Documentation

Quick Start Basic Setup API Reference Spam Protection Advanced Features Framework Examples Troubleshooting FAQ

Spam Protection

Keep unwanted submissions out of your inbox

Overview

Static Forms supports two types of spam protection:

reCAPTCHA

Google's popular CAPTCHA service. Free and widely trusted.

✅ Industry standard
✅ Multiple versions (v2, v3)
⚠️ Requires Google account

ALTCHA

NEW

Privacy-first CAPTCHA alternative. No tracking or external dependencies.

✅ Privacy-focused
✅ No external accounts needed
✅ Better user experience

ALTCHA Setup

Recommended

ALTCHA is a privacy-first, self-hosted CAPTCHA alternative that doesn't require any external accounts or API keys.

Step 1: Enable ALTCHA in Dashboard

Go to your CAPTCHA settings
Enable ALTCHA protection
Save your settings

Step 2: Add ALTCHA to Your Form

<!DOCTYPE html>
<html>
<head>
  <script type="module" src="https://cdn.jsdelivr.net/npm/altcha/dist/altcha.min.js"></script>
</head>
<body>
  <form action="https://api.staticforms.dev/submit" method="POST">
    <input type="hidden" name="apiKey" value="YOUR_API_KEY" />
    
    <!-- Your form fields -->
    <input type="text" name="name" required />
    <input type="email" name="email" required />
    <textarea name="message" required></textarea>
    
    <!-- ALTCHA Widget -->
    <altcha-widget
      challengeurl="https://www.staticforms.xyz/api/altcha/challenge"
      hidefooter="true"
    ></altcha-widget>
    
    <button type="submit">Send</button>
  </form>
</body>
</html>

💡 Learn More: Check out our detailed guides on implementing ALTCHA:

• ALTCHA for HTML Websites
• ALTCHA for Next.js

reCAPTCHA Setup

Google reCAPTCHA is a widely-used CAPTCHA service that protects your forms from automated spam. Static Forms supports both reCAPTCHA v2 (checkbox) and v3 (invisible - Pro only).

Pro Feature: reCAPTCHA v3 is available exclusively for Pro users. It provides invisible protection with score-based verification, eliminating the need for user interaction.

Step 1: Get reCAPTCHA Keys

Visit Google reCAPTCHA Admin
Register your site and get your Site Key (for HTML) and Secret Key (for Static Forms)
Important: Add both your domain AND staticforms.xyz to the domain list
Choose your version:
- v2 Checkbox: User clicks "I'm not a robot" (All tiers)
- v3 Invisible: Score-based verification, no user interaction (Pro only)

Step 2: Configure in Dashboard

Go to your CAPTCHA settings
Select the reCAPTCHA tab
Choose your version (v2 or v3 for Pro)
Enter your Secret Key (not the Site Key)
Save your settings

Step 3: Add reCAPTCHA to Your Form

For reCAPTCHA v2 (Checkbox):

<script src="https://www.google.com/recaptcha/api.js" async defer></script>

<form action="https://api.staticforms.xyz/submit" method="POST">
  <input type="hidden" name="accessKey" value="YOUR_ACCESS_KEY" />
  
  <!-- Your form fields -->
  <input type="text" name="name" required />
  <input type="email" name="email" required />
  <textarea name="message" required></textarea>
  
  <!-- reCAPTCHA Widget - Use your SITE KEY here -->
  <div class="g-recaptcha" data-sitekey="YOUR_RECAPTCHA_SITE_KEY"></div>
  
  <button type="submit">Send</button>
</form>

For reCAPTCHA v3 (Invisible - Pro Only):

<!-- Load reCAPTCHA v3 -->
<script src="https://www.google.com/recaptcha/api.js?render=YOUR_SITE_KEY"></script>

<form id="myForm" action="https://api.staticforms.xyz/submit" method="POST">
  <input type="hidden" name="accessKey" value="YOUR_ACCESS_KEY" />
  
  <!-- Hidden field for the token -->
  <input type="hidden" name="g-recaptcha-response" id="g-recaptcha-response" />
  
  <!-- Your form fields -->
  <input type="text" name="name" required />
  <input type="email" name="email" required />
  <textarea name="message" required></textarea>
  
  <button type="submit">Send</button>
</form>

<script>
  document.getElementById('myForm').addEventListener('submit', function(e) {
    e.preventDefault();
    
    grecaptcha.ready(function() {
      grecaptcha.execute('YOUR_SITE_KEY', {action: 'submit'}).then(function(token) {
        // Set the token in the hidden field
        document.getElementById('g-recaptcha-response').value = token;
        
        // Submit the form
        document.getElementById('myForm').submit();
      });
    });
  });
</script>

Read the complete reCAPTCHA guide →

Which Should You Choose?

Feature	ALTCHA	reCAPTCHA
Setup Difficulty	Easy	Moderate
External Account Required	No	Yes (Google)
Privacy	Excellent	Good
User Experience	Smooth	Can be intrusive
Effectiveness	Excellent	Excellent

🎯 Recommendation: We recommend ALTCHA for most use cases due to its ease of setup, privacy benefits, and excellent user experience.