Skip to content

Stopping form spam

Turnstile and reCAPTCHA, which to choose, and protecting every form at once.

On this page

Any form that's publicly reachable will start collecting automated junk sooner or later. You set up protection once under Settings → Form protection, and it covers the built-in contact form and every form you build.

The providers

  • Cloudflare Turnstile: a privacy-friendly widget that usually lets visitors through without a puzzle. It's free, and your domain doesn't have to be on Cloudflare. Create a Turnstile widget in your Cloudflare dashboard to get a site key and a secret key.
  • Google reCAPTCHA v2: the classic "I'm not a robot" checkbox. Create a v2 (checkbox) key pair at google.com/recaptcha/admin.
  • Google reCAPTCHA v3: invisible, with no widget shown to visitors. It scores each submission from 0.0 to 1.0 and rejects anything below the threshold you set. Keys are made for one version, so create a v3 pair if you choose it.

You can add keys for Turnstile, reCAPTCHA, or both. A provider is only used once both of its keys are filled in.

Your default, and changing it per form

Pick a default on the same settings page. Every form is set to Site default unless you change it, so switching the default changes them all at once. To protect one form differently, open it under Forms, go to the Integrations tab, and choose a specific provider or Off under Spam protection.

When you first set up protection, or change the default, SignalPage checks for forms with protection switched off and offers to turn it on for all of them. If you choose Not now, the Forms list keeps a reminder and the same button until you do.

Which to pick

Turnstile is the least intrusive for visitors and the easiest to get right. reCAPTCHA v2 is a fine alternative if you already use Google's tools. Reach for v3 only if you'd rather visitors saw nothing at all, and be prepared to tune the threshold, because setting it too high will silently reject real enquiries.

After turning it on

Submit your own form once to confirm a genuine submission still gets through. If a provider is missing a key, forms skip that check rather than blocking visitors, so a half-finished setup won't lose you enquiries, but it won't stop spam either.