Captcha Setup
Protect your forms from spam and bots with human verification.
All captcha providers
| Provider | Type | Plan | Get keys |
|---|---|---|---|
| Honeypot + JS | Invisible (automatic) | All plans | No keys needed |
| Math Challenge | Visible (e.g. "What is 3+7?") | All plans | No keys needed |
| hCaptcha | Checkbox + puzzles | All plans | dashboard.hcaptcha.com |
| reCAPTCHA v2 | Checkbox + image puzzles | Pro | google.com/recaptcha/admin |
| reCAPTCHA v3 | Invisible (score-based) | Pro | google.com/recaptcha/admin |
| Cloudflare Turnstile | Invisible (no puzzles) | Pro | dash.cloudflare.com/turnstile |
| GeeTest v4 | Behavioral (slide/click) | Pro | geetest.com |
Which one should I choose?
- Start with defaults — every FormBlade form has honeypot + JS verification enabled automatically. This blocks 80-90% of bots with zero setup and zero user friction.
- Free and simple — add the Math Challenge. No external account needed, works everywhere including China.
- Free with strong protection — add hCaptcha. Privacy-friendly (no Google tracking), free up to 1M verifications/month. Available on all plans.
- Best UX (Pro) — Cloudflare Turnstile. Completely invisible, no puzzles, free unlimited. Users never see a challenge.
- Invisible scoring (Pro) — reCAPTCHA v3. Runs in the background, assigns a 0.0-1.0 score. Set a threshold (0.5 recommended).
- Asia / China (Pro) — GeeTest v4. Behavioral challenges that work without Google services.
How captcha works in FormBlade
- Pick a provider in the Form Designer → Captcha section.
- Add your keys — paste the Site Key and Secret Key from your captcha provider's dashboard. Math Challenge and honeypot need no keys.
- Save — on hosted forms (
/f/your-form), the widget appears automatically. On self-hosted forms, add the provider's script tag to your HTML (see the Integration tab for code). - Verification — when a form is submitted, FormBlade verifies the captcha token server-side. Failed verifications are accepted but flagged as spam (soft-fail). You never lose a submission.
Soft-fail: never lose a submission
Unlike most form services, FormBlade does not reject submissions that fail captcha. Instead, they are accepted and marked as spam in your dashboard. This means:
- Misconfigured keys or network errors do not block real users
- You can review flagged submissions and unflag false positives
- The Spam tab shows exactly which check triggered (honeypot, JS, or captcha)
- No notification emails are sent for spam-flagged submissions
Hosted forms vs self-hosted
- Hosted forms (
/f/your-form) — the captcha widget is injected automatically. No HTML changes needed. - Self-hosted forms — add the provider's script tag and widget to your HTML. The Integration tab in your form shows the exact code to copy.
Tip: Captcha stacks with honeypot and JS verification. All three run independently on every submission, giving you layered protection.
Plan availability
| Feature | Personal (free) | Pro |
|---|---|---|
| Honeypot + JS verification | Yes (automatic) | Yes |
| Math Challenge | Yes | Yes |
| hCaptcha | Yes | Yes |
| reCAPTCHA v2 / v3 | No | Yes |
| Cloudflare Turnstile | No | Yes |
| GeeTest v4 | No | Yes |