1 min readUpdated
Public forms attract automated submissions. Formkit applies two defences, both in form settings.
Spam check
Cloudflare Turnstile checks each submission, usually without being seen. If it cannot load for someone, they tick a box instead. Obvious bots are refused. It is on by default for published forms.
Rate limiting
Caps how many submissions can arrive from the same source in a short window. A form linked from a newsletter will never touch the cap; a form being hammered will.
If something slips through
Delete it from the responses table and note the pattern, such as a repeated address or a nonsense answer in the same field, so you can filter for it next time.
Was this helpful?
Try it on a form of your ownFree to start, with unlimited forms and responses. No card needed.
Start building free