Spam Protection

Keep your forms spam-free with built-in honeypot, rate limiting, and Cloudflare Turnstile integration.

Honeypot

The honeypot is a hidden field invisible to real users but detected by bots. It's enabled by default on all forms.

How it works: A hidden field is added to the form. If a bot fills it in, the submission is silently rejected.
No user interaction required: Completely invisible and frictionless.
Always active: The honeypot is automatically included in all forms with no configuration needed.

Tip: The honeypot catches most basic bots without any setup or third-party service.

Submission Speed Check

Giraforms records a timestamp when the form loads. If the form is submitted in less than 3 seconds, it's automatically rejected as spam — real users need more time to fill out a form.

This check is always active and requires no configuration.

Rate Limiting

Prevent abuse by limiting how often a single IP address can submit a form. This protects against both bots and intentional flooding.

Parameter	Description	Default
Max Submissions	Maximum submissions allowed per time window	5
Time Window	Period before the counter resets	1 hour (3600 seconds)

Rate limiting is based on the user's IP address and is enabled by default. Developers can adjust the limits using PHP filters:

// Allow 10 submissions per 2 hours
add_filter( 'giraforms_rate_limit', function() { return 10; } );
add_filter( 'giraforms_rate_timeframe', function() { return 7200; } );

Note: Users behind shared IPs (offices, schools) may trigger the limit faster. Increase the limit via the filter if your audience typically shares IPs.

Cloudflare Turnstile

Turnstile is Cloudflare's privacy-friendly CAPTCHA alternative. It verifies visitors without showing puzzles in most cases. Available in both the free and Pro versions of Giraforms.

Setup

Get Your Turnstile Keys

Enter Keys in Giraforms

Go to Forms → Integrations. Find the Cloudflare Turnstile card and enter your Site Key and Secret Key.

Add the Captcha Block to Your Form

In the page editor, add the Giraforms Captcha block inside your Form Container. The block uses your configured Turnstile keys automatically.

Test

Submit the form on the front-end to verify Turnstile is working. Check that submissions are accepted for real users and blocked for bots.

Cloudflare Turnstile site key and secret key settings under Forms → Integrations

Combining Protections

For maximum protection, all methods work together:

Honeypot — catches simple bots (always on)
Speed check — blocks instant submissions under 3 seconds (always on)
Rate Limiting — prevents flooding attacks (always on)
Turnstile — blocks sophisticated bots with minimal user friction

These protections work independently and complement each other. A submission must pass all enabled checks to be accepted.

Stop spam with Turnstile

Cloudflare Turnstile is now free for all Giraforms users. Configure it in Forms → Integrations and add the Captcha block to your forms.

Get Giraforms