Screen AroFlo lead form spam with reCAPTCHA or Turnstile

Captcha checks each submission with Google reCAPTCHA v3 or Cloudflare Turnstile before Formpiece saves it. A submission that fails the check is refused, so it never becomes an enquiry and nothing reaches AroFlo. Captcha works on every plan.

Before you start

• Save your keys as a credential under Integration Credentials. Click Create Integration Credential and pick reCAPTCHA v3 or Turnstile.
• reCAPTCHA needs a reCAPTCHA v3 Site Key and a reCAPTCHA v3 Secret Key. They have to be reCAPTCHA v3 keys.
• Turnstile needs a Turnstile Site Key and a Turnstile Secret Key.

Step by step

1. Open your form from Forms. If it opens in Form UI, switch to Config. Then open Settings, then Captcha.

2. Turn on Allow captcha.

3. Pick your credential from Choose Integration credentials. Only reCAPTCHA v3 and Turnstile credentials are listed, each with its provider in brackets.

4. Click Save.

   

The form uses whichever provider the chosen credential belongs to. To change provider, pick a different credential.

The check runs when the customer clicks Send enquiry. reCAPTCHA v3 never asks the customer to do anything. Turnstile can show a challenge at the bottom of the screen when Cloudflare wants a closer look, and the customer has two minutes to complete it.

When it goes wrong

Customers see "Captcha verification failed."

Formpiece checked the submission and refused it. The message shows above the form and everything the customer typed stays in place. A refused submission never becomes an enquiry, so it isn't listed under Enquiries and no failed notification email goes out.

• Allow captcha is on and Choose Integration credentials is empty. The page saves this without complaint, and every enquiry is then refused. Form UI flags it as "Captcha is on with no credentials chosen".
• The chosen credential was deleted, or holds no secret key. Pick a credential again and click Save.
• Google or Cloudflare rejected the token. Check the site key and secret key in the credential come from the same reCAPTCHA or Turnstile setup.
• reCAPTCHA scored the submission below 0.5.
• Google or Cloudflare didn't answer within five seconds. Formpiece refuses any submission it couldn't check.

Customers see a message about the captcha script or challenge

With captcha on, the form has to get a token from the provider before it sends. When it can't, the customer sees the reason above the form, such as "The grecaptcha script did not load." or "The Turnstile challenge did not complete in time." The provider's script may have been blocked, by a browser extension for example, or the customer didn't finish the Turnstile challenge within two minutes.

FAQ