Form spam protection and email validation
Personizely checks what visitors type into widget forms before a submission is saved, so your contact list and email platform don't fill up with typos, fake addresses and bots. Every form with an email field gets email validation automatically. You can add stricter email verification with Bouncer, per-field validation rules, and Google reCAPTCHA v3 to filter bot submissions.
Available on: all platforms.
How it works
When a visitor submits a widget form:
- The email address is checked. Invalid addresses block the submission and the email field is highlighted.
- Required fields and validation patterns are checked. The browser shows the field's error message.
- Phone numbers are normalized to international format, using the selected country code.
- The submission is saved to the visitor's profile, and the form's action and Widget automations run, for example adding the contact to Klaviyo.
If you've connected reCAPTCHA, it also screens submissions for bots.
Email validation
Email validation is on for every widget form that has an email field. There's nothing to configure.
Check | What it rejects |
|---|---|
Format | Addresses that aren't shaped like an email, such as jane@ or jane.example.com |
Domain (default) | Addresses whose domain can't receive email, such as typos like [email protected] |
Bouncer (if connected) | Addresses that Bouncer classifies as undeliverable, such as non-existent mailboxes |
- The address is checked while the visitor types and when they leave the field, so most submissions don't wait.
- An empty, optional email field isn't validated.
- If a widget has several email fields, only the first one is validated.
Connect Bouncer
- Create an API key in your Bouncer account.
- In Personizely, go to Settings → Integrations → Bouncer and click Connect.
- Paste the key in API Key and save.
Bouncer then replaces the default domain check for all widget forms on this website. Each validation uses credits on your own Bouncer account.
Field validation
Each form field can be Required and can have a Validation pattern (a regular expression, for example ^[0-9]{5}$ for a 5-digit ZIP code) with its own Error message. Phone fields are saved in international format. All field options are described in Form.
reCAPTCHA v3
reCAPTCHA v3 works in the background, without a checkbox or puzzle, and helps keep bot sign-ups out of your list. It applies to Form elements in widgets.
What you need
- reCAPTCHA v3 keys (a site key and a secret key) from the Google reCAPTCHA admin console, with your website's domains added.
- Google's reCAPTCHA v3 script loaded on your pages, with your site key. Personizely doesn't load it for you.
Set it up
- In the Google reCAPTCHA admin console, register your site with reCAPTCHA v3 and add every domain where your widgets show.
- In Personizely, go to Settings → Integrations → reCAPTCHA and click Connect.
- Enter your secret key in API Key and your site key in Site Key, then save.
- Add Google's script to your site's <head>, on every page where a widget with a form can appear:
<script src="https://www.google.com/recaptcha/api.js?render=YOUR_SITE_KEY"></script>On Shopify, add it to theme.liquid; on other platforms, to your site's header code or tag manager.
- Submit a test form on your live site and check that it's saved.
reCAPTCHA only protects forms on pages where Google's script is loaded. If you add it to some templates only, forms on other pages aren't checked.
Things to know
- Google shows its reCAPTCHA badge on pages with the script, unless you hide it as Google's terms allow.
- Content Security Policy: if your site has one, allow Google's reCAPTCHA domains. See Content Security Policy (CSP).
- Cookie consent: Google's script sets its own cookies. Declare it in your cookie policy. See Cookies and consent.
- Surveys aren't covered. reCAPTCHA applies to Form elements only.
Behavior details and limitations
- Validation runs in the widget only. Data you send with the JavaScript API (window.ply), such as ply.identifyVisitor(), isn't validated.
- Blocked submissions aren't recorded. A submission that fails validation doesn't count as a submit or a conversion, and no automations run.
- Spin-to-win forms record the lead once. If a form's action spins a wheel and the visitor can spin again, later submits re-spin without saving the submission again.
- Validation doesn't confirm ownership. An address can be valid and still belong to someone else. Use double opt-in in your email platform if you need consent confirmation.
Troubleshooting
- Valid addresses are rejected → the domain has no mail server configured, which happens with new or internal domains, or Bouncer classified the address as undeliverable.
- Bots still get through → reCAPTCHA isn't connected, or Google's script isn't loaded on the page where the widget showed. Check the page source for recaptcha/api.js.
- Test submissions aren't saved after adding reCAPTCHA → check that the secret key is in API Key, the site key is in Site Key and in the script URL, the keys are v3 keys, and your domain is registered in the reCAPTCHA console.