---
title: Spam protection and CAPTCHA for signup forms
description: See how signup forms keep robots out with a hidden field, a timer and send limits, and how to add Turnstile, hCaptcha or reCAPTCHA.
url: "https://hiveplugins.com/docs/hive-mail-spam-protection-and-captcha/"
updated: "2026-10-28"
category: Hive Mail
---

# Spam protection and CAPTCHA for signup forms

Robots fill in public forms. Every signup form has three quiet protections that are always on, and you can add a fourth, a CAPTCHA. A CAPTCHA needs a free account with the service you choose, where you create keys for your domain: a **site key** (public) and a **secret key** (private).

## The four layers

The card **How your signup forms keep robots out** in **Settings** > **Forms** lists them:

1. **A hidden field** that only robots fill in.
2. **A timer**: a form sent less than 3 seconds after the page was drawn is refused.
3. **A limit on sends**: 3 forms a minute and 10 an hour per visitor; at most 3 confirmation emails a day to one address and 20 an hour from one network.
4. **A CAPTCHA**, off until you set it up. It is the best protection against your form being used to email strangers.

Only the CAPTCHA can be switched off, per form.

## Set up a CAPTCHA

1. Create your account and keys with the service. The screen links to each one ("Get your keys at Cloudflare").
2. Go to **Settings** > **Forms**, card **CAPTCHA**, and choose a **CAPTCHA service**: **None** (default), **Cloudflare Turnstile**, **hCaptcha**, **Google reCAPTCHA v2** (the "I am not a robot" box) or **Google reCAPTCHA v3** (invisible, scores each visitor).
3. Paste the **Site key**. It goes into the page.
4. Paste the **Secret key**. It stays on this site, shows as dots once saved, and is never shown again. Typing replaces it; emptying removes it.
5. For reCAPTCHA v3 only, set **How strict** from 0.1 to 0.9 (usual: 0.5). Raise it if spam gets through, lower it if real people are turned away.
6. Press **Save changes**. Open a signup form: its **Spam protection** card now names the service.

For reCAPTCHA v2, choose "I'm not a robot" when you create the keys.

![The CAPTCHA card with Turnstile chosen, the site key filled in and the secret key shown as dots.](https://hiveplugins.com/wp-content/uploads/2026/10/hivemail-settings-forms-captcha-01.webp)

To switch it off for one form, open the form in **Audience** > **Forms**, switch off **Ask visitors to pass a CAPTCHA** in **Spam protection**, and save. A yellow box warns if a service is ready but the switch is off. A form that sends confirmation emails is the one robots like most.

![The Spam protection card of a signup form showing the CAPTCHA switch.](https://hiveplugins.com/wp-content/uploads/2026/10/hivemail-forms-editor-spam-02.webp)

## What each service receives

Hive Mail has no CAPTCHA of its own, so the service you choose is told about your form's visitors.

| Service | Visitor experience |
| --- | --- |
| Cloudflare Turnstile (recommended) | Free; usually nothing visible; no puzzles. |
| hCaptcha | Free; may show a picture puzzle. |
| Google reCAPTCHA v2 | Free; "I am not a robot" box, sometimes a puzzle. |
| Google reCAPTCHA v3 | Free; invisible score from 0 to 1; a small badge in the page corner. |

- **Opening a page with such a form:** the browser loads the service's script (from challenges.cloudflare.com, js.hcaptcha.com, [www.google.com](http://www.google.com) or [www.recaptcha.net](http://www.recaptcha.net)). The service sees the visitor's IP address, browser, device and page address, and may set cookies.
- **Sending the form:** your server sends the service your secret key, the check's code and the visitor's IP address, and gets back yes or no (v3 also a score). Nothing typed in the form is sent.
- Pages without such a form load nothing.

While a form uses a CAPTCHA, Hive Mail adds a paragraph about this to the WordPress privacy policy guide. Mention it in your own privacy policy too.

## When a check fails

A CAPTCHA counts as ready only when a service is chosen and both keys are saved; otherwise forms behave as if it were off. The check fails closed: a missing token, a service that takes over 5 seconds, an unreadable answer, a refusal or a low v3 score all refuse the send, and the visitor sees "We could not check that you are human. Please try again." The reason (never the token or an address) goes to the log, at most once a minute per reason: see [Settings: Tools](/docs/hive-mail-settings-tools/).

If visitors cannot send, check that both keys are saved, belong to the chosen service and your domain, and that your site can reach the service. See also [Conflicts with other plugins and caching](/docs/hive-mail-conflicts-with-plugins-and-caching/).

This is information, not legal advice.

Next: [Settings: Forms](/docs/hive-mail-settings-forms/), [Signup forms](/docs/hive-mail-signup-forms/).