How it does so is its own business and its own responsibility. It is prohibited to use the findings for advertising that the law does not permit without prior consent. This includes in particular:

• unsolicited e-mails with the findings to companies or persons who have not consented (in Poland, Art. 398 of the Polish Electronic Communications Law (Prawo komunikacji elektronicznej, PKE); in Germany, § 7 UWG, the German Act against Unfair Competition – in both countries, this also applies to businesses);
• unsolicited advertising calls, insofar as the applicable law requires consent for them;
• messages that use the findings to build pressure, stoke fear or create the impression that formexposed checked the website on behalf of an authority or of the operator.

It remains permitted to show the findings to the operator in a conversation that the operator has requested, and to send them to the operator if the operator has consented to receiving them or the law applicable to the approach expressly permits sending them without consent. The agency itself checks whether this is the case; the fact that it works with the operator on another matter is not in itself sufficient.

3.6 Misusing reports, API, plugin and badge

• Systematically collecting reports, guessing or trying out report addresses, or retrieving reports in large numbers in order to accumulate data about third-party websites.
• Publishing reports on third-party websites in order to expose their operators.
• Passing on API keys, plugin secrets or credentials, circumventing the limits of the API or using it for third-party domains.
• Altering or imitating the badge, displaying it on a domain other than the one for which it was issued, or using it to claim a certification that formexposed does not grant. The badge shows “protected” only while the domain is verified, monitoring is running and the last check is recent and favourable; otherwise it shows the neutral “Contact form check”. A self-made graphic with the same statement deceives visitors.
• Storing credentials for the scan behind the login for an account that was not specifically created as a test account, or for a third-party website.

4. How formexposed prevents and detects misuse

The following measures are implemented in the code. We do not disclose the exact thresholds, because they change and because they would make misuse easier.

4.1 Free check

• Kill switch. We can pause the free check at any time. The opt-out is not affected and also works during a pause.
• reCAPTCHA for the check, the header check and the opt-out, with separate thresholds per form, plus a trap and a timing check in these forms.
• Limits per IP address, per session and per day. Accepted checks are counted. An overall daily limit protects against waves.
• Many domains from one address. Anyone who tries to check many different domains from one IP address within a short time is blocked. Here every attempt counts, including a rejected one: this is the typical pattern with which someone uses formexposed to sound out third-party sites.
• One domain per week. Anyone who enters a domain again within a week sees the existing report; it is not checked again.
• Very young domains and domains whose age cannot be determined are not checked without an account. They are frequently registered for fraud.
• Public targets only. A name that points to an internal or reserved address is rejected – before the job and again on every single request by the crawler.

4.2 Monitoring

We record conspicuous patterns – many domains from one address, many requests within a few minutes, many rejected attempts in one session, clusters of opt-outs from one country, reaching the daily limit – as an anomaly. A new anomaly triggers a notification to us, without domain and without IP address; we see the details only in the administration area. What data we store for this and for how long is set out in the Privacy Policy.

4.3 Verification as the gateway

Active checks, monitoring, the scan behind the login, browser journeys and the search for exposed files run, for customers, only for domains for which proof of control has been provided: by DNS record, meta tag, file on the server or via the plugin. Before every job, the scanner checks again itself whether the domain is classified as verified; if it is not, an active check falls back to the read-only one, and a browser journey is not carried out. Active checks can also be switched off for the entire service.

4.4 Test submissions

Every test submission is labelled: in the sender name “FormExposed Security Scanner”, in the subject “[formexposed.com] Automated security test — no action required” and in the text with a reference to the page about FormExposedBot, to the opt-out and with the scan ID. The language depends on the target page (German, English or Polish). Per check, at most five submissions go to a single form. The scanner stops after this number. It fills in other required fields with “FormExposed security test”; it ticks checkboxes without which the form cannot be submitted, for example for consent. The labelling shows that there is no person and no declaration by a person behind it.

4.5 The crawler

FormExposedBot identifies itself with its own user-agent, reads robots.txt before every check and does not check if a Disallow for it or for all programs covers the home page; it does not currently observe blocked sub-paths individually. Light requests without a browser, such as the form pulse or the header check, do not read robots.txt. It does not check domains on our exclusion list (opt-out) or their www variant, not even on behalf of paying customers with a verified domain; their ongoing monitoring ends with the next check that is due. Details are on the page about FormExposedBot.

5. Consequences of a breach

We respond proportionately: we choose the mildest measure that stops the breach and averts further harm to third parties and to the service, limit it to the affected account, domain or function, and lift it as soon as the reason for it ceases to apply. Possible measures are to:

• abort individual checks and temporarily block IP addresses or sessions;
• remove a domain from an account, revoke its verification or put it on the exclusion list;
• block individual functions, such as active checks, the prospect check, the API or the badge;
• block the account and terminate the contract for good cause, as provided in the Terms of Service;
• claim compensation for damage in accordance with the statutory provisions and, to the extent legally permissible, notify the affected website operators, law enforcement authorities or CERT Polska if there are concrete indications of a criminal offence or an attack on third parties.

Automatic limits of the free check and of our own forms (section 4.1) are not a measure against a specific person. They apply to everyone according to fixed rules and end when the relevant period expires or as soon as we have resolved an anomaly.

Prior hearing. Before we block a Customer’s account, domain or function, remove a domain from their account, revoke its verification or terminate the contract, we inform the Customer in text form which conduct we object to, which rule of this page or of the Terms of Service we rely on and which measure we are considering. The Customer can comment or remedy the breach within seven days; only then do we decide. Before termination for good cause, the longer period for remedy that the Terms of Service provide for this applies instead; a block due to non-payment is governed solely by the Terms of Service.

Urgent cases. We act without a prior hearing only if waiting would seriously endanger third parties or the service, in particular where there are concrete indications of verification obtained by deception, in the case of checks or test submissions against the declared will of the website operator, in the case of an attack on third parties via the service, in the case of a notice indicating a serious infringement of the law by content in a client portal or white-label report, or if an authority, a court or the law requires it. In that case, we initially limit the measure to the affected domain, function or content, inform the Customer of it, with reasons, in text form without undue delay and at the latest on the following working day, insofar as this does not defeat its purpose and is not prohibited by law, and hold the hearing afterwards.

Objections. Anyone who considers a measure unjustified, including without an account, can object to it in text form at contact@lukaswojcik.com. We examine the objection and reply within 14 days, giving reasons; if it is justified, we lift the measure immediately. The procedure under Complaints and recourse to the courts remain open. If we restrict a Customer’s content following a notice of illegal content, we additionally provide a statement of reasons under Art. 17 of Regulation (EU) 2022/2065 (Digital Services Act, DSA) and name these means of redress. Whether a block affects the obligation to pay and when termination for good cause is possible is governed by the Terms of Service.

6. If you are affected

6.1 You do not want formexposed to check your website

Enter your domain on the page Exclude your domain or block FormExposedBot for the home page in your robots.txt. Both take effect, without you having to contact us, for every check that starts afterwards. Ongoing monitoring in a customer account ends with the next check that is due; until then, light requests such as the form pulse may still come, and these light requests do not read the robots.txt. If you want these to end sooner as well, also write to us. What exactly is excluded is described on the opt-out page.

6.2 You have received a test submission that you did not expect

Test submissions go only to domains for which a Customer has provided proof of control, and to formexposed’s own test and demo domains. They take place at the instigation of that Customer. If you did not arrange this, perhaps your agency, your hosting provider or a colleague added the domain – or someone obtained the verification by deception. The quickest way to stop further test submissions is to do it yourself via the opt-out: test submissions only occur during a check, and after the entry no further check of the domain starts. Also write to us at contact@lukaswojcik.com and quote the scan ID from the message. We will check who verified the domain, put the domain on the exclusion list pending clarification if you have not already done so, and ask the Customer to substantiate their authority. We will tell you who verified it only to the extent that data protection law permits.

6.3 You suspect that someone is using formexposed against you

Write to contact@lukaswojcik.com, ideally with the time, the domain and – from your server logs – the requests with the FormExposedBot user-agent. You can also reach us via the contact page. We will confirm receipt and tell you what we have done. You can report illegal content in a client portal or white-label report in the same way; what such a notice under Art. 16 DSA should contain is set out in the Imprint. Our point of contact under Art. 11 and 12 DSA is also listed there.

6.4 You have found a security vulnerability in formexposed itself

Please report it via our vulnerability reporting page (also at /.well-known/security.txt). It explains how we handle reports and what we promise researchers. Please do not test on third-party websites in the process, including via formexposed.

7. Cooperation with authorities

We cooperate with law enforcement authorities, supervisory authorities and bodies such as CERT Polska when it comes to misuse of the service or attacks on third parties. We hand over data only if there is a legal basis, the requesting body is competent and the request is in the prescribed form. We examine each request individually and hand over only what it actually requires. We inform affected Customers unless the law or the authority prohibits it.

We do not store more in order to be able to provide information to authorities than is necessary for operation and abuse prevention. What has been deleted after the periods stated in the Privacy Policy have expired, we cannot hand over either.

8. Changes

We update this page when the service or the patterns of misuse change. For Customers, the rules on changes in the Terms of Service apply; new prohibitions and stricter consequences apply to them only after this procedure. We assess conduct according to the version that applied at the time of the conduct. Questions about this page: contact@lukaswojcik.com.