Where it is: Settings → Pricing & Limits. Spam protection has no switch — it is always on.
Rate limits
Per-session, per-IP and global daily limits, plus a hard daily spend cap. The limits are exact under bursts, and they are the thing standing between an abusive script and your provider bill. Behind a reverse proxy the real visitor IP is resolved from trusted headers only.
Spam protection
Visitor forms carry a hidden honeypot field and a signed minimum-think-time token, so automated submissions are dropped without a CAPTCHA. Real visitors never see any of it.