Any public-facing form attracts spam bots. The Anti-Spam tab gives you configurable extra shields on top of the protection that’s already running automatically behind the scenes.

Always-On Protection (Nothing to Configure)

Three layers of protection run on every single submission automatically, with no settings to manage:

• Security token check: Blocks submissions that don’t come from your genuine form (basic CSRF protection).
• Honeypot field: An invisible field real visitors never see or fill in — if it’s filled in, the submission is silently rejected as a bot.
• Minimum fill time: Submissions completed in under 2 seconds are blocked, since no human fills a form that fast.
• Rate limiting: Each visitor’s IP address is capped at 5 submissions per 10 minutes, preventing rapid-fire spam floods.

Duplicate Event Detection

Sometimes an impatient user clicks Submit three times, creating three identical events. Turning this on compares the new submission’s title and start date against existing events, and politely blocks the submission if it finds an exact match already in your system.

Enable Google reCAPTCHA v3

Want heavier spam protection without annoying real users? reCAPTCHA v3 runs invisibly in the background, scoring visitor behaviour to block bots — no picture puzzles for humans to solve. It layers on top of the honeypot and timing checks described above.

reCAPTCHA Site Key & Secret Key

To use reCAPTCHA, Google needs to know who you are. Register for free at Google’s reCAPTCHA admin console, choose v3, add your site’s domain, then copy the two generated keys into these fields.

reCAPTCHA Minimum Score

Google scores every visitor from 0.0 (definitely a bot) to 1.0 (definitely human). The default passing score is 0.5. If spam is still slipping through, raise it to 0.7–0.8 for stricter filtering — just be aware a very high score can occasionally block legitimate visitors on unusual networks (e.g. VPNs).

Note: reCAPTCHA and its keys only take effect once you’ve enabled reCAPTCHA above — leaving it disabled means these fields are simply ignored.