# Bot protection (Turnstile)

Defend forms against bot submissions with Cloudflare Turnstile.

## How it works

When a respondent submits, Turnstile checks in the background that they are not a bot. In rare cases, a small dialog asks them to confirm. There are no image puzzles. A submission that fails the check is rejected, and the respondent can try again.

> **Requests are not gated**
>
> Bot protection applies to [share links](https://docs.formstep.io/sharing-publishing/sharing-embedding/) only. A [request](https://docs.formstep.io/requests/overview/) link belongs to one recipient, so it skips the check.

## Formstep-hosted forms

On `form.formstep.io` links, bot protection needs no setup.

- **Free**: always on.

- **Pro and Business**: turn it on or off per form in **Settings**, **Public link access**, **Spam protection**. If your plan lapses, it turns back on after 30 days. See [Upgrading & downgrading](https://docs.formstep.io/subscription-billing/upgrading-downgrading/#grace-period).

## Custom domain forms (BYOK)

On a [custom domain](https://docs.formstep.io/branding-domains/custom-domains/) (Pro and Business), such as `fill.yourdomain.com`, bot protection needs your own free Turnstile keys, because Formstep’s key only covers formstep.io.

1. **Add your custom domain first**

   The Bot Protection card on the Domains page appears once the workspace has a custom domain.

2. **Create a Cloudflare account**

   Sign up for a free account at [dash.cloudflare.com](https://dash.cloudflare.com) if you don't have one.

3. **Create a Turnstile widget**

   In [Turnstile](https://dash.cloudflare.com/?to=/:account/turnstile), add a widget with your custom domains as allowed hostnames.

4. **Copy your keys**

   Copy the **Site key** and **Secret key**.

5. **Paste the keys in Formstep**

   Open **Domains** in the sidebar, find the **Bot Protection** card, paste both keys, and save. They apply to the whole workspace.

6. **Turn it on per form**

   Turn on **Spam protection** in each form's **Settings**, **Public link access**.

Without keys, bot protection cannot run on the custom domain:

| Owner | Custom domain without keys |
| - | - |
| Pro or Business | Submissions go through without a check. |
| Free, guest, or a plan lapsed past day 30 | Submissions on the branded URL are rejected. The formstep.io link keeps working. |

> **No custom domains? Skip this.**
>
> If all your forms use the default Formstep share links, you do not need Turnstile keys. Bot protection works automatically.

## Layered defense strategies

Turnstile is one layer. For more protection, combine it with other settings:

| Threat level | Recommendation |
| - | - |
| Low | Turnstile alone |
| Medium | Turnstile with a password or a scheduled close |
| High | Require sign-in, so nobody answers anonymously |
| Giveaways | Turnstile with a scheduled close and a response limit |

> **No protection is perfect**
>
> Some bots get past any check. For important forms, also use sign-in or [email verification](https://docs.formstep.io/building-forms/email-verification/), and review submissions before you act on them.

## Next steps

[Submission inbox](https://docs.formstep.io/submissions-analytics/submission-inbox/) — Review responses after bot protection is in place

[Share links](https://docs.formstep.io/sharing-publishing/sharing-embedding/) — Create and manage share link URLs

[Custom domains](https://docs.formstep.io/branding-domains/custom-domains/) — Set up branded form URLs

[Plans & pricing](https://docs.formstep.io/subscription-billing/plans-pricing/) — Compare Free, Pro, and Business