How to stop spam and bot submissions on a Makeform form
Use Anti-Bot Protection (Level 1) and CAPTCHA in your form's Settings to block bot submissions and require a check before submitting or paying. Both tools are free on every plan.
Is it free? Yes. Anti-bot protection and CAPTCHA are available on every plan, with no CAPTCHA keys to set up.
Steps
- Open your form and click the Settings icon in the top bar.
- Turn on Anti-Bot Protection (Level 1). It enables a honeypot field to detect and block spam submissions from bots.
- If spam continues, turn on CAPTCHA and keep Cloudflare Turnstile as the provider.
- Click Save Changes.
- Submit a test response to check the setup.
What respondents see
The honeypot field is invisible to people. CAPTCHA requires respondents to complete a check before submitting or paying.
Cloudflare Turnstile is the available CAPTCHA provider. hCaptcha and Google reCAPTCHA show as Unavailable, so you cannot select them as an alternative provider.
CAPTCHA and custom domains
Check this restriction before setting up a custom address for a form that uses hosted CAPTCHA. There are no CAPTCHA keys to configure for the hosted option.
Other access controls
Under Settings > Access, you can also use these controls:
- Prevent duplicate submissions accepts one completed response for each value in a selected field.
- Password protection requires a password to open and submit the form.
- Limit number of submissions caps total submissions.
- Allowed embed domains controls which sites can embed the form. Enter one origin per line; leaving it empty allows any site to embed.
Makeform is a free AI form builder: describe what you want to collect and it builds the form for you, with unlimited forms and submissions on the free plan.
FAQ
Do respondents see the honeypot field?
No. The field used by Anti-Bot Protection (Level 1) is invisible to people. It detects and blocks spam submissions from bots.
Do I need my own CAPTCHA keys?
No. There are no keys to set up for the hosted CAPTCHA. Turn on CAPTCHA and keep Cloudflare Turnstile.
Can I use hosted CAPTCHA on a custom domain?
No. Hosted CAPTCHA works only on Makeform links. Remove it before assigning a custom domain or path.
Does leaving allowed embed domains empty block embeds?
No. An empty Allowed embed domains setting means any site can embed the form. To specify allowed sites, enter one origin per line.