# Spam Protection



Bot submissions distort everything downstream: the
[conversion funnel](/platform/traffic/conversion-funnel) reads worse than
reality, [scoring](/platform/lead-agents/scoring) picks up a spike of low
scores, and reps stop trusting alerts. That is why the spam rate sits on the
[traffic overview](/platform/traffic/analytics).

## The Two Controls Surface Gives You [#the-two-controls-surface-gives-you]

<Steps>
  <Step title="Email validation on the email field">
    An email field can block personal email domains outright
    (`blockPersonalEmails`), and Surface can put a deliverability verdict on the
    address it was given. The verdict is annotate-only by default: the visitor
    continues, and the response carries the result for workflows and scoring.
    Soft warn, block and disqualify are the other policies. See
    [email validation](/build/forms-sdk/email-validation).
  </Step>

  <Step title="Cloudflare Turnstile">
    Bring your own Cloudflare widget, paste the site key and secret into the
    form's settings, then drop the **Turnstile** component onto the step you
    want gated. It is validated on submit. Walkthrough:
    [Enable Cloudflare Turnstile](/guides/enable-cloudflare-turnstile).
  </Step>
</Steps>

## Reading the Spam Rate [#reading-the-spam-rate]

The **spam rate** card sits on the traffic overview next to avg lead score and
high quality. Read the shape over time, not the number on any one day.

| Pattern                                                             | Likely cause                                                                             |
| ------------------------------------------------------------------- | ---------------------------------------------------------------------------------------- |
| A flat baseline you have watched for weeks                          | Background noise. Learn your own normal, there is no published number to compare against |
| Sudden spike on one form                                            | That form's URL got scraped or posted somewhere. Add Turnstile to it specifically        |
| High on a [direct-link](/platform/forms/embedding/direct-link) form | The URL is public and not protected by the page around it. Expected, so validate harder  |
| High, and every submission scores 0                                 | Not spam so much as wrong traffic. Check the campaign sending it                         |

## What Not to Do [#what-not-to-do]

**Do not add a required phone number to deter bots.** It deters buyers far more
effectively. Drop-off by step in
[form analytics](/platform/forms/analytics) shows the cost.

**Do not hard-delete suspected spam.** Filter it out of views and keep the
record, or you cannot tell a false positive from a real one. Score-based filters
(`minScore` on `get_leads_with_ai_scores`) are the easy way to do that.

**Do not rely on a honeypot alone.** They stop the simplest bots and nothing
else.

**Do not treat a multi-step form as a spam control.** Extra steps may deter some
automated submissions, but nothing in Surface claims it, so do not build the
form around it.

<Tip>
  Bots reaching a form you built with the
  [Forms SDK](/build/forms-sdk/overview)? SDK forms skip the hosted-page settings,
  Turnstile included, so protection has to run on your page rather than on ours.
  See [dos and don'ts](/build/forms-sdk/dos-and-donts).
</Tip>