How to Stop Spam Submissions on monday.com Forms
Published on August 11, 2026
You published a form, shared the link, and submissions came in. Then the junk started: items named “asdkjh”, fake email addresses, messages stuffed with links. Each one lands on your board next to real requests, fires the same notifications and automations, and waits for someone to sort and delete it.
This is what happens when a public form link gets found by bots. This guide explains why it happens and how to layer defenses that cut spam down without blocking real respondents.
Quick answer
- Enable CAPTCHA — Google reCAPTCHA, Cloudflare Turnstile, or both — in FormFlow’s form settings. It is the highest-impact control for a public form.
- Add response limits and availability windows so a discovered link is only worth attacking while the form is open.
- For known audiences, use passwords instead: a static password on insert forms, per-item passwords on update forms.
- No single control eliminates spam. Layers reduce it and raise the cost of abuse.
Why Public Form Links Attract Spam
A public form link is exactly that: public. Once it sits on your website or in a campaign, crawlers index it and scrapers harvest it. Bots then probe it with whatever the form accepts: link spam, fake signups, garbage text. The traffic is automated and indiscriminate. Your form is one of thousands hit the same way.
The cost shows up on your board. Junk items pile up between real submissions, teammates chase fake contacts, and every automation that runs on item creation consumes actions on garbage. If the form has a response limit, bots can eat it before real respondents arrive.
Native options are thin here. A monday.com community request for reCAPTCHA on forms has been open since April 2021 , and monday.com’s WorkForms documentation does not list CAPTCHA support at review time — check the current docs for the latest status. FormFlow builds bot protection and four other access controls into every form. All of them are optional: forms are open by default, and you enable only what each form needs.
Five Layers That Reduce Spam
Each control below cuts off a different route for junk. Work down the list and stop when the remaining risk is acceptable for that form.
1. CAPTCHA: reCAPTCHA, Turnstile, or Both
A CAPTCHA challenge sits between the visitor and the submit button and filters out most automated traffic before it reaches your board. FormFlow supports Google reCAPTCHA and Cloudflare Turnstile. Enable either or both — only the challenges you turn on are shown to respondents.
| Google reCAPTCHA | Cloudflare Turnstile | |
|---|---|---|
| Respondent experience | Checkbox plus a possible image challenge (reCAPTCHA docs ) | Designed to avoid visible challenges for most visitors (Turnstile docs ) |
| Setup | Requires Google reCAPTCHA keys | Requires Cloudflare Turnstile keys |
| Pick it when | You want the widely recognized checkbox | You want the least friction for real respondents |
To enable it: open your form in FormFlow, go to Form Settings, and turn on Google reCAPTCHA, Cloudflare Turnstile, or both.
When to use: any form with a publicly reachable link and no password. Start with one provider; add the second only if spam keeps getting through.
2. Response Limits
A response limit caps total submissions; the form closes automatically when the cap is reached. It cannot tell bots from humans, but it puts a ceiling on damage — a scripted run cannot dump ten thousand items on your board overnight. Separate submission limits can also cap entries per user or per time period.
When to use: fixed-capacity events, contests, beta signups — anywhere volume should be finite. Pair it with CAPTCHA so bots do not consume the limit before real respondents arrive.
3. Availability Windows
An availability window (time limits in form settings) sets a start date, an end date, or both. Outside the window, visitors see a customizable message instead of a form. A link that only works for two weeks is a smaller target than one that stays live for years — stale links in old campaigns keep collecting spam long after anyone watches the board.
When to use: campaigns, application deadlines, seasonal intake, event registration. Close the window and the spam stops with it.
4. Country Restrictions
Country restrictions accept submissions only from the countries you select; everyone else sees a message instead of the form. If you operate in three markets, submissions from elsewhere are noise at best. This narrows exposure rather than detecting bots, so treat it as a filter, not a bot-stopper.
When to use: regional campaigns, compliance-driven collection, or when your junk submissions clearly originate from regions you do not serve.
5. Password Protection
A password keeps the form itself out of reach. On insert forms, you set one static password and share it with the intended audience. On update forms, each item gets its own password stored in a board column and generated automatically through monday.com automations. A bot that finds the URL hits a password prompt, not a form.
When to use: any form meant for a known audience — internal requests, invited applications, client record updates.
Match the Defense to the Form Type
| Form type | Typical setup |
|---|---|
| Public lead capture | CAPTCHA on; response limit if capacity is finite; availability window for campaigns; no password |
| Internal request form | Static password shared in a team channel; CAPTCHA usually skipped |
| Update form (client or employee data) | Per-item links and per-item passwords; CAPTCHA rarely needed |
A public lead capture form carries the real spam risk. The link is meant to be found, so CAPTCHA does the work while limits and windows contain whatever slips through.
An internal request form is technically a public URL, but a static password removes the incentive: the form never renders for anyone without it.
Update forms are hard to spam at scale by design. Each link points at exactly one item, and with per-item passwords enabled, each link also demands a credential unique to that item. There is no single endpoint a bot can hammer with mass junk. Internal forms behind per-item passwords usually need no CAPTCHA at all — a challenge with no bot exposure only slows down the people you invited.
Frequently Asked Questions
Does monday.com’s native form builder support CAPTCHA? A community request for reCAPTCHA on monday.com forms has been open since April 2021, and monday.com’s WorkForms documentation does not list CAPTCHA support at review time — check the current docs for the latest status. FormFlow adds Google reCAPTCHA and Cloudflare Turnstile as optional settings on any form.
Will CAPTCHA stop all spam on my monday.com forms? No. CAPTCHA blocks most automated submissions, but some bots and any human-typed spam can still get through. Treat it as the first layer and combine it with response limits, availability windows, and passwords to reduce what remains and raise the cost of abuse.
Should I enable both reCAPTCHA and Turnstile at once? Start with one provider. One challenge is enough for most forms, and FormFlow shows respondents only the challenges you enable. Add the second provider if spam keeps getting past the first.
Next Steps
- Review every optional security control in form settings →
- See how FormFlow’s five security layers fit together →
- Audit your existing forms with the security checklist →
- Install FormFlow and turn on CAPTCHA for your most exposed form.
Last reviewed: 2026-08-03. Community demand cited from the reCAPTCHA feature request in the monday.com community ; CAPTCHA behavior verified against Google reCAPTCHA and Cloudflare Turnstile documentation. Provider and platform features may change.