> ## Documentation Index
> Fetch the complete documentation index at: https://docs.surveyowl.co/llms.txt
> Use this file to discover all available pages before exploring further.

# Protect a form from spam

> The always-on honeypot, plus CAPTCHA with SurveyOwl's built-in option or your own provider.

Every form is checked against a honeypot: a decoy field that people never see but simple bots tend to fill in. Those submissions are dropped without telling the bot what went wrong. A Hosted form adds the decoy for you. On an Endpoint form you add it to your own markup, as shown in [Files and CAPTCHA](/developer-api/files-and-captcha#honeypot-protection).

For stronger protection, turn on **CAPTCHA** under **Security** in the form's **Settings**.

## Choose how to run it

Open the **Captcha provider** menu. What you see depends on the form:

* **SurveyOwl protection (hCaptcha)** is free and needs no keys. Picking it turns CAPTCHA on, and respondents see an hCaptcha checkbox on the last page. It's offered on Hosted forms when your deployment has it enabled.
* **Your own provider**: reCAPTCHA v2, reCAPTCHA v3, hCaptcha or Cloudflare Turnstile. You use your own account, so your quota and risk scores are the ones that count. This is the only choice for an Endpoint form.

## Use your own provider

<Steps>
  <Step title="Pick the provider">
    Choose it from the menu. The settings link to that provider's console.
  </Step>

  <Step title="Create keys">
    In the provider's console, register every hostname the form runs on. Include localhost if you test there.
  </Step>

  <Step title="Paste both keys">
    The site key is public. The secret key is stored securely and is never shown again after you save. Once both are filled in, CAPTCHA switches on.
  </Step>

  <Step title="Set a score if it's score-based">
    For reCAPTCHA v3, a higher minimum is stricter. `0.5` is a sensible starting point.
  </Step>

  <Step title="Save and test">
    Save, submit a real response, and check that it reaches your inbox.
  </Step>
</Steps>

The **CAPTCHA** switch pauses and resumes whichever option you picked without losing your keys.

On a Hosted form, SurveyOwl shows the challenge for you. On an Endpoint form you render the provider's widget yourself and send its token along with the answers. See [Files and CAPTCHA](/developer-api/files-and-captcha).

<Warning>
  **Keep the secret key private.** Never put it in page HTML, a public repository or a support screenshot.
</Warning>


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.