Spam Protection

NBForms supports two CAPTCHA providers that verify tokens server-side before a submission is accepted.

How it works

1. You add a CAPTCHA widget to your HTML form.
2. When the user submits, the widget injects a hidden token into the form data.
3. NBForms sends that token to the provider's verification endpoint.
4. If verification fails, the submission is rejected with 400 Bad Request.

Your secret key is never sent to the browser. Verification happens entirely on the NBForms backend.

Enabling CAPTCHA

Go to Form → Settings → CAPTCHA, choose a provider, paste your secret key, and save.

reCAPTCHA v2

Get your keys

1. Go to google.com/recaptcha.
2. Create a new site — choose reCAPTCHA v2 → "I'm not a robot" Checkbox.
3. Add your domain (e.g. example.com).
4. Copy the Site Key (public) and Secret Key (private).

Add the widget to your form

<!-- Load the reCAPTCHA script once per page -->
<script src="https://www.google.com/recaptcha/api.js" async defer></script>

<form action="https://api.nbforms.com" method="POST">
  <input type="hidden" name="_token" value="YOUR_FORM_TOKEN" />
  <label>Email</label>
  <input type="email" name="email" required />
  <!-- reCAPTCHA widget -->
  <div class="g-recaptcha" data-sitekey="YOUR_SITE_KEY"></div>
  <button type="submit">Send</button>
</form>

The widget automatically injects a hidden g-recaptcha-response field when the user checks the box.

Cloudflare Turnstile

Turnstile runs silently in the background in Managed mode — users see no checkbox.

Get your keys

1. Go to Cloudflare Dashboard → Turnstile.
2. Add a site, set your domain, choose widget type Managed.
3. Copy the Site Key and Secret Key.

Add the widget to your form

<!-- Load the Turnstile script once per page -->
<script src="https://challenges.cloudflare.com/turnstile/v0/api.js" async defer></script>

<form action="https://api.nbforms.com" method="POST">
  <input type="hidden" name="_token" value="YOUR_FORM_TOKEN" />
  <label>Email</label>
  <input type="email" name="email" required />
  <!-- Turnstile widget -->
  <div class="cf-turnstile" data-sitekey="YOUR_SITE_KEY"></div>
  <button type="submit">Send</button>
</form>

Turnstile injects a hidden cf-turnstile-response field automatically.

Using the Setup tab

The Setup tab field builder includes a reCAPTCHA v2 option in the Add fields row. Adding it inserts the correct <div class="g-recaptcha"> element and loads the Google script in the generated snippet.

Replace YOUR_SITE_KEY with your actual site key before deploying.

CAPTCHA requirements

• CAPTCHA verification is only triggered when both a provider is set in Settings and a secret key is saved.
• If you enable a provider but leave the secret key blank, settings will not save.
• Submissions without a CAPTCHA token (when one is required) are rejected immediately — the submission is not stored.