If you’re using CiviCRM Form Builder, there are two simple ways I use to keep junk submissions from turning into junk CRM data.
Cloudflare Turnstile
With the Form Protection extension, Turnstile can now be added to Form Builder forms under the “Elements” tab. It works like reCAPTCHA, but without making people identify bicycles and traffic lights.
Turnstile support is currently in the main branch of Form Protection because a tagged release isn’t out yet. Add your Turnstile site key and secret key on the Form Protection settings page.
Email verification
To ensure the people signing up are indeed who they say they are, I like requiring the person to click a verification link sent to their email address before the submission even creates the contact.
Turnstile and email verification solve slightly different problems.
- Turnstile asks: does this submission look like it came from a real person?
- Email verification asks: does this person actually control the email address they gave us?
To enable email verification under a given form, go to Settings > and check “Verify submission before processing”. For a newsletter signup or similar form, I often use a verification email like this:
Subject: Please verify your email for {domain.name}
Please {afformSubmission.validateSubmissionLink} to confirm you are a real human and get on our email list.That is the token that inserts the verification link. It is not especially obvious where to find, so it is worth knowing.
If the problem is broader than individual form submissions, Cloudflare Managed Challenges and security rules can add another layer before the traffic ever reaches your site.
The bottom line:
The internet is becoming all about bots; form spam is annoying and clogs up your email and distract from real work. Protect your forms and get on to your normal work without distraction.