Spam protection (CAPTCHA)

Spam protection adds a Cloudflare Turnstile challenge to your form: a one-click "I'm not a robot" check that stops most bots before they can submit. Most legitimate visitors pass automatically in the background without clicking anything.

Spam protection is available on Starter and above.

Turning it on

1. Open a form and go to the Settings tab.
2. Check Require CAPTCHA (spam protection).

The helper text reads: "Adds a one-click 'I'm not a robot' check just above the submit button."

On the Free plan this row is locked, with a note that spam protection is available on paid plans.

How it appears to respondents

• The Turnstile widget renders just above the submit button.
• On multi-page forms it appears only on the last page.
• The submit button stays disabled until the check passes.
• The widget matches your form theme (light, dark, or system).
• If the challenge token expires before the respondent submits, the widget quietly resets and they pass again, usually without noticing.

How it's enforced

Every submission is verified on the server before any record is written to Attio. If verification fails, the submission is rejected with "CAPTCHA verification failed. Please try again." A bot that skips the widget cannot get past this server-side check.

The plan entitlement is also re-checked on the server, so a form that was set up on a paid plan will stop enforcing CAPTCHA if the workspace later downgrades to Free.

Plan gating

Available on Starter, Pro, and Business. In the pricing comparison this is listed as Spam protection (CAPTCHA).