Purlock
Script for your site Form link checker

One line, and bad links stop at your forms.

Any form with a link in it gets checked before it's sent. A bad link gets a message, the form stays put, and what they typed isn't lost.

Get your line of code Read the docs

One API call per link checked. Your line of code is free to get. Free accounts get 100 calls a month, and after that links go through unchecked unless you choose to block.

What you get

What it does for you

  • Your real API key stays private

    It uses a public site key that only works on the domains you list, and you can replace it any time.

  • Only sends the links

    Never the rest of what someone wrote. It skips forms with a password, and fields for email or card details.

  • Refuses what matters

    Known harmful links, links pretending to be a brand, and adult sites. A new domain alone isn't refused.

  • Your forms keep working

    If Purlock is slow or down, forms still send, unless you choose to block instead.

  • Fits your site

    Limit it to certain forms, use your own wording, or show your own message.

  • For buttons too

    A QR code button that doesn't use a form takes one line: PurlockShield.check(url).

How it works

All you add to your site

Paste this into your site

<script src="https://purlock.com/shield/v1.js" data-key="ps_live_..." async></script>

Good to know

What it can't do

  • It protects people using your forms, but a bot can post straight to your server without running it. To stop bots too, use the post and comment link checker.
  • An editor that doesn't use a normal form needs the PurlockShield.check line.
  • Tell your visitors in your privacy policy that links they submit are checked by a third party.

FAQ

Questions, answered

Do I need a developer?
No. Get your line from your Shield page, list your domains, and paste it into your site before the closing body tag.
Is it safe to have a key in my page?
Yes. The site key can only check links, from the domains you listed. It can't use the API or see your account. If someone copies it, they can only use up some of your calls, capped per day, and you can replace it.
Can I refuse suspicious links too?
Yes. Add data-suspicious="block", and links that only look unusual get stopped as well.

Related