Any form that's publicly reachable will start collecting automated junk sooner or later. Settings → Form Protection covers every form on your site at once — the built-in contact form and anything you've built yourself — and takes effect immediately.
The options
- None — no check. Simplest, and fine until the spam starts.
- Cloudflare Turnstile — a privacy-friendly checkbox widget. Requires your domain to be on Cloudflare (the free plan is enough). Create a Turnstile widget in your Cloudflare dashboard to get a site key and a secret key.
- Google reCAPTCHA v2 — the classic "I'm not a robot" checkbox. Works on any domain, no Cloudflare needed. Create a v2 (checkbox) key pair at
google.com/recaptcha/admin. - Google reCAPTCHA v3 — invisible, with no widget shown to visitors. It scores each submission from 0.0 to 1.0 and rejects anything below the threshold you set. Works on any domain.
Which to pick
If your domain is already on Cloudflare, Turnstile is the least intrusive for visitors. If it isn't, reCAPTCHA v2 is the straightforward choice. Reach for v3 only if you'd rather visitors saw nothing at all, and be prepared to tune the threshold — set it too high and you'll silently reject real enquiries.
After turning it on
Submit your own form once to confirm a genuine submission still gets through. Every provider here needs both a site key and a secret key; with only one filled in, the check can't complete.