# How to stop spam and bot submissions on a Makeform form

Use **Anti-Bot Protection (Level 1)** and **CAPTCHA** in your form's **Settings** to block bot submissions and require a check before submitting or paying. Both tools are free on every plan.

**Is it free?** Yes. Anti-bot protection and CAPTCHA are available on every plan, with no CAPTCHA keys to set up.

## Steps

1. Open your form and click the **Settings** icon in the top bar.
2. Turn on **Anti-Bot Protection (Level 1)**. It enables a honeypot field to detect and block spam submissions from bots.
3. If spam continues, turn on **CAPTCHA** and keep **Cloudflare Turnstile** as the provider.
4. Click **Save Changes**.
5. Submit a test response to check the setup.

## What respondents see

The honeypot field is invisible to people. CAPTCHA requires respondents to complete a check before submitting or paying.

**Cloudflare Turnstile** is the available CAPTCHA provider. **hCaptcha** and **Google reCAPTCHA** show as **Unavailable**, so you cannot select them as an alternative provider.

## CAPTCHA and custom domains

:::callout{type="info"}
Hosted CAPTCHA works only on Makeform links, not on custom domains. Remove CAPTCHA before assigning a custom domain or path.
:::

Check this restriction before setting up a custom address for a form that uses hosted CAPTCHA. There are no CAPTCHA keys to configure for the hosted option.

## Other access controls

Under **Settings** > **Access**, you can also use these controls:

- **Prevent duplicate submissions** accepts one completed response for each value in a selected field.
- **Password protection** requires a password to open and submit the form.
- **Limit number of submissions** caps total submissions.
- **Allowed embed domains** controls which sites can embed the form. Enter one origin per line; leaving it empty allows any site to embed.

Makeform is a free AI form builder: describe what you want to collect and it builds the form for you, with unlimited forms and submissions on the free plan.

## FAQ

### Do respondents see the honeypot field?

No. The field used by **Anti-Bot Protection (Level 1)** is invisible to people. It detects and blocks spam submissions from bots.

### Do I need my own CAPTCHA keys?

No. There are no keys to set up for the hosted CAPTCHA. Turn on **CAPTCHA** and keep **Cloudflare Turnstile**.

### Can I use hosted CAPTCHA on a custom domain?

No. Hosted CAPTCHA works only on Makeform links. Remove it before assigning a custom domain or path.

### Does leaving allowed embed domains empty block embeds?

No. An empty **Allowed embed domains** setting means any site can embed the form. To specify allowed sites, enter one origin per line.

## Related

- [Prevent duplicate submissions](/help/guides/prevent-duplicate-submissions)
- [Password protect a form](/help/guides/password-protect-a-form)
- [Form settings](/help/guides/form-settings)
- [Embed your form](/help/guides/embed-your-form)