CAPTCHA Fields
CAPTCHA fields protect your forms from automated spam submissions, bot attacks, and fake entries. Forms Plugin offers a range of CAPTCHA options - from industry-standard services to custom interactive challenges.
CAPTCHA fields are available exclusively on the Commercial (Scale) plan.
Scale Plan Required - CAPTCHA fields require a Commercial (Scale) subscription. Free and Pro plan users will see an upgrade prompt when attempting to add these fields.View Plans & Pricing Available CAPTCHA Fields
| CAPTCHA Type | Description |
|---|
| Google reCAPTCHA | Google’s industry-standard CAPTCHA. Supports both v2 (checkbox) and invisible reCAPTCHA |
| hCAPTCHA | A privacy-focused CAPTCHA alternative that rewards website owners for serving demands |
| Cloudflare Turnstile | A privacy-respecting, user-friendly CAPTCHA that runs in the background with minimal friction |
| Mathematical CAPTCHA | A simple arithmetic challenge (e.g., “What is 4 + 7?”) |
| Number CAPTCHA | Users enter a displayed number sequence |
Which CAPTCHA Should You Use?
| Scenario | Recommended CAPTCHA |
|---|
| Maximum bot protection with broad compatibility | Google reCAPTCHA |
| Privacy-conscious, low-friction protection | Cloudflare Turnstile |
| Privacy-focused alternative with website rewards | hCAPTCHA |
| Simple sites where you want a lightweight challenge | Mathematical CAPTCHA or Number CAPTCHA |
Cloudflare Turnstile is a strong choice for most sites. It validates users silently in the background and only shows a challenge when it detects suspicious behavior - meaning most real users never have to interact with it at all.
Adding a CAPTCHA Field
- Open Forms Plugin and navigate to Fields
- Select the CAPTCHA tab
- Click a CAPTCHA type to add it to your form
- Configure the required settings (API keys, site keys) in the field properties
Setting Up Google reCAPTCHA
You will need a Site Key and Secret Key from the Google reCAPTCHA admin console. Enter these in the field’s configuration panel after adding it to your form.
Setting Up hCAPTCHA
You will need a Site Key from the hCAPTCHA dashboard. Enter it in the field’s configuration after adding it to your form.
Setting Up Cloudflare Turnstile
You will need a Site Key from the Cloudflare Turnstile dashboard. Enter it in the field’s configuration after adding it to your form.
Built-in Honeypot Protection
Google reCAPTCHA and Cloudflare Turnstile now include an additional honeypot layer on top of the standard CAPTCHA check. A honeypot is a hidden field that is invisible to real visitors but is automatically filled in by many spam bots. If that field comes back filled, the submission is silently rejected before it ever reaches your inbox or CRM.
This adds a second line of defense that runs alongside the CAPTCHA:
- Invisible to users - real visitors never see or interact with the honeypot field, so there is no added friction.
- Catches simple bots - automated scripts that blindly fill every field are blocked even if they bypass the CAPTCHA.
- Always on - the honeypot is enabled automatically when you add a Google reCAPTCHA or Cloudflare Turnstile field. No extra setup or keys are required.
The honeypot works together with the CAPTCHA, not instead of it. You still need a valid Site Key (and Secret Key for reCAPTCHA) for the CAPTCHA challenge itself.
Why CAPTCHA Matters
Without spam protection, contact forms and lead capture forms are frequent targets for automated bots that:
- Flood your inbox with junk submissions
- Add fake contacts to your CRM or email lists
- Submit malicious data to your backend systems
Adding a CAPTCHA field to any public-facing form is a simple and effective way to keep your submissions clean and trustworthy.
Upgrading to Access CAPTCHA Fields
CAPTCHA fields are available on the Commercial (Scale) plan only. See Plans & Pricing to upgrade.
