Shopify form spam protection on SK Form Builder is a set of checks that run before a submission is stored. The catalog verifies Google reCAPTCHA v2, reCAPTCHA v3, and hCaptcha on the server, and it also uses a honeypot, an IP blocklist, a default limit of 10 submissions from one IP each hour, and email-domain allow and block lists.
Those controls are for the merchant whose contact inbox fills with bot leads overnight. They reduce junk. They do not decide which remaining message is a real customer. A person still has to read what gets through. Captcha is not assigned to a paid tier. Plan prices in the catalog are Starter at no charge, Basic at $4.99 a month or $49.90 a year, and Pro at $12.99 a month or $129.90 a year, and there is no feature-to-plan matrix. Cloudflare Turnstile is not in the catalog.
What the overnight junk usually looks like
Bot leads tend to repeat. The same message arrives many times, the name is a string of random letters, or the email uses a domain you have never sold to. A quieter pattern is one IP address submitting just often enough to look like several interested buyers. Real customers write uneven messages about an order, a product, or shipping. Format checks catch a broken email address. They do not catch a well-formed address that belongs to a bot, so the spam tools sit beside validation.
Captcha options the app actually names
Three providers are documented, and each one is checked on the server against the provider's API before the submission is accepted. A checkbox that only exists in the browser is not enough. The server has to agree.
- reCAPTCHA v2: the familiar challenge on a Shopify reCAPTCHA form. The shopper completes the challenge, and the server verifies the response.
- reCAPTCHA v3: a score-threshold check with no puzzle for every visitor. The catalog says the score is threshold-based. It does not publish the number you must set, so use the provider's own guidance when you choose how strict to be.
- hCaptcha: the hCaptcha Shopify form option, also verified on the server. Use it when you have standardized on hCaptcha rather than Google.
Pick one provider for a form. Stacking two puzzles on the same page is not documented, and it asks a real customer to work twice. Keys used at runtime are loaded from a storefront-safe endpoint. The catalog is explicit that private credentials, such as SMTP passwords and API secrets, are not placed in the public page.
Turnstile is a different product. If a setup guide tells you to paste a Turnstile site key into this app, stop. That provider is not listed. Use reCAPTCHA v2, reCAPTCHA v3, or hCaptcha.
A strict v3 threshold or a puzzle that fails on mobile will block buyers as well as bots. After you enable a provider, submit one real entry from a phone and one from a desktop browser. If either fails, loosen the threshold or switch provider before you judge the form broken.
Blocklists and the honeypot
The honeypot is a hidden field. People do not see it and do not fill it. Simple bots often fill every field, including that one. It is a quiet filter. It will not stop a bot that is written to skip hidden inputs. Keep it on, and keep a captcha as well when the junk continues.
The IP blocklist is server-side. Add an address only after you have seen repeated abuse from it. A cafe, a mobile carrier, or a company office can share one public IP among many real shoppers. Blocking that address blocks all of them. Remove the entry if legitimate mail from that network stops.
Email-domain allow and block lists also run on the server. A block list is how you refuse a domain that sends only junk. An allow list is the stricter tool: only listed domains get through. An allow list fits a private wholesale form with a known set of company domains. It is a poor fit for a public contact page, because a new customer on an unlisted mailbox would be rejected.
- Use a domain block list for public contact forms that attract one bad domain.
- Use a domain allow list only when every valid sender shares a known domain.
- Pair either list with captcha. A new domain appears faster than you can type it into a list.
The hourly limit
The default rate limit is 10 submissions from one IP address each hour. Over that limit the server responds with HTTP 429 and does not accept the submission. Ten messages an hour is enough for a household sharing a connection. It is low enough to slow a script that posts all night.
The catalog states that default. It does not publish a separate documented control for changing the number, so plan around 10 per IP per hour unless the app screen you are using shows something else. Tell support staff that a customer who retries a broken form many times can hit the limit. Ask them to wait, or submit the test from another network, before you treat the 429 as a bug in the form.
The limit is per IP, not per email address. Two bots on different networks can still send 10 each. Captcha and the domain lists cover that gap. One busy office on one IP shares the same hourly budget, which is another reason to avoid blocking that IP outright.
What still needs a person
After the filters, open the submissions inbox. Status can be approve, reject, or pending, and a response can be assigned. Reject the leftover pitches. The tools do not write a reason for you. Field drop-off in analytics is a count of people who left a multi-step form. It is not a spam diagnosis.
A submission that includes a customer email becomes a support ticket. Spam that passes the filters can open one too, so reject it and keep the queue for customers. If the form accepts a file, the extension allowlist is your limit on what a bot can attach. There is no published megabyte cap. Merchant email uses reply-to set to the address on the form, so read the message before you reply to a link or an unexpected invoice.
Questions about form spam
Which captcha should a small store turn on first?
Start with one verified provider: reCAPTCHA v2 if you want a visible challenge, reCAPTCHA v3 if you want a score, or hCaptcha if that is your standard. Confirm a real submission from a phone before you leave it on overnight.
Will these tools stop every bot?
No single control does. The honeypot, the hourly IP limit, the domain lists, and server-side captcha each catch a different pattern. Review what remains in the inbox.
Is Turnstile available on this form?
No. The catalog names reCAPTCHA v2, reCAPTCHA v3, and hCaptcha. Plan the Shopify form around one of those three.
Turn on one captcha, the honeypot, and a careful domain list, then confirm a real entry still arrives. The control list is on the SK Form Builder page.