Skip to main content

CAPTCHA Fields

CAPTCHA fields protect your forms from automated spam submissions, bot attacks, and fake entries. Forms Plugin offers a range of CAPTCHA options - from industry-standard services to custom interactive challenges. CAPTCHA fields are available exclusively on the Commercial (Scale) plan.
Scale Plan Required - CAPTCHA fields require a Commercial (Scale) subscription. Free and Pro plan users will see an upgrade prompt when attempting to add these fields.View Plans & Pricing

Available CAPTCHA Fields

Which CAPTCHA Should You Use?

Cloudflare Turnstile is a strong choice for most sites. It validates users silently in the background and only shows a challenge when it detects suspicious behavior - meaning most real users never have to interact with it at all.

Adding a CAPTCHA Field

  1. Open Forms Plugin and navigate to Fields
  2. Select the CAPTCHA tab
  3. Click a CAPTCHA type to add it to your form
  4. Configure the required settings (API keys, site keys) in the field properties

Setting Up Google reCAPTCHA

You will need a Site Key and Secret Key from the Google reCAPTCHA admin console. Enter these in the field’s configuration panel after adding it to your form.

Setting Up hCAPTCHA

You will need a Site Key from the hCAPTCHA dashboard. Enter it in the field’s configuration after adding it to your form.

Setting Up Cloudflare Turnstile

You will need a Site Key from the Cloudflare Turnstile dashboard. Enter it in the field’s configuration after adding it to your form.

Built-in Honeypot Protection

Google reCAPTCHA and Cloudflare Turnstile now include an additional honeypot layer on top of the standard CAPTCHA check. A honeypot is a hidden field that is invisible to real visitors but is automatically filled in by many spam bots. If that field comes back filled, the submission is silently rejected before it ever reaches your inbox or CRM. This adds a second line of defense that runs alongside the CAPTCHA:
  • Invisible to users - real visitors never see or interact with the honeypot field, so there is no added friction.
  • Catches simple bots - automated scripts that blindly fill every field are blocked even if they bypass the CAPTCHA.
  • Always on - the honeypot is enabled automatically when you add a Google reCAPTCHA or Cloudflare Turnstile field. No extra setup or keys are required.
The honeypot works together with the CAPTCHA, not instead of it. You still need a valid Site Key (and Secret Key for reCAPTCHA) for the CAPTCHA challenge itself.

Why CAPTCHA Matters

Without spam protection, contact forms and lead capture forms are frequent targets for automated bots that:
  • Flood your inbox with junk submissions
  • Add fake contacts to your CRM or email lists
  • Submit malicious data to your backend systems
Adding a CAPTCHA field to any public-facing form is a simple and effective way to keep your submissions clean and trustworthy.

Upgrading to Access CAPTCHA Fields

CAPTCHA fields are available on the Commercial (Scale) plan only. See Plans & Pricing to upgrade.