Arcjet guards your app. Doorman reads the message.

Messages that pass a bot check: real submissions and how Doorman judged them

  1. Specimen · Contact formNº 125240 9592

    From growth@rankwise.io

    “Your restaurant isn't showing on page one of Google. We can fix your local SEO in 30 days, guaranteed. Can I send a proposal?”

    Sales pitch

    1% chance it’s real · 82 ms

    Void

  2. Specimen · Contact formNº 126918 7211

    From zara@quill.example

    “I run Quill Legal. We use Xero today. Half our clients are in the UK. Can we get a demo this week?”

    91% chance it’s real · 87 ms

    Genuine

  3. Specimen · Contact formNº 128596 4830

    From hello@pixelcraft.agency

    “We build stunning websites for architects. Your current site feels dated. 15 minute call to show you some concepts?”

    Sales pitch

    2% chance it’s real · 84 ms

    Void

  4. Specimen · Contact formNº 130274 2449

    From kofi@proton.me

    “I run Brightline Dental. Clients keep asking to pay by card and we can't take it. Does it import from what we use now?”

    81% chance it’s real · 78 ms

    Genuine

  5. Specimen · Contact formNº 131952 0068

    From hello@scaleleads.co

    “Are you accepting guest posts? I have a well researched article on small business cash flow that fits your audience.”

    pitch

    2% chance it’s real · 83 ms

    Void

  6. Specimen · Contact formNº 133629 7687

    From claire.m@gmail.com

    “Hi, my son chipped a front tooth at football. Do you have anything this week for children? He's 11.”

    95% chance it’s real · 90 ms

    Genuine
Start free
Paste a pitch you got

Sound familiar?

Arcjet gives developers security as code: rate limits, bot rules, email validation, a WAF and guardrails for AI agents. Its signup protection checks who and how fast, not what they wrote. A real person with a valid email pitching you passes. Doorman reads that part.

14 days of Pro free, no card. Then free for 100 submissions a month, or Pro from $29.

  1. Valid emails still pitchA real address with valid MX records can still be an agency pitch or a throwaway intent.
  2. Code in every appProtection lives in your application through an SDK.
  3. Signals, not meaningBot, email and velocity signals don't say what a message is asking for.

Doorman and Arcjet, side by side.

QuestionDoormanArcjet
What it checksWhat the submission says, against what you sellBots, email validity and rate limits; also WAF and AI-agent rules
A human pitch from a valid emailKept outPasses signup protection
Why something was blockedThe exact sentence, in plain languageAllow or deny with the rule and values that decided it
SetupA form URL, one API call, or your coding agentAn SDK in your app code
PriceFree for 100 submissions a month; Pro $29 for 5,000Free up to 10,000 requests a month; Individual $25 a month plus usage

Their plans and behaviour as published on their own sites, checked 29 September 2026. Sources: arcjet.com/pricing, docs.arcjet.com/signup-protection.

Which one is right for you?

Choose Doorman if

  • The junk is in what people write: pitches, fake sign-ups with real addresses, abuse
  • You want protection without an SDK in your code
  • Your forms are on Webflow, Framer or a static site

Choose Arcjet if

  • You want rate limiting, bot rules, a WAF and email validation as code across your whole app
  • You're securing AI agents and LLM calls
  • You want security rules in your codebase

They fit together: Arcjet for rate limits and bots across the app, Doorman on the forms to read what gets through.

Switch in two minutes

  1. Hosted form change the form's action to your Doorman URL and remove the Arcjet script and widget.
  2. From your server replace the Arcjet verify call with one doorman.check call; act on deliver, hold or drop.
  3. Or ask your agent copy one prompt into Claude Code, Codex or Cursor and it does the swap.
  4. Start safely watch mode delivers what it would have dropped, tagged, until you switch it to enforce.

Read the docs

Before → afterhtml
<!-- before: a Arcjet script and widget -->
<form action="/contact" method="POST"> … <div class="arcjet-widget"></div>

<!-- after: no script, no widget -->
<form action="https://withdoorman.com/f/f_yourForm" method="POST"> …

Checked, not guessed.

Every decision comes from Doorman's models reading the submission, in milliseconds, with the reason attached.

13/13
agency and SEO pitches dropped in our labelled set; a bot check passes all of them
0
genuine enquiries dropped; the unsure ones were held for you
~100 ms
to judge a submission, invisible to the visitor

Labelled test set: 104 invented but labelled contact-form and checkout submissions, judged live; latency is the median of those checks. Questions were not tuned to the set.

Questions

Does Doorman do rate limiting?

Hosted endpoints are rate limited per IP and per form, but Doorman isn't a general rate limiter or WAF for your app.

Can I call it from my code like Arcjet?

Yes: one doorman.check call from a route handler or server action, with a typed Node SDK.

Does it validate email addresses?

Disposable and throwaway addresses count against a sign-up, and Doorman judges the whole submission, not the address alone.

How much does it cost?

Free for 100 submissions a month. Pro is $29 a month for 5,000 and Business is $79 a month for 50,000, and every account starts with 14 days of Pro. Until November 30, the first 100 paying customers get Pro at $19 and Business at $59, kept for as long as they stay. See pricing.

Try it on your own forms.

Start with 14 days of Pro, free. Turn on watch mode to see every call before you trust it.

Start free Try the live demo