Anti-spam keeps junk out of your submissions with a choice of CAPTCHA providers, keyword and IP blocklists, and a disposable-email blocklist — on top of the always-on honeypot, time-trap and rate limiting that every form gets for free.
Where: Tiger Forms → Settings → Anti-spam.
Choose an active CAPTCHA
Pick one provider in the Active CAPTCHA dropdown; only the selected provider’s keys are enforced, but you can leave the others filled in for quick switching. The options are:
- Google reCAPTCHA v2 (checkbox) — the classic “I’m not a robot” challenge.
- Google reCAPTCHA v3 (score) — invisible; scores each submission 0.0–1.0.
- Cloudflare Turnstile — a lightweight, privacy-friendly challenge.
- hCaptcha — a privacy-focused alternative to reCAPTCHA.
- — None — — no CAPTCHA (the honeypot and rate limiting still apply).
Entering keys
- Create keys with your chosen provider (for reCAPTCHA, use the matching type — v2 “I’m not a robot” or v3).
- Paste the site key and secret key into that provider’s rows. Secrets are stored encrypted and shown masked.
- For reCAPTCHA v3, set a score threshold (0.0–1.0, default 0.5) — submissions scoring below it are treated as spam. A higher number is stricter.
- Save, then submit a test entry to confirm the challenge appears and passes.
Blocklists
- Blocked keywords — one per line; submissions containing any listed phrase are rejected.
- Blocked IPs — one per line, CIDR ranges allowed, to turn away known bad sources.
- Disposable email blocklist — click Update now to refresh the list of throwaway email domains; the page shows when it was last updated.
Always-on protection
Independently of CAPTCHA, every form ships with a hidden honeypot field, a time-trap that rejects instant (bot-speed) submissions, and per-visitor rate limiting. These need no keys and stop the laziest bots first.
Tips
Layer your defenses. Leave the honeypot and rate limiting doing their job and add an invisible CAPTCHA (reCAPTCHA v3 or Turnstile) for zero user friction; reach for a visible checkbox (v2 or hCaptcha) only when you need higher assurance.
Which CAPTCHA should I use?
reCAPTCHA v3 and Turnstile run silently, so visitors see nothing. reCAPTCHA v2 and hCaptcha add a visible check that stops more bots but adds a click. Start invisible and tighten only if spam gets through.
Legitimate people are being blocked — why?
Check your score threshold (lower it toward 0.3 if v3 is too aggressive) and review the keyword and IP blocklists for entries that are too broad.