Google Forms is free and quick, which is exactly why so many forms end up full of junk: random names, links to shops you've never heard of, the same answer forty times in a minute. There is no spam button to press, but a few settings stop most of it.
This guide covers the seven Google Forms settings that stop spam, what each one costs you in responses, and the point at which a form needs real bot protection instead.
Why Google Forms gets spam
Three things make a Google Form an easy target:
- The link is public. Once it's on a website, a social post or a WhatsApp group, scripts that collect form links will find it.
- Nothing checks for bots. Google Forms has no CAPTCHA, hidden trap field or rate limit you can switch on, so a script can send hundreds of responses quickly.
- Receipts can be abused. When a form emails responders a copy of their answers and anyone can type any address, spammers have used it to send spam to other people's inboxes from Google's servers.
7 settings that stop spam on Google Forms
1. Collect verified email addresses
In Settings › Responses, set Collect email addresses to Verified. Respondents must sign in to Google, and their account's address is recorded with each response. Anonymous scripts can't get past it. Responder input, the other option, accepts whatever address is typed, so it doesn't stop anything.
The cost: people without a Google account, or who won't sign in on their phone, can't answer.
2. Limit to one response
Limit to 1 response also needs a Google sign-in, and stops one account sending the form again and again. It's good for votes, registrations and applications, and has the same cost as verified emails.
3. Restrict it to your organisation
On a Google Workspace account, you can let only people in your organisation answer. Ideal for internal surveys; useless for anything public.
4. Add a question bots can't answer
Add a required Short answer question such as “Type the word blue” or “What is 3 + 4?”. Under the three-dot menu choose Response validation and require the exact answer (Text › Contains blue, or Number › Equal to 7). Generic bots fill every field with random text and fail.
A trick question that real people get wrong, or a puzzle on every page of the form.
One obvious question near the end, with a friendly error such as “Please type blue so we know you’re not a bot.”
A script written for your form in particular will learn the answer, so treat this as a speed bump, not a wall.
5. Validate short answers
Spam usually hides in free-text fields. Use response validation to keep links out of fields that never need them: on a Name or Company question, choose Text › Doesn't contain › http, and set a sensible maximum length on paragraphs. For phone numbers, a regular expression keeps out obvious junk; our phone number validation guide has patterns to copy.
6. Don't send receipts to typed-in addresses
If you collect addresses with Responder input, don't also send responders a copy of their response. That combination is what spammers use to deliver their messages to strangers. Use verified emails, or turn receipts off.
7. Close forms you no longer need
Old forms are where spam piles up unnoticed. When an event or campaign is over, turn off Accepting responses on the Responses tab, or set a close date or response limit ahead of time so the form closes itself.
What Google Forms can't do
Every setting above either asks people to sign in or only slows bots down. Google Forms has no answer for:
| Problem | In Google Forms | What you need instead |
|---|---|---|
| Bots on a public form | No CAPTCHA, hidden field or rate limit | Invisible bot checks on every response |
| Sales pitches typed by people | No spam filter | A filter that reads answers for pitches and links |
| Throwaway email addresses | Accepted unless you require sign-in | A block on temporary email services |
| Spam from one country or network | No rules by country, IP or domain | Firewall rules |
| Fake phone numbers | Format check only | A WhatsApp or SMS code |
| Spam you've already received | Mixed in with real responses | A spam folder that keeps it out of your data |
Cleaning up spam responses
Delete spam from the Individual view on the Responses tab, one response at a time. If the form is linked to a Google Sheet, deleting a response in Forms doesn't delete its row, so remove those rows from the sheet too, and check any automation that already acted on them, such as emails, CRM records or a Zapier step.
When to switch
Google Forms is fine for internal surveys and forms where everyone has a Google account. It's time for a form builder with real spam protection when:
- The form is public: on your website, in ads or in your bio, and anyone must be able to answer without signing in.
- Responses become leads or orders that someone calls, emails or ships to, so every fake one costs you time.
- You need to know a phone number or email is real before you accept it.
- You're spending more time deleting junk than reading answers.
How Tapzy handles spam
Every Tapzy form has bot protection on from the moment you publish, with nothing to set up and no sign-in for respondents:
- Invisible bot checks: a hidden trap field, a small puzzle the browser solves while people type, a time check and a rate limit.
- A spam filter that reads answers for sales pitches, link dumps, scams and keyboard mash, at the strictness you choose.
- No throwaway emails: over 9,000 temporary email services are turned away, and you can accept business emails only.
- Firewall rules by country, device, IP range, referrer, email domain or answer.
- A trust score from 0 to 100 on every response, in Results, Google Sheets, webhooks and CSV.
- Spam is kept aside, not deleted: it doesn't count toward your limits or reach your integrations, and one click restores anything you want back.
Moving is quick: paste your Google Form's public link into Tapzy's importer and it rebuilds the questions. See the Tapzy vs Google Forms comparison for everything else that changes, or how spam protection works.