Spam Protection
Keeping bots out of the lead table without adding friction for real buyers.
Bot submissions distort everything downstream: the conversion funnel reads worse than reality, scoring picks up a spike of low scores, and reps stop trusting alerts. That is why the spam rate sits on the traffic overview.
The Two Controls Surface Gives You
Email validation on the email field
An email field can block personal email domains outright
(blockPersonalEmails), and Surface can put a deliverability verdict on the
address it was given. The verdict is annotate-only by default: the visitor
continues, and the response carries the result for workflows and scoring.
Soft warn, block and disqualify are the other policies. See
email validation.
Cloudflare Turnstile
Bring your own Cloudflare widget, paste the site key and secret into the form's settings, then drop the Turnstile component onto the step you want gated. It is validated on submit. Walkthrough: Enable Cloudflare Turnstile.
Reading the Spam Rate
The spam rate card sits on the traffic overview next to avg lead score and high quality. Read the shape over time, not the number on any one day.
| Pattern | Likely cause |
|---|---|
| A flat baseline you have watched for weeks | Background noise. Learn your own normal, there is no published number to compare against |
| Sudden spike on one form | That form's URL got scraped or posted somewhere. Add Turnstile to it specifically |
| High on a direct-link form | The URL is public and not protected by the page around it. Expected, so validate harder |
| High, and every submission scores 0 | Not spam so much as wrong traffic. Check the campaign sending it |
What Not to Do
Do not add a required phone number to deter bots. It deters buyers far more effectively. Drop-off by step in form analytics shows the cost.
Do not hard-delete suspected spam. Filter it out of views and keep the
record, or you cannot tell a false positive from a real one. Score-based filters
(minScore on get_leads_with_ai_scores) are the easy way to do that.
Do not rely on a honeypot alone. They stop the simplest bots and nothing else.
Do not treat a multi-step form as a spam control. Extra steps may deter some automated submissions, but nothing in Surface claims it, so do not build the form around it.
Bots reaching a form you built with the Forms SDK? SDK forms skip the hosted-page settings, Turnstile included, so protection has to run on your page rather than on ours. See dos and don'ts.