Bot protection (Turnstile)

How it works

When a respondent submits, Turnstile checks in the background that they are not a bot. In rare cases a small dialog asks them to confirm, with no image puzzles. A submission that fails the check is rejected, and the respondent can try again. Requests skip the check, because a request link belongs to one recipient.

Forms on formstep.io

On form.formstep.io links, bot protection needs no setup.

• On Free, it is always on.

• On Pro and Business, turn it on or off per form in Settings, Public link access, Spam protection. If your plan lapses, it turns back on after 30 days. See Upgrading & downgrading.

Only if you use a custom domain

On a custom domain (Pro and Business), such as fill.yourdomain.com, bot protection needs your own free Turnstile keys, because Formstep’s key only covers formstep.io. If all your forms use formstep.io links, skip this section.

1. 1

   Add your custom domain first

   The Bot Protection card on the Domains page appears once the workspace has a custom domain.

2. 2

   Create a Cloudflare account

   Sign up for a free account at dash.cloudflare.com if you don't have one.

3. 3

   Create a Turnstile widget

   In Turnstile, add a widget with your custom domains as allowed hostnames.

4. 4

   Copy your keys

   Copy the Site key and Secret key.

5. 5

   Paste the keys in Formstep

   Open Domains in the sidebar, find the Bot Protection card, paste both keys, and save. They apply to the whole workspace.

6. 6

   Turn it on per form

   Turn on Spam protection in each form's Settings, Public link access.

Without keys, bot protection cannot run on the custom domain:

Next steps