One spam check per form

  • performance
  • forms
  • spam

Updated

Overview

Some sites protect their Gravity Forms with two spam checks at once: Simple Cloudflare Turnstile ("verify you're human") and Google reCAPTCHA (the CAPTCHA field, or the Gravity Forms reCAPTCHA add-on's v3 check). Two checks don't stop more spam than one, but they add weight and a second way for a form to break:

  • reCAPTCHA v3 downloads about 1 MB from Google on every page of the site, which counts against the PageSpeed score.
  • A CAPTCHA field whose keys are missing or out of date turns every visitor away with "The reCAPTCHA was invalid".
  • reCAPTCHA v3 with broken keys stops the form from sending at all.

With Dirigible Optimize active, reCAPTCHA steps aside on every form Turnstile protects. Turnstile keeps checking those forms, and forms Turnstile doesn't protect keep reCAPTCHA exactly as before.

There's nothing to set up, and none of your forms or settings are changed. Deactivating Dirigible Optimize puts reCAPTCHA back.

Which forms

reCAPTCHA steps aside on a form when all of these are true:

  • Turnstile has its site key and secret key, and Enable on all Gravity Forms is on (Settings → Cloudflare Turnstile, under Gravity Forms).
  • The form's ID isn't in Turnstile's Gravity Forms Disabled Form IDs.
  • Turnstile checks every visitor. If its Whitelist Settings skip certain IP addresses or browsers, or its Failsafe Settings let forms through while Cloudflare is down, reCAPTCHA stays on every form.

Logged-in visitors: if Turnstile's Whitelist Settings skip logged-in users, they see reCAPTCHA as before, because Turnstile doesn't check them.

What changes on a protected form

  • The CAPTCHA field (the "I'm not a robot" box) no longer shows, and Google's script for it doesn't load.
  • The reCAPTCHA v3 check is switched off for the form, the same way the form's own reCAPTCHA settings tab switches it off. New entries show the reCAPTCHA score as Disabled.
  • When every form that uses reCAPTCHA v3 is protected by Turnstile, Google's v3 script stops loading on the site's pages. If any form still uses v3 without Turnstile, the script keeps loading everywhere, as before.
  • Entries are no longer sent to Spam because of a low reCAPTCHA score. Turnstile turns bots away before an entry is saved instead.

What stays the same

  • Every submission is still checked on the server. reCAPTCHA is only skipped once Turnstile has verified that submission; if Turnstile didn't check it, reCAPTCHA checks it as before.
  • Multi-page forms, Save and Continue, conditional logic, AJAX forms and the pop-up form work as before.
  • Turnstile still loads when a visitor reaches the form (see Turnstile on demand).
  • Math and text CAPTCHAs, and reCAPTCHA Enterprise, are left alone.

After changing Turnstile settings

Pages are cached, so a visitor may get a copy of a page from before a change. If you turn off Enable on all Gravity Forms, add a form to Disabled Form IDs, or deactivate Turnstile or Dirigible Optimize, purge the site's cache straight away. Until you do, a cached page can show a form without reCAPTCHA that now needs it, and that form may not send. Turnstile has the same catch when it's first turned on.