Anti-spam features by builder
Read on 30 October 2026. Webflow is left out because we could not verify its current form spam settings from its documentation, and we would rather omit it than guess. [1][2][3][4][5]
| Builder | Default protection | Optional methods | Plan needed | Filtering |
|---|---|---|---|---|
| Carrd | "Baseline mitigation against spam and bots" | Cloudflare Turnstile, Google reCAPTCHA v2 or hCaptcha; one per form | Pro Standard for a provider | Not documented |
| Framer | Basic: background puzzle on all sites | Advanced: extra AI-powered layer; no native reCAPTCHA | Advanced on Pro and above | Pass (deliver and flag) or Block |
| systeme.io | Not documented | Google reCAPTCHA v2, keys added under the custom domain's settings | Needs a custom domain set up for the keys | Not documented |
How each one works
Carrd: under the form's Options you pick a Spam Protection provider. Only one provider can be selected per form, and the same provider and keys can be reused across forms on a site. A provider requires Pro Standard or higher. [1]
Framer: its built-in protection is a CAPTCHA that "operates in the background": the visitor's device solves a mathematical puzzle that bots typically lack the computing power for. Advanced protection adds an AI layer on Pro plans and above. With filtering set to Pass, everything is delivered and suspicious submissions get markers such as [Spam] in the subject; with Block, flagged submissions are not delivered. Framer says remaining spam is likely from real people and that it has no native reCAPTCHA integration. [2][3]
systeme.io: you register your domain with Google reCAPTCHA v2 (the "I'm not a robot" checkbox), then paste the site and secret keys into Settings, Custom domains, your domain's settings. The reCAPTCHA element is pre-installed on the contact page template, and the domain on the funnel step must match the one registered with Google. [4][5]
The accessibility cost of each method
The W3C note Inaccessibility of CAPTCHA says a CAPTCHA "often prevents people with disabilities from performing the requested procedure", that audio alternatives are a poor fit for people with cognitive disabilities, and that relying on CAPTCHA is "becoming increasingly ineffective" because common image and audio tests can be cracked. It describes honeypots, fields hidden from humans with CSS, as an approach that "should be considered". [6]
Cloudflare says Turnstile works "without showing visitors a CAPTCHA" and offers managed (shows a checkbox only for risky visitors), non-interactive and invisible widget types. [7]
| Method | Where available here | Visitor effort | Accessibility risk |
|---|---|---|---|
| Background puzzle | Framer Basic | None | Low |
| AI filtering | Framer Advanced | None | Low; false positives possible, so use Pass and review |
| Turnstile (managed or invisible) | Carrd | Usually none; checkbox for risky visitors | Low to moderate |
| reCAPTCHA v2 checkbox | Carrd, systeme.io | Click; image challenge when flagged | Higher: image or audio challenges can block some users |
| hCaptcha | Carrd | Depends on configuration | Test with keyboard and screen reader before launch |
| Honeypot field | Not a documented setting on these builders | None | Low if properly hidden and labelled |
Which to pick
On Framer, keep Basic protection on and use Pass with Advanced if you are on Pro, so legitimate messages flagged by mistake still arrive marked rather than vanish. On Carrd, Turnstile in managed mode shows a checkbox only when it judges a visitor risky. On systeme.io, reCAPTCHA v2 is the documented option, so test the checkbox flow with a keyboard and on a phone. [2][1][7][5]
If spam continues, Framer's own diagnosis applies widely: it is likely real people, and filtering at the destination (inbox rules or a form tool) is the remaining fix. [3]
Setup checklist
- Confirm the plan: Carrd providers need Pro Standard; Framer Advanced needs Pro. [1][2]
- On systeme.io, set up the custom domain before generating reCAPTCHA keys, and match the domain exactly. [4][5]
- Submit a test entry from a phone, with a keyboard only, and with a screen reader if you can.
- Check where flagged submissions go: Framer's Pass mode marks them in the email subject. [2]
- Keep forms short; fewer fields means less to abuse and less friction for real people.
- Review submissions weekly for the first month and adjust the protection level.
Questions before you decide
Does Framer support reCAPTCHA?
Framer's help centre says it does not have a native reCAPTCHA integration. Its built-in protection runs a background puzzle on every site, and Advanced protection adds an AI layer on Pro plans and above.
Which captcha providers does Carrd support?
Carrd lets you choose Cloudflare Turnstile, Google reCAPTCHA v2 or hCaptcha per form, one provider per form. Adding a provider requires Pro Standard or higher; all forms get baseline protection.
Where do I add reCAPTCHA keys in systeme.io?
systeme.io's help centre says to paste the reCAPTCHA v2 site and secret keys into Settings, Custom domains, then your domain's settings, and save. The contact page template has the reCAPTCHA element pre-installed.
Are honeypot fields accessible?
The W3C note on CAPTCHA describes honeypots, fields hidden from humans with CSS, as an approach that should be considered, in contrast to visual and audio CAPTCHAs that can block people with disabilities.
Sources & verification
Product details and prices can change. Check the linked provider before buying.
- Carrd: protecting forms from spam and bots Accessed 30 Oct 2026
- Framer help: enable spam protection Accessed 30 Oct 2026
- Framer help: how built-in form spam protection works Accessed 30 Oct 2026
- systeme.io help: secure registration forms with reCAPTCHA Accessed 30 Oct 2026
- systeme.io help: add a CAPTCHA to a contact page Accessed 30 Oct 2026
- W3C: Inaccessibility of CAPTCHA Accessed 30 Oct 2026
- Cloudflare: Turnstile overview Accessed 30 Oct 2026
Sources link directly to providers. Product buttons may use separately labeled affiliate links. Read our disclosure.