GUIDE

How to protect a form with CAPTCHA

Public forms are magnets for bots. Left unguarded, a single contact form can flood your inbox with junk submissions and burn through your monthly quota. A CAPTCHA challenge is one of the most effective ways to separate real people from automated scripts, and adding one is simpler than it looks.

What a CAPTCHA actually does

A CAPTCHA is a challenge that is easy for humans and hard for bots. Modern versions rarely show puzzles: they score behavior in the background and only interrupt suspicious visitors. The goal is not perfect blocking but raising the cost of automated abuse enough that spammers move on.

Pick a provider: reCAPTCHA, hCaptcha, or Turnstile

The three common choices are Google reCAPTCHA (v2 checkbox or v3 invisible scoring), hCaptcha, and Cloudflare Turnstile. Turnstile and hCaptcha are privacy-friendly and mostly invisible, while reCAPTCHA v3 returns a score you act on. Each gives you a public site key for the widget and a secret key for verification.

Render the widget, then verify the token server-side

Adding the widget is only half the job. The browser widget produces a token, but a bot can skip the widget entirely and POST straight to your endpoint. That is why the token must be verified on your server against the provider's API using your secret key. Skipping server-side verification makes the CAPTCHA purely decorative.

CAPTCHA is one layer, not the whole defense

Treat CAPTCHA as part of a stack, not a silver bullet. Pair it with a hidden honeypot field and server-side content filtering so bots that slip past one control still get caught by another. Keep friction low: an invisible challenge protects conversions better than a puzzle every visitor must solve.

How Formstork handles CAPTCHA for you

Formstork lets you turn on Turnstile, hCaptcha, or reCAPTCHA per form and verifies the token server-side automatically, so you never build or host a verification backend. It layers that with a built-in honeypot, a server-side spam filter, and a rules engine that can block or flag by field, with allowed-domains on Pro. Drop the widget into your form, enable the check in the dashboard, and failed challenges are rejected before they reach your inbox.

html

<form action="https://api.formstork.com/submit" method="POST">
  <input type="hidden" name="access_key" value="YOUR_ACCESS_KEY">
  <input type="email" name="email" placeholder="Your email" required>
  <textarea name="message" placeholder="Your message" required></textarea>

  <!-- Cloudflare Turnstile widget: injects a cf-turnstile-response token -->
  <div class="cf-turnstile" data-sitekey="YOUR_TURNSTILE_SITEKEY"></div>

  <button type="submit">Send</button>
</form>
<script src="https://challenges.cloudflare.com/turnstile/v0/api.js" async defer></script>

Frequently asked questions

Do I still need CAPTCHA if I already have a honeypot?

They catch different bots, so use both. A honeypot silently traps naive scripts that fill every field, while a CAPTCHA challenges more advanced bots that ignore hidden fields. Formstork ships a honeypot by default and lets you add a CAPTCHA on top.

Which CAPTCHA is best for user experience?

Cloudflare Turnstile and hCaptcha are usually the least intrusive because they run invisibly for most visitors and only challenge suspicious ones. reCAPTCHA v3 is also invisible but asks you to act on a score. Formstork supports all three, so you can switch without changing your backend.

Can a bot bypass CAPTCHA by posting directly to the form endpoint?

Only if the token is never verified on the server. Formstork verifies the CAPTCHA token server-side on every submission, so a POST without a valid token is rejected before it reaches your dashboard or inbox.

Try Formstork free

250 submissions a month with a full dashboard. No credit card required.

Get your access key Read the docs