---
title: Form spam protection and email validation
slug: form-protection
description: How Personizely protects widget forms: built-in email validation, Bouncer verification, required fields and patterns, phone formatting and reCAPTCHA v3 setup.
docTags: 
createdAt: 2026-10-16T20:04:57.186Z
---

Personizely checks what visitors type into widget forms before a submission is saved, so your contact list and email platform don't fill up with typos, fake addresses and bots. Every form with an email field gets email validation automatically. You can add stricter email verification with Bouncer, per-field validation rules, and Google reCAPTCHA v3 to filter bot submissions.

**Available on:** all platforms.

## How it works

When a visitor submits a widget form:

1. **The email address is checked.** Invalid addresses block the submission and the email field is highlighted.
2. **Required fields and validation patterns are checked.** The browser shows the field's error message.
3. **Phone numbers are normalized** to international format, using the selected country code.
4. **The submission is saved** to the visitor's profile, and the form's action and [Widget automations](docId\:J2UM-jhfDgQFopQlTvf_l) run, for example adding the contact to Klaviyo.

If you've connected reCAPTCHA, it also screens submissions for bots.

## Email validation

Email validation is on for every widget form that has an email field. There's nothing to configure.

| Check                  | What it rejects                                                                                                   |
| ---------------------- | ----------------------------------------------------------------------------------------------------------------- |
| Format                 | Addresses that aren't shaped like an email, such as `jane@` or `jane.example.com`                                 |
| Domain (default)       | Addresses whose domain can't receive email, such as typos like `jane@gmial.con`                                   |
| Bouncer (if connected) | Addresses that [Bouncer](https://www.usebouncer.com/) classifies as undeliverable, such as non-existent mailboxes |

- The address is checked while the visitor types and when they leave the field, so most submissions don't wait.
- An empty, optional email field isn't validated.
- If a widget has several email fields, only the first one is validated.

### Connect Bouncer

1. Create an API key in your Bouncer account.
2. In Personizely, go to **Settings → Integrations → Bouncer** and click **Connect**.
3. Paste the key in **API Key** and save.

Bouncer then replaces the default domain check for all widget forms on this website. Each validation uses credits on your own Bouncer account.

## Field validation

Each form field can be **Required** and can have a **Validation** pattern (a regular expression, for example `^[0-9]{5}$` for a 5-digit ZIP code) with its own **Error message**. Phone fields are saved in international format. All field options are described in [Form](docId:_32XhaAm6KMwlL3_ZIH25#field-options).

## reCAPTCHA v3

reCAPTCHA v3 works in the background, without a checkbox or puzzle, and helps keep bot sign-ups out of your list. It applies to **Form** elements in widgets.

### What you need

- reCAPTCHA **v3** keys (a site key and a secret key) from the [Google reCAPTCHA admin console](https://www.google.com/recaptcha/admin), with your website's domains added.
- Google's reCAPTCHA v3 script loaded on your pages, with your site key. **Personizely doesn't load it for you.**

### Set it up

1. In the Google reCAPTCHA admin console, register your site with **reCAPTCHA v3** and add every domain where your widgets show.
2. In Personizely, go to **Settings → Integrations → reCAPTCHA** and click **Connect**.
3. Enter your **secret key** in **API Key** and your **site key** in **Site Key**, then save.
4. Add Google's script to your site's `<head>`, on every page where a widget with a form can appear:

   ```html
   <script src="https://www.google.com/recaptcha/api.js?render=YOUR_SITE_KEY"></script>
   ```

   On Shopify, add it to `theme.liquid`; on other platforms, to your site's header code or tag manager.
5. Submit a test form on your live site and check that it's saved.

:::hint{type="warning"}
reCAPTCHA only protects forms on pages where Google's script is loaded. If you add it to some templates only, forms on other pages aren't checked.
:::

### Things to know

- **Google shows its reCAPTCHA badge** on pages with the script, unless you hide it as Google's terms allow.
- **Content Security Policy:** if your site has one, allow Google's reCAPTCHA domains. See [Content Security Policy (CSP)](docId\:kHb2SYuGO9A2ulTVoNa_J).
- **Cookie consent:** Google's script sets its own cookies. Declare it in your cookie policy. See [Cookies and consent](docId:-HA6dgPmpYmb7x6UZQ_t2).
- **Surveys aren't covered.** reCAPTCHA applies to Form elements only.

## Behavior details and limitations

- **Validation runs in the widget only.** Data you send with the [JavaScript API (window.ply)](docId\:d64TegyOiwNA2GFG1eXPm), such as `ply.identifyVisitor()`, isn't validated.
- **Blocked submissions aren't recorded.** A submission that fails validation doesn't count as a submit or a conversion, and no automations run.
- **Spin-to-win forms record the lead once.** If a form's action spins a wheel and the visitor can spin again, later submits re-spin without saving the submission again.
- **Validation doesn't confirm ownership.** An address can be valid and still belong to someone else. Use double opt-in in your email platform if you need consent confirmation.

## Troubleshooting

- **Valid addresses are rejected** → the domain has no mail server configured, which happens with new or internal domains, or Bouncer classified the address as undeliverable.
- **Bots still get through** → reCAPTCHA isn't connected, or Google's script isn't loaded on the page where the widget showed. Check the page source for `recaptcha/api.js`.
- **Test submissions aren't saved after adding reCAPTCHA** → check that the secret key is in **API Key**, the site key is in **Site Key** and in the script URL, the keys are v3 keys, and your domain is registered in the reCAPTCHA console.

## Related

- [Form element](docId:_32XhaAm6KMwlL3_ZIH25)
- [Contacts and form submissions](docId\:r6fb_qyzgxzRzBTFzO5AX)
- [Integrations](docId\:YweYsNdyWfChY1Z9KMneN)
- [Content Security Policy (CSP)](docId\:kHb2SYuGO9A2ulTVoNa_J)
- [Widget automations](docId\:J2UM-jhfDgQFopQlTvf_l)