How to Add hCaptcha (or Cloudflare Turnstile) to a Framer Form

Spam bots love contact forms. Spam Shield protects your native Framer form, and it now lets you pick hCaptcha as well as Cloudflare Turnstile when you need a real captcha.

---

Do you need a captcha at all?

Start without one. Spam Shield is invisible on your site and already adds:

• A honeypot: a hidden field that people never see and bots fill in.
• A minimum fill time: a form sent faster than a person could (3 seconds by default) is stopped.
• A spam_check field, so every entry that passed arrives with "spam_check": "passed".

If spam still gets through, add a captcha. Visitors then prove they are human before the form can be sent.

---

How the captcha works in Spam Shield

1. Spam Shield loads the official script of the captcha you picked, and only that one: js.hcaptcha.com for hCaptcha, challenges.cloudflare.com for Turnstile.
2. The check shows above the submit button. hCaptcha can also run invisibly when the form is sent.
3. Until the check has passed, the submit is blocked and the visitor sees your message, "Please complete the security check." by default.
4. The token is sent with the form as h-captcha-response (or cf-turnstile-response for Turnstile).

---

Set up hCaptcha in four steps

1. Create a site in your hCaptcha dashboard and copy its site key and secret key.
2. Select your Form on the Framer canvas, open Spam Shield and click Insert Spam Shield. It is added above the submit button.
3. In the right panel, set Captcha to hCaptcha and paste the site key. Choose the theme and size.
4. Publish your site.

---

Checking every token on the server

A captcha in the browser can be skipped by a bot that posts straight to your form's endpoint. With FramerSend, paste the captcha's secret key in your form's settings (Forms → Edit → Captcha secret key). FramerSend then checks every token with hCaptcha or Cloudflare before the submission is saved and sent to your connectors. The same field takes a Turnstile or an hCaptcha secret.

---

Turnstile or hCaptcha?

• Cloudflare Turnstile usually passes without any puzzle and is free.
• hCaptcha is a good choice if you already use it on other sites, want its invisible mode, or prefer not to use Cloudflare.

Both work the same way in Spam Shield, and you can switch at any time in the right panel.

---

What we tested on a live site

We published a Framer form with Spam Shield set to hCaptcha with hCaptcha's public test site key. The hCaptcha widget showed above the submit button (in its compact size in a narrow form). Clicking submit without completing the check showed "Please complete the security check." and Framer sent nothing. Our automated tests also cover the server check with valid, invalid and missing tokens for both hCaptcha and Turnstile.

Spam Shield is included in every plan with all 110+ connectors, from $5/month and free for 14 days. Browse the other form fields for Framer.