Overview #
Spam submissions can fill your inbox, waste staff time, and make useful form entries harder to find. A combination of form protection, validation, and monitoring can reduce unwanted submissions.
Lumo Forms includes or may provide several protection options depending on your installed version, such as CAPTCHA integrations, Cloudflare Turnstile, or other anti-spam controls.
Step 1: Review Available Protection Settings #
Open your Lumo Forms form settings and check which anti-spam options are available in your installed version.
Enable only protection methods that are supported and correctly configured.
Step 2: Configure CAPTCHA or Turnstile #
If your version supports CAPTCHA or Cloudflare Turnstile, follow the provider’s current instructions to create the required site credentials.
Enter the appropriate public site key and secret key in the designated settings.
Use the credentials for the correct website and environment. Never publish secret keys in page content, screenshots, or public code repositories.
After configuring the integration, test the form to verify that legitimate visitors can submit it and that invalid verification attempts are rejected.
Step 3: Use Additional Validation #
Where supported, consider enabling honeypot protection or other server-side anti-spam checks.
Keep required-field validation enabled for fields that are essential to the form’s purpose. Validation can improve data quality, although it is not a complete spam-prevention solution.
Step 4: Test Legitimate Submissions #
Complete the form as a normal visitor would.
Check that:
- Valid submissions are accepted.
- Required fields are enforced.
- The verification widget loads correctly, if used.
- Failed verification does not create a successful submission.
- Mobile visitors can complete the form.
Step 5: Monitor Spam Patterns #
Review unwanted submissions to identify patterns such as repeated links, suspicious messages, or bursts of requests.
If spam continues, investigate server logs and rate-limiting options available through your hosting provider or security tools.
Common Problems #
The verification widget does not appear: Check the configured site key, domain restrictions, JavaScript errors, and caching.
Legitimate visitors are blocked: Review the provider configuration and test in different browsers. Avoid combining too many aggressive protection methods without testing.
Spam continues despite CAPTCHA: No single technique blocks every automated or human-generated spam submission. Consider layered protection and server-side controls.
Best Practices #
Use the least intrusive protection that works for your audience. Explain any data collection associated with third-party verification services in your privacy policy.
