Anti-Spam & Security

Honeypot

The honeypot is a hidden form field that is invisible to real users but gets filled in by bots that blindly complete every field. When the server detects a value in the honeypot, the submission is rejected as spam.

The honeypot is enabled by default on every new form. It adds zero friction for legitimate users. You can toggle it off per form in the form settings if needed, but there is rarely a reason to disable it.

Time-to-Submit

CampaignCanvas measures how quickly a form is completed after it loads. A real person needs at least a few seconds to read and fill in a form, while bots typically submit within milliseconds. Any submission completed in under 2 seconds is automatically rejected as bot traffic.

When the honeypot or the time check rejects a submission, nothing is saved and the visitor sees: We couldn't accept your submission. Please wait a few seconds and try again. You can change this text per form under Settings → Validation → Spam rejection message.

Important

The 2-second threshold is not currently configurable. If you have forms that are legitimately submitted very quickly (e.g. a single checkbox opt-in), you can disable time-to-submit validation for those specific forms in the form settings.

CAPTCHA

CampaignCanvas supports three CAPTCHA providers for human verification: Cloudflare Turnstile, Google reCAPTCHA v3, and hCaptcha. Each is configured per form and verified server-side automatically.

Supported Providers

Provider	Type	User Experience
Cloudflare Turnstile	Interactive widget	Non-intrusive challenge, adapts to your site’s theme
Google reCAPTCHA v3	Invisible / score-based	No user interaction; submissions scoring below 0.5 are rejected
hCaptcha	Checkbox widget	Visitor ticks the hCaptcha box; the token is verified against hCaptcha’s siteverify API

Per-Form Configuration

In the form settings, choose which CAPTCHA provider to use (or leave it empty to disable CAPTCHA for that form). Paste the site key and secret key on the form — both are required for hCaptcha, Turnstile, and reCAPTCHA. Leave a field empty to fall back to the matching key in appsettings.json.

Global Configuration

Add your site key and secret key in appsettings.json under the CampaignCanvas section:

{
  "CampaignCanvas": {
    "TurnstileSiteKey": "0x4AAAAAAA...",
    "TurnstileSecretKey": "0x4AAAAAAA...",
    "RecaptchaSiteKey": "6Lc...",
    "RecaptchaSecretKey": "6Lc...",
    "HCaptchaSiteKey": "10000000-ffff-ffff-ffff-000000000001",
    "HCaptchaSecretKey": "0x0000000000000000000000000000000000000000"
  }
}

You only need to configure the provider(s) you plan to use. The CAPTCHA widget and verification are handled automatically by CampaignCanvas once the keys are set.

Missing Secret Key

A form with a CAPTCHA provider selected needs a secret key, either on the form or in appsettings.json. Without one, CampaignCanvas can’t verify the CAPTCHA, so it rejects every submission to that form: visitors see “Captcha verification failed. Please try again.” and the application log names the missing key. Add the key, or clear the form’s CAPTCHA provider to turn CAPTCHA off.

The same applies to a form whose CAPTCHA provider isn’t available on this site, and to the newsletter signup form when its provider has no secret key.

Tip. Secret keys aren’t included in exports, so a form created by an import has no secret key of its own. Unless appsettings.json has one for its provider, add the key after importing; see Import & Export.

Rate Limiting

Form submissions can be rate-limited to prevent abuse, but CampaignCanvas doesn’t switch this on by itself: your site’s Program.cs has to register a rate-limiting policy called "FormSubmission" and turn the rate limiter on. Getting Started has the code. With its example settings, an IP address that sends more than 10 submissions in a minute gets a 429 Too Many Requests response until that one-minute window ends.

Tip

Rate limiting is especially important for headless API submissions. Combine it with CAPTCHA for the strongest protection.