Forms

How to protect forms from spam (reCAPTCHA)

September 15, 2026
How to protect forms from spam (reCAPTCHA)

TeleportHQ forms have two spam protections, both in the form's Settings → Spam Filter: Check submissions with reCAPTCHA, an invisible Google check that refuses submissions it scores as bots, and a Hidden spam-trap field that sends bot submissions to your Spam tab. On TeleportHQ addresses, reCAPTCHA works with no setup. On a custom domain, paste your own Google reCAPTCHA Site Key and Secret Key, click Save and publish again.

How TeleportHQ protects your forms

Every TeleportHQ form submission goes through these checks:

  • Rate limiting. TeleportHQ accepts at most one submission per second from the same visitor's address. Faster ones are refused.
  • reCAPTCHA (switch Check submissions with reCAPTCHA). "An invisible check on each submission sent from the page; the ones it scores as bots are refused, and so is anything posted without the check." Visitors don't tick a box. On TeleportHQ addresses, TeleportHQ's own reCAPTCHA is used. With your own keys, yours is used instead.
  • A hidden spam-trap field (switch Hidden spam-trap field). "An invisible field people never see or fill in. Submissions that fill it are marked as spam." Bots tend to fill in every field. Those submissions are saved to your Spam tab instead of your list of submissions.

Before you start

  • Add a form. See How to create a form.
  • For your own reCAPTCHA keys: a Google account, and your custom domain, for example mybakery.com, connected to this project in TeleportHQ. See How to connect your own domain.
  • reCAPTCHA keys don't make forms work on other hosting. TeleportHQ forms only accept submissions from the project's TeleportHQ address (ending in .teleporthq.app or .teleporthq.site) and its connected custom domain. On a site hosted elsewhere, submissions are refused with "Domain not allowed". See Why is my form not working?

Check your form's spam settings

  1. In the TeleportHQ editor's left sidebar, click Growth (the last button, under Live).
  2. Under Forms, click Form submissions. Ctrl+5 (Cmd+5 on a Mac) opens it in one go.
  3. Under Your forms, click the form.
  4. Beside the form's title, click Settings (tooltip "Confirmation and error messages, notifications, spam protection and limits"). The Manage Form window opens on its Settings tab. You can also select the form on the canvas and click Manage in the right panel.
  5. Scroll to Spam Filter.
The Spam Filter section of the TeleportHQ form settings with 1 the reCAPTCHA switch, 2 the Hidden spam-trap field switch and 3 the Site Key and Secret Key fields numbered
  1. Check submissions with reCAPTCHA: on for new forms. Turn it off if you don't want Google's script on the form's page, for example to keep your cookie banner simple. Then no reCAPTCHA check runs for this form.
  2. Hidden spam-trap field: turning it on or off adds or removes the hidden field inside the form at once, without Save. A form added from the Primitives tab has it on. A form from a ready-made section or from the AI Assistant may not: switch it on.
  3. Site Key and Secret Key: your own reCAPTCHA keys. They show only while reCAPTCHA is on. The line above them says: "Forms published on TeleportHQ domains are protected by default. For custom domains, provide your reCAPTCHA keys from Google reCAPTCHA admin."

Click Save after changing reCAPTCHA or the keys, then publish your site so the change reaches your live form.

Add your own reCAPTCHA keys for a custom domain

1. Create the keys at Google

  1. Go to https://www.google.com/recaptcha/admin and sign in.
  2. Register a new site. Add a label, for example Sunny Bakery forms.
  3. Choose Score based (v3). TeleportHQ runs reCAPTCHA invisibly, the v3 way, so keys of the checkbox type (v2) don't work.
  4. Under domains, add your custom domain, for example mybakery.com.
  5. Submit, then copy the Site key and the Secret key that Google shows.

2. Add the keys in TeleportHQ

  1. Open the form's Settings tab (Growth → Forms, the form, Settings) and scroll to Spam Filter.
  2. Check that Check submissions with reCAPTCHA is on.
  3. Paste the site key into Site Key.
  4. Paste the secret key into Secret Key.
  5. Click Save.
  6. Publish your site again.

Repeat for each form on the custom domain. A form you add later in the same project starts with the keys of a form that already has them.

Check that it worked

  1. On your published site, submit the form.
  2. In the editor, open Growth → Forms and click the form. Your entry is listed beside it.

Troubleshooting

My form shows its error message after I added keys The keys may not match your domain, they may be of the wrong type (v2 instead of v3), or the site key and secret key are swapped. TeleportHQ rejects the submission with "Invalid CAPTCHA token". In the Google reCAPTCHA admin console, check that your exact domain is listed and that the keys are Score based (v3), copy both keys again, paste them into the right fields, click Save and publish again.

Real submissions ended up in Spam Open the Spam tab, tick them and click Mark as not spam. See How to see and export form submissions.

I still get spam Check that both switches are on, and report spam entries with Report as spam to keep your list clean. reCAPTCHA checks the submissions sent from your page. A program that sends submissions straight to TeleportHQ's form service, without going through your page, can still get past it, although the switch's description says such submissions are refused. The spam-trap field catches many of those.

Good to know

  • Spam protection isn't tied to a plan.
  • The settings and keys are saved per form.
  • A copy of the project doesn't keep the keys. When you duplicate a project, or someone clones it, its forms lose their reCAPTCHA keys, because the keys are registered for the owner's domains. The copy's forms use TeleportHQ's own reCAPTCHA until you paste keys again in each form.
  • Click the About Spam protection (i) button next to Spam Filter for a short reminder in the editor.
Share

Related Articles

How to choose what happens after someone submits a form

In TeleportHQ, you open a form's Manage Form window (Growth → Forms → Settings) and, on the Settings tab, choose what visitors see after submitting (an alert, a component, a page or a web address), who gets an email for each submission (up to 3 addresses, the workspace owner first), and when the form closes (an expiration date or a submission limit); click Save and publish.

How to see and export form submissions

In TeleportHQ, you see form submissions in Growth → Forms → Form submissions by picking a form in the Your forms list, where you search, open and edit entries, mark them as spam, move them to trash, download one as a PDF, or click Download submissions to export them as a CSV file.

Why is my form not working?

A TeleportHQ form usually stops collecting submissions because the site is hosted outside TeleportHQ ("Domain not allowed"), the changes weren't published, the form's storage is off or handled by a workflow, an action attribute overrides it, a field rule refuses the value, the form expired or hit a limit, or reCAPTCHA keys don't match the domain.

How to connect your own domain

In TeleportHQ, publish your site to Production, then open Publish → Production → Custom domain → Configure, type your domain, choose the default address, and add the DNS records TeleportHQ shows at your domain provider.

How to create a form

In TeleportHQ, you create a form by adding a Form element from Elements → Primitives, by adding a ready-made Contact Form, Sign Up or Sign In section, or by asking the AI Assistant; then click + Add elements to insert fields such as Name, Email and Phone, and publish so submissions reach Growth → Forms.