Spam protection for forms (ALTCHA)
Forms on your site are protected from bots without puzzles, cookies or third-party scripts. New flows that save or email what visitors send are protected automatically.
Three settings per flow
| Setting | What happens |
|---|---|
altcha (default for form flows) | Our built-in, self-hosted check. The visitor's browser quietly solves a small proof-of-work puzzle (well under a second), a hidden honeypot field must stay empty, and the form can't be sent faster than 3 seconds after the page started it. Each answer works once and expires after 20 minutes. |
captcha | Your own Cloudflare Turnstile or Google reCAPTCHA (v2 or v3) keys. Set the public key with set_captcha_provider and the secret key as a site secret (TURNSTILE_SECRET or RECAPTCHA_SECRET). We never provide captcha keys. |
off | No check (webhooks, logins). |
Change it in the site's Spam protection section, with set_spam_protection, or when creating the flow (spam_protection). GET flows can't be protected (they can't save entries anyway).
What you need to do
Nothing. Pages with a <form action="/api/flows/<name>"> get the small widget script added automatically. Forms you submit with your own fetch() code work too, as long as they send the form's fields (new FormData(form)). Visitors need JavaScript turned on.
Blocked posts
A blocked post gets a short page explaining what to do (or a 403 JSON answer for scripts). Blocked attempts are listed without their contents for 30 days (list_blocked_submissions), with the reason: honeypot filled, too fast, missing or invalid answer, reused answer, captcha failed.
Price
No extra charge. A post, accepted or blocked, is one flow call (3.01 credits per 1,000); the widget and its challenge are ordinary page requests.