# Bot protection (Turnstile)

Defend share links against bot submissions with Cloudflare Turnstile. When it runs, who can turn it off, and the extra setup a custom domain needs.

## How it works

When a respondent submits, Turnstile checks in the background that they are not a bot. In rare cases a small dialog asks them to confirm, with no image puzzles. A submission that fails the check is rejected, and the respondent can try again. Requests skip the check, because a [request](https://formstep.io/docs/requests/overview/) link belongs to one recipient.

## Forms on formstep.io

On `form.formstep.io` links, bot protection needs no setup.

- On Free, it is always on.

- On Pro and Business, turn it on or off per form in **Settings**, **Public link access**, **Spam protection**. If your plan lapses, it turns back on after 30 days. See [Upgrading & downgrading](https://formstep.io/docs/subscription-billing/upgrading-downgrading/#grace-period).

## Only if you use a custom domain

On a [custom domain](https://formstep.io/docs/branding-domains/custom-domains/) (Pro and Business), such as `fill.yourdomain.com`, bot protection needs your own free Turnstile keys, because Formstep’s key only covers formstep.io. If all your forms use formstep.io links, skip this section.

1. **Add your custom domain first**

   The Bot Protection card on the Domains page appears once the workspace has a custom domain.

2. **Create a Cloudflare account**

   Sign up for a free account at [dash.cloudflare.com](https://dash.cloudflare.com) if you don't have one.

3. **Create a Turnstile widget**

   In [Turnstile](https://dash.cloudflare.com/?to=/:account/turnstile), add a widget with your custom domains as allowed hostnames.

4. **Copy your keys**

   Copy the **Site key** and **Secret key**.

5. **Paste the keys in Formstep**

   Open **Domains** in the sidebar, find the **Bot Protection** card, paste both keys, and save. They apply to the whole workspace.

6. **Turn it on per form**

   Turn on **Spam protection** in each form's **Settings**, **Public link access**.

Without keys, bot protection cannot run on the custom domain:

| Owner | Custom domain without keys |
| - | - |
| Pro or Business | Submissions go through without a check. |
| Free, guest, or a plan lapsed past day 30 | Submissions on the branded URL are rejected. The formstep.io link keeps working. |

## Next steps

[Authentication gate](https://formstep.io/docs/sharing-publishing/authentication-gate/) — Ask for sign-in or a password

[Your own domains](https://formstep.io/docs/branding-domains/custom-domains/) — Set up branded form URLs