Google Forms spam: how bots flood a form, and how to stop them

Google Forms has no CAPTCHA, and anyone with a form's link can submit it. That makes a public form an easy target: a Google Forms spammer script can send hundreds of fake responses in a minute, burying the real ones and ruining the results. This guide explains how that happens and which settings actually stop it.

How spam bots fill a form

A spam bot rarely opens the form page at all. Every Google Form has an address that receives responses, and the question IDs are visible in the page source. A script can send answers straight to that address, again and again, and to Google each one is an ordinary response.

That is why tricks inside the form only go so far. A hidden question or a "type the word blue" check stops the crudest scripts, but anything that reads the form properly can read the rule too.

Signs your form is being spammed

• A burst of responses within seconds of each other
• The same answers repeated, or answers that are random in every question
• Text fields full of nonsense, links or the same phrase
• Far more responses than people you shared the form with

Settings that stop it

In order of how much they help:

1. Require sign-in and limit to one response. Under Settings, Responses, turn on Limit to 1 response. Every response then needs its own Google account, which stops almost every bot.
2. Restrict it to your organization. In Google Workspace, you can allow only people in your domain to respond.
3. Share the link with the people who should answer, not publicly. If a link has leaked, make a copy of the form and share the copy instead. A copy has a new address, while the old one keeps accepting responses until you close it.
4. Close the form when you are done. Turn off Accepting responses in the Responses tab. Add-ons such as formLimiter can close a form at a set time or after a number of responses.
5. Use response validation as a speed bump. A required question with a rule, such as a code you give to real respondents, filters out the simplest scripts.
6. Filter what gets through. An Apps Script onFormSubmit trigger can check each new response and remove it with deleteResponse if it looks like spam. In a linked sheet, sorting by timestamp shows bursts quickly.

Test your form's defences

The only way to know how a form behaves under a flood is to try it on your own form. Crowdfill sends a few hundred realistic responses at the speed you choose, so you can see what your linked sheet and dashboards do with that volume, and whether an Apps Script filter catches what it should. Afterwards, delete the test responses from the Responses tab.

Crowdfill is built for testing your own forms, and it stops at the same walls a spam bot should: it cannot get past sign-in or one-response limits, except as you. If Crowdfill gets through a setting, a simple spam script probably can too.

Spam sent through Google Forms

There is a second kind of Google Forms spam: e-mails sent through a form, such as fake quiz results or response receipts, and forms that ask for passwords. Google Forms itself warns never to submit passwords through a form. Use the Report abuse link at the bottom of a suspicious form.

Questions

Can I add a CAPTCHA to a Google Form?

Not natively. Requiring sign-in with one response per person is the closest built-in protection.

Can I see who sent the spam?

Only if the form collects verified e-mail addresses, which needs sign-in. Otherwise responses are anonymous.

How do I delete spam responses?

In the Responses tab, open the Individual view and delete them one by one, or delete all responses from the menu. Rows already in a linked sheet need removing there as well.