Public forms with no bot check are the first thing spam bots find. A free, invisible check stops them without annoying real people. Fake sign-ups, junk messages, or your email provider's quota used up overnight.
The form accepts anything posted to it, and scripts post to every form they find.
Paste this into Lovable, Bolt, v0, Replit or Cursor:
Add Cloudflare Turnstile to every public form, and verify the token on the server (with TURNSTILE_SECRET_KEY) before processing the submission.
The full page, with the request ready to copy, is at launchpad.axonscape.com/fix/forms-flooded-by-bots. I work on Launchpad by Axonscape, which runs a free launch check for apps built with AI tools: it finds this and the other things that break at launch, from a public GitHub repo or a .zip of the code, and keeps nothing.