Every form is protected from the moment you publish it. You do not need to set anything up.
Built in, always on
- Honeypot: a hidden field that people never see and bots fill in.
- Time check: submissions sent faster than a person could type are refused.
- Rate limiting: repeated submissions from one address are slowed down.
Add a challenge
For forms that attract a lot of spam, add the reCAPTCHA, hCaptcha or Cloudflare Turnstile field to the form and enter the site and secret keys from the provider.
Turnstile and hCaptcha can run without asking visitors to solve a puzzle. Choose the least intrusive option that stops your spam.