Spam protection

Every public form is protected in layers. Two are always on, and the rest are switches in the console. None of them need code: turn a captcha on, and the hosted page and the embed render it and BuildBase verifies it.

Choose a captcha provider

The provider applies to every form that has Require a captcha turned on.

Managed by BuildBase uses Cloudflare Turnstile run on BuildBase's own account. Most visitors see a small "Success" check and never a puzzle. On a self-hosted install without Turnstile keys, Managed uses the built-in check.

Built-in check runs a short proof-of-work calculation in the visitor's browser, typically under a second. It loads no third-party script and sets no cookie, so it suits sites with strict privacy requirements. It makes every submission cost a bot CPU time, but it does not tell a person from a headless browser on its own: pair it with content rules.

Your own keys route verification through your own provider account, so its analytics and settings are yours.

Add your own keys

1. Create a widget at the provider:
   • Cloudflare Turnstile: Cloudflare dashboard > Turnstile > Add widget, Managed mode.
   • hCaptcha: dashboard.hcaptcha.com > Sites > New site. The secret key is under your account settings.
   • Google reCAPTCHA: google.com/recaptcha/admin > Create, type v2 "I'm not a robot" Checkbox. v3 and Invisible keys do not render.
2. Add the hostname the console shows in the dialog to the widget's allowed domains. That is where the hosted page and the embed run.
3. Paste the site key and secret key into Forms > Spam protection and choose Check keys and save.

For Turnstile, Cloudflare confirms the secret before it is saved, so a mistyped key is reported in the dialog. hCaptcha and Google only confirm a secret against a real visitor's token, so after saving keys for either, open the hosted form and submit it once.

If a stored key later becomes unreadable, or a provider rejects it, forms fall back to Managed rather than accepting submissions without a check.

Turn protection on for a form

The Protect dialog holds every per-form setting. The shield icon is filled when any of them is on.

The rules are never sent to the public form page, so a spammer cannot read which words or limits to avoid.

Held for review

With Hold for review, a submission that breaks a link or word rule is saved but fires nothing: no form.submitted webhook, no workflow, no email. The visitor sees the normal success message.

On the form's page in the console, held submissions show a Held for review badge. Hover it for the reasons, for example 3 links (limit 1) or Contains blocked word "casino". Then:

• Approve releases it. form.submitted and the record-created event fire as if it had just arrived, so workflows run normally.
• Delete discards it. Nothing it would have triggered runs.

Email domain rules never hold: the visitor is asked for a different address, since a submission from a throwaway address cannot be followed up.

Test before going live

Each provider publishes test keys that run the real widget and the real verification, and always pass. Save them in Forms > Spam protection to try the whole flow on a draft form, then replace them with your own keys.

Test widgets show a "for testing only" line, so never leave them on a live form: with test keys, every visitor passes.

After saving your real keys:

1. Open the form's hosted page from the console and complete the captcha.
2. Submit it. The submission should appear on the form's page.
3. If the visitor sees "Could not verify the captcha", the provider refused your secret key or hostname. Check both in the provider's dashboard.

The hosted page shows each message in a toast and resets the captcha so the visitor can try again. The quiet answers are deliberate: telling a bot which check caught it tells it what to change.

Self-hosting

Nothing is required: Managed uses the built-in check until the platform has Turnstile keys. To run Managed on your own Cloudflare account, set both:

Next Steps

• Share and embed - put a protected form on any site.
• Custom forms - send a captcha token from your own UI.
• Workflows - act on form.submitted.