How to Stop Spam on Google Forms

Does Google Forms have a CAPTCHA?

No. Google Forms has no CAPTCHA, no reCAPTCHA and no spam filter. You can't add one yourself either, because Google hosts the form and you never get to edit its code. Anyone, or anything, with the link can submit.

Spam usually starts when the link ends up somewhere public: a website, a social post or a directory. Bots collect those links and fill them in. The settings below make that harder, strongest first.

Require sign-in

Bots rarely have Google accounts, so asking people to sign in stops most automated spam.

1. Open the Settings tab and expand Responses .
2. Turn on Limit to 1 response . Respondents must sign in to Google, and each account can submit once.
3. Or set Collect email addresses to Verified. That also requires sign-in, and records each person's Google email with their answers.

The cost is real. People without a Google account can't respond at all, and people on a phone or a work laptop often give up at the login screen. For internal forms that's fine. For a contact form, a lead form or a survey of customers, you lose genuine responses along with the spam.

On a Google Workspace account you can go further and restrict the form to people in your organisation, under the same Responses section.

Add a spam-check question

This is the nearest thing to a CAPTCHA in Google Forms, and it doesn't need sign-in.

1. Add a Short answer question such as "Spam check: what is 3 + 4?" and turn on Required.
2. Click the three dots ⋮ at the bottom right of the question and choose Response validation.
3. Set it to Number, Equal to, 7.
4. Type an error message such as "Please answer the spam check".

Simple bots fill every box with random text, fail the check and never submit. It won't stop a person spamming by hand, or a bot written for your form, and every real respondent has to answer it too. Change the sum now and then if spam creeps back.

Limit responses and close the form

A form that has stopped accepting responses can't be spammed. Two built-in settings help:

• Close the form at a set date and time, or as soon as you have what you need. See how to close a Google Form.
• Cap the total number of responses, so a flood of spam can't run past it. See how to limit responses in Google Forms.

Share the link carefully

• Send the link by email or in a private group instead of posting it on a public page, where bots look.
• Embedding the form on your website doesn't hide it. The form's address is in the page code, so bots can still find it.
• If a form is being flooded, make a copy and share the new link with the people who need it. The copy has a new address and starts with no responses.

Delete spam responses

1. Open the Responses tab and click Individual .
2. Use the arrows to find a junk response and click the trash icon to delete it.
3. To clear everything, click the three dots on the Responses tab and choose Delete all responses.

Deleting can't be undone. Rows already copied to a linked Google Sheet stay in the sheet, so delete them there too. If spam keeps arriving between clean-ups, turn off Get email notifications for new responses in the same three-dot menu until the settings above are in place.

Where Google Forms spam protection stops

Every Google Forms option either makes people sign in or makes them answer an extra question. Neither suits a public contact form, a lead form or a customer survey.

FormNX spam protection is built into every form. An invisible honeypot field, a hidden box that real visitors never see and bots fill in, runs on every form automatically and rejects bot submissions before they reach you. Turn on the CAPTCHA in the form settings for a second check. You don't need your own reCAPTCHA keys or any add-on.

On paid plans you can also block disposable email addresses, which stops throwaway sign-ups on lead and registration forms.

Comparing the two in more depth? See the Google Forms alternative page.