The Contact Form Advanced widget has free SPAM protection built in, using Google reCAPTCHA: visitors tick "I'm not a robot" before the form sends. You need a free Google account to get two keys, which you paste into the form's settings. It takes about 10 minutes. In EverWeb 4.6 and later you can also choose invisible reCAPTCHA v3, or Cloudflare Turnstile instead of Google: see the EverWeb 4.6 section below.
Which form do you have?
| Widget | SPAM protection |
|---|---|
| Contact Form Advanced | reCAPTCHA, which you turn on in Widget Settings. In EverWeb 4.6 and later, also Cloudflare Turnstile |
| Contact Form (the plain one) | No reCAPTCHA. Replace it with Contact Form Advanced to use it |
Turn on SPAM protection
- Get your two keys from Google. Follow How to add SPAM protection with reCAPTCHA to Contact Forms. Choose reCAPTCHA v2 and the "I'm not a robot" Checkbox, and add your website's domain, such as yourdomain.com.
- In EverWeb, select your form and open Inspector > Widget Settings.
- Scroll to SPAM Protection and tick Use reCaptcha SPAM Protection.
- Paste your Site Key into reCaptcha Site Key and your Secret Key into reCaptcha Secret Key. Don't swap them, and don't add spaces.
- Publish your website, then open the published page in a private browser window and send yourself a test.
The reCAPTCHA box only appears on your published website. In Preview, EverWeb shows a note in its place, and forms don't send from Preview.
EverWeb 4.6 and later: reCAPTCHA v3 or Cloudflare Turnstile
In EverWeb 4.6 and later, the SPAM Protection section has a Captcha Provider menu with three choices. All three are free.
| Captcha Provider | What visitors see | Where you get the keys |
|---|---|---|
| reCaptcha v2 | An "I'm not a robot" box to tick | Google, as described above |
| reCaptcha v3 | Nothing to tick. Google checks the visit in the background, and the form shows a short line saying the site is protected by reCAPTCHA, with links to Google's Privacy Policy and Terms of Service | Google reCAPTCHA, choosing the score-based (v3) type |
| Cloudflare Turnstile | A small Cloudflare box that usually checks the visitor by itself, with no puzzle to solve | Cloudflare, with a free Cloudflare account. Your domain doesn't need to use Cloudflare |
- Select your form, open Inspector > Widget Settings, scroll to SPAM Protection and tick Use reCaptcha SPAM Protection.
- Choose your provider in Captcha Provider.
- Click the sign-up button below the key boxes. Its name follows your choice: Sign Up for reCaptcha v3 opens Google's page for creating reCAPTCHA keys, and Sign Up for Cloudflare Turnstile opens Turnstile in your Cloudflare dashboard. Sign in, or create a free account, if asked.
- Create keys for your website. For reCAPTCHA v3, choose the score-based (v3) type. For Turnstile, add a widget. In both, type your website's domain, such as yourdomain.com, and any other address you publish to, such as a test copy.
- Paste the site key into reCaptcha Site Key and the secret key into reCaptcha Secret Key. The boxes keep the reCaptcha name whichever provider you choose.
- Publish your website, then send yourself a test from a private browser window.
Keys only work with the provider they were made for. reCAPTCHA v2 keys don't work with v3. If you change the provider, create new keys for it and replace both.
If it doesn't work
- "The captcha is not valid." or the box doesn't load: check that the domain in your reCAPTCHA or Turnstile settings matches your website's address, that each key is in the right box, and that the keys were made for the provider you chose.
- You publish the same website to a second address, such as a test copy: add that domain to the same keys too.
- "You must complete the captcha.": the visitor sent the form without ticking the box. This is working as it should.
- "The captcha score was too low." (reCAPTCHA v3, EverWeb 4.6 and later): Google judged the visit likely to be automated. Real visitors rarely see this. If one does, ask them to try again, or switch Captcha Provider to reCaptcha v2 or Cloudflare Turnstile.
- Your form doesn't arrive at all: see My contact form isn't sending me emails.
Good to know
- reCAPTCHA and Turnstile stop automated programs that fill in forms. They can't stop a person typing spam by hand, or spam sent straight to your email address. For spam in your inbox, see I'm receiving a lot of spam emails to my account. How can I stop this?
- If you have the Contact Forms Enhanced add-on, its Send Confirmation Email option needs SPAM protection turned on. See What is the Contact Forms Enhanced Add-on?