Spam protection
Caramel can add a spam protection challenge to any public form. When enabled, the challenge runs silently in the background for most real visitors and blocks automated submissions before they reach your destinations.
Note Spam protection uses a privacy-preserving verification service. Visitors do not need to solve a puzzle or click a checkbox in most cases — the challenge runs automatically.
Enable spam protection
Section titled “Enable spam protection”- Open your form in the editor.
- Select the Branding tab.
- Under the Settings card, toggle on Spam protection.
- Click Save.
Spam protection takes effect immediately for new submissions. Existing submissions are not affected.
How it works
Section titled “How it works”When spam protection is enabled, each form load includes a verification challenge. If the challenge passes, the submission proceeds normally. If it fails — as it typically does for automated scripts and bots — the submission is rejected before any data is stored or forwarded to destinations.
Real visitors on modern browsers pass the challenge automatically. No CAPTCHA image or checkbox is shown in the vast majority of cases.
When to enable it
Section titled “When to enable it”Enable spam protection on any form that:
- Is publicly embedded on a high-traffic page.
- Has been receiving a high volume of junk submissions.
- Routes submissions to a CRM, mailing list, or automation where junk data is harmful.
For internal or low-volume forms (for example, an employee feedback form shared via a direct link), spam protection is optional.
Best practices
Section titled “Best practices”- Combine spam protection with field validation. Required email fields catch some bot patterns on their own; spam protection handles the rest.
- If you see a spike in junk submissions, check whether your domain allowlist is configured. See Embed your form.
- Monitor the Submissions tab after enabling spam protection to confirm legitimate submissions are still coming through.
Next steps
Section titled “Next steps”- Embed your form — Control which domains can load your form.
- Form analytics — Check whether submission volume changed after enabling protection.
- Where submissions go — Review destinations that receive each clean submission.