You can’t add a captcha to a native Notion form, so the fix for Notion form spam is to control who can reach the form. Limit it to your workspace, close it with No access when the flood starts, or put a form front-end with a honeypot or reCAPTCHA in front of your Notion database.
Why Notion form spam happens
Notion form spam happens because a public Notion form is an open link with no bot check. Notion’s forms help lists the sharing choices and the anonymous setting, but it never mentions spam, captcha or bots.
When you pick Anyone on the web with link, Notion says people outside your workspace, and people who don’t use Notion at all, can fill out the form. That’s the point of a public form. It also means a script that finds the link can post as often as it likes.
The other detail makes cleanup harder. Notion says respondents to forms shared with Anyone on the web with link “will automatically be anonymous.” So you can’t see a name, and there’s no list of senders to block.
Native settings that cut Notion form spam
Notion’s form builder has three settings that affect spam: who can fill it out, whether it’s open at all, and, on Enterprise, whether forms can go public. None of them filter bots. They only limit who sees the form.
Everything but the Enterprise switch lives under Share form → Who can fill out:
| Setting | What it does | When to use it |
|---|---|---|
| Anyone at your workspace with link | Only workspace members can submit; guests only with database access | Internal requests, IT tickets, team surveys |
| Anyone on the web with link | Anyone with the link can submit, anonymously | Public forms you can’t avoid |
| No access | Closes the form and stops new responses | Mid-attack, or when a campaign ends |
| Settings → Security → Disable publishing sites, forms, and public links | Enterprise owners can prevent forms from being shared to the web | Workspaces that never need public forms |
The workspace option is the strongest. If only your team needs the form, a bot with the link still can’t submit. The same setting also lets you keep Anonymous responses off, so each row records who sent it.
Close the form when spam is arriving now
The fastest way to stop a spam wave is to set the form to No access. Notion describes this option as the one you pick “if you’d like to close your form and stop accepting new responses.”
Here’s the order I’d follow when a form gets hit:
- Open the form builder and select Share form.
- Under Who can fill out, choose No access.
- Open the Responses table, sort by when rows were created, and delete the junk.
- If the link was posted somewhere public, make a fresh form so the old link stays dead.
- Reopen with the narrowest access the form can live with.
Closing the form is blunt. Real people get turned away too, so use it as a pause button while you fix access.
Add a honeypot, reCAPTCHA or Turnstile through a front-end
Real spam filtering needs a form layer that runs checks before a row is written to Notion. Notion’s native form can’t host these checks, so they come from a separate form builder or your own site form that saves into the database.
The three common checks:
- Honeypot field. A hidden input that people never see but basic bots fill in. Forminit’s honeypot docs explain that the server checks the hidden field is empty and discards the submission when it isn’t.
- reCAPTCHA v3. Google’s reCAPTCHA v3 “returns a score for each request without user friction.” A score of 1.0 is very likely a good interaction and 0.0 very likely a bot, and Google says “you can use a threshold of 0.5” by default.
- Cloudflare Turnstile. Turnstile calls itself a “smart CAPTCHA alternative” that “works without showing visitors a CAPTCHA.” Its managed mode decides whether to show a checkbox based on visitor risk. The Turnstile plans page lists a free plan, limited to 20 widgets per account.
Many third-party form builders that write to Notion offer a captcha toggle, often on paid plans. Read the builder’s docs to see which check it runs.
My take: start with a honeypot. It costs real people nothing, and most form spam comes from simple scripts that fill every field. Add Turnstile or reCAPTCHA only if junk still gets through.
What spam checks can’t fix
Every check above has a gap. A honeypot only catches bots that fill every field; a script written for your specific form can skip the hidden input.
reCAPTCHA v3 gives you a number, not a verdict, so you still pick the threshold. Set it too strict and you reject real people with no warning. Google also notes that “reCAPTCHA tokens expire after two minutes,” which matters for long forms where people take their time.
And none of them stop a human typing junk by hand. Only the workspace-only setting or a manual review step catches that.
Clean up spam that already reached Notion
Spam rows sit in your database like any other response, so you clear them from the Responses table. Notion stores form responses there by default.
- Add a Status property with a default like “New,” and only move real responses forward.
- Make a filtered view that hides anything still marked “New” from the people who act on responses.
- Watch automations. A
Page addedautomation fires “when a new page is added to your database,” per Notion’s automations help, so spam rows can trigger emails or Slack posts too.
If your form sends a team alert on every response, a spam wave becomes an inbox flood too.
Where to go next
If spam keeps coming back, the form probably doesn’t need to be as public as it is. How to share a Notion form publicly covers the sharing options in more depth, and the limitations of Notion forms lists the other gaps you’ll hit.
For public forms on a website, a front-end form usually fits better. This Notion contact form guide shows one setup, and the best Notion form builders compares options. A waitlist form is a common spam target, so it’s worth protecting first.
FAQ
Does Notion have a captcha for forms?
Notion’s forms help doesn’t describe any captcha, spam filter or bot check. The controls it offers are who can fill out the form, closing the form, and anonymous responses.
How do I close a Notion form to stop spam right away?
Open the form builder, select Share form, then Who can fill out, and choose No access. Notion says this closes the form and stops new responses.
Can I see who sent a spam response on a public Notion form?
No. Notion says respondents to forms shared with Anyone on the web with link are automatically anonymous, so there’s no name to block.
What is the least annoying way to block form bots?
A honeypot field or an invisible check like reCAPTCHA v3 or Cloudflare Turnstile. Neither asks real people to solve a puzzle, but both need a form front-end that supports them.