Public Link
Bot protection (Turnstile)
Cloudflare Turnstile checks public-link submissions for bots. It is always on for Free forms, and you can turn it off on Pro and Business. Most respondents never see it.
How it works
When a respondent submits, Turnstile checks in the background that they are not a bot. In rare cases, a small dialog asks them to confirm. There are no image puzzles. A submission that fails the check is rejected, and the respondent can try again.
Requests are not gated
Bot protection applies to share links only. A request link belongs to one recipient, so it skips the check.
Formstep-hosted forms
On form.formstep.io links, bot protection needs no setup.
Free: always on.
Pro and Business: turn it on or off per form in Settings, Public link access, Spam protection. If your plan lapses, it turns back on after 30 days. See Upgrading & downgrading.
Custom domain forms (BYOK)
On a custom domain (Pro and Business), such as fill.yourdomain.com, bot
protection needs your own free Turnstile keys, because Formstep’s key only covers formstep.io.
- 1
Add your custom domain first
The Bot Protection card on the Domains page appears once the workspace has a custom domain.
- 2
Create a Cloudflare account
Sign up for a free account at dash.cloudflare.com if you don't have one.
- 3
Create a Turnstile widget
In Turnstile, add a widget with your custom domains as allowed hostnames.
- 4
Copy your keys
Copy the Site key and Secret key.
- 5
Paste the keys in Formstep
Open Domains in the sidebar, find the Bot Protection card, paste both keys, and save. They apply to the whole workspace.
- 6
Turn it on per form
Turn on Spam protection in each form's Settings, Public link access.
Without keys, bot protection cannot run on the custom domain:
| Owner | Custom domain without keys |
|---|---|
| Pro or Business | Submissions go through without a check. |
| Free, guest, or a plan lapsed past day 30 | Submissions on the branded URL are rejected. The formstep.io link keeps working. |
No custom domains? Skip this.
If all your forms use the default Formstep share links, you do not need Turnstile keys. Bot protection works automatically.
Layered defense strategies
Turnstile is one layer. For more protection, combine it with other settings:
| Threat level | Recommendation |
|---|---|
| Low | Turnstile alone |
| Medium | Turnstile with a password or a scheduled close |
| High | Require sign-in, so nobody answers anonymously |
| Giveaways | Turnstile with a scheduled close and a response limit |
No protection is perfect
Some bots get past any check. For important forms, also use sign-in or email verification, and review submissions before you act on them.