CAPTCHA and spam protection
Layer low-friction controls before adding an interactive challenge.
Combine complementary controls
Use schema and size limits, rate limits, a honeypot, origin policy, bounded content signals, and quarantine. Add CAPTCHA when measured abuse justifies the visitor friction.
Configure protection
- Start with the server schema and rate limits.
- Enable botcheck and inspect false positives.
- Choose hCaptcha, reCAPTCHA, or Turnstile only when needed.
- Test token expiry, accessibility, failure recovery, and provider outage behavior.
Keep site keys and secrets distinct
A CAPTCHA site key is public and belongs in the page. Its verification secret stays on the server and must never be embedded in generated form code.
Documentation reviewed on October 20, 2026Suggest an improvement →