Bots Are Eating Your Typeform Response Quota
Typeform users have reported bots draining their paid response quota since 2021. Here's the evidence, why it happens, and what actually stops it.
If you run paid traffic into a Typeform, some share of the responses you're paying for aren't people. They're bots — and Typeform counts them exactly the same as a real lead. They fill your monthly response quota, they trigger the same 90% and 100% warning emails, and on most plans there is nothing standing between your form and them.
This isn't a hunch. It's been reported by Typeform's own users, in Typeform's own community forum, for years. Here's the evidence, why the gap exists, how to spot a bot submission when you see one, and a practical, vendor-neutral way to defend a form — whether or not you're staying on Typeform.
A bot submission counts the same as a real one
Typeform's pricing tiers cap how many responses you can collect per month: 100 on Basic ($39/mo, or $28/mo billed annually), 1,000 on Plus ($79/$56), and 10,000 on Business ($129/$91) (typeform.com/pricing). The free plan doesn't publish an exact number on the pricing page — it just says "a limited number of responses per month" — though Typeform's help center puts it at 10 per month, reportedly down from 100 earlier in the year (help.typeform.com — Response limits).
None of those plans — Free, Basic, Plus, or Business — include Typeform's spam prevention. Its Google reCAPTCHA-based spam prevention only exists on the Growth Flow plan ($379/mo, $266/mo annually) and the Talent (HR) plan ($169/mo, $119/mo annually) (help.typeform.com — Secure your forms with Google reCAPTCHA protection; confirmed via Typeform's own feature-announcement thread). Below those two tiers — which is where almost every small lead-gen operation actually sits — a bot filling out your form looks, to Typeform's counter, exactly like a person filling out your form.
Worth flagging while we're on pricing: Business and Growth Flow cap at the identical 10,000 responses a month, for $129 versus $379/mo (typeform.com/pricing). The extra money on Growth Flow buys lead enrichment, Smart Insights, and other automation features — and it also happens to be the tier where reCAPTCHA becomes available. The cheapest plan that lists reCAPTCHA at all is actually Talent, at $169/mo ($119/mo annually), but that's an HR hiring-forms product, not a general lead-gen plan (typeform.com/pricing).
Typeform users have been reporting this for years
This isn't a theoretical gap. Typeform's own community forum has multiple threads, going back to 2021, from users watching their quota disappear to bot traffic.
"First we thought we had an overwhelming response rate from respondents but it turns out that most are fake (Bots). Yet, the service was cut out as we reached our limitation."
— user Bethey, April 28, 2021 (community.typeform.com)
"I launched a new form yesterday, and I woke up this morning to almost 200 responses. But I'm pretty sure the majority of them are fake."
— user shelley.d, September 1, 2021 (community.typeform.com). A Typeform community staff member replied with a workaround: add a required question asking respondents to answer a simple math problem or retype a word — not a product fix, a manual patch.
"ALL responses were instantly filled by fake BOT responses."
— user donna.blum, November 16, 2022 (community.typeform.com). The same thread asks Typeform support whether deleting the fake responses would free up quota again, and whether support could reset the monthly count — a question that only makes sense if the answer, without someone at Typeform stepping in, is no.
These threads span 2021 to 2022 and are still among the top-ranking results for "Typeform bot responses" and similar searches in September 2026. Typeform has since shipped spam protection, but four-plus years on it is still limited to its Growth and Talent plans.
Why this keeps happening
Typeform does have a real spam-prevention feature — it's just gated. When "Advanced spam prevention" (the reCAPTCHA-based system) is switched on, flagged submissions get routed to a separate spam folder, capped at 1,000 messages per form, and don't count against your response limit (help.typeform.com — Spam prevention). That's a genuinely useful feature. The problem is where it sits: Growth Flow and Talent only.
The practical consequence: on Basic, Plus, and Business, a bot submission that gets through isn't diverted to a spam folder or excluded from your count. It's just a response, and it counts toward the same cap you're paying for.
How to tell a bot submission from a real lead
Before you can defend against bots, it helps to know what one looks like in your response data. Patterns worth checking, especially after a spike:
- Completion time. A real person takes at least several seconds to read and answer even a short form. A cluster of submissions completed in one or two seconds each is a strong bot signal.
- Timing clusters. Genuine traffic from an ad campaign arrives unevenly, spread across the hours people are awake and online. A burst of dozens or hundreds of submissions within a few minutes, especially overnight, is not organic behaviour.
- Identical or near-identical answers. Free-text fields with the same phrase, gibberish, or an obvious placeholder repeated across many responses.
- Throwaway or malformed email addresses. Random-character local parts, disposable-domain providers, or emails that don't match the name given elsewhere in the form.
- Missing referrer or UTM data. If you're tagging your ad traffic and a chunk of responses arrive with no campaign source at all, that traffic didn't come from the ad you paid for.
- No natural drop-off. Real respondents abandon partway through a multi-step form at a fairly predictable rate. A wave of submissions that all reach the final question with no partial completions in between is a sign of a script, not a person.
What a bot flood does to your account
When a form hits 100% of its response limit — bot-inflated or not — it goes into Private mode and stops accepting new responses until the monthly reset or an upgrade, with warning emails sent at the 90% and 100% marks along the way (help.typeform.com — Response limits). If that happens mid-campaign, your form is closed to real traffic you're still paying to send.
A defence playbook, ranked by effort
None of the following techniques stops every bot — bot tooling adapts, and any single layer can eventually be worked around. Used together, they meaningfully cut the volume of automated submissions that reach you. Here's how they rank, and which of them you can use on Typeform:
| Technique | Effort | Effectiveness | On Typeform |
|---|---|---|---|
| Honeypot hidden field | Low — add once, invisible to real users | Catches unsophisticated bots that fill in every field they find (Medium, Ivy Forms) | Not possible — Typeform's hidden fields are filled from the URL rather than by the visitor, so they can't act as a bot trap, and forms don't accept custom code |
| Manual verification question | Low | Blocks simple bots; adds a small amount of friction for real people; this is Typeform's own community team's suggested workaround (community.typeform.com) | Available on every plan, as a required short-text question |
| Time-to-complete check | Low | Flags submissions completed faster than a human could read the form (Formester) | No automatic time-based blocking on any plan |
| CAPTCHA (reCAPTCHA) or Cloudflare Turnstile | Low to medium | Blocks most automated submission tools when active; Turnstile is the increasingly preferred low-friction option because it doesn't require the user to solve a puzzle (Formester, Cloudflare Turnstile) | reCAPTCHA only, only on Growth ($266–379/mo) and Talent ($119–169/mo); we found no Turnstile option (help.typeform.com) |
| Email validation | Medium | Format checks and disposable-domain checks filter out throwaway addresses; doesn't stop bots using realistic-looking emails (Formester) | Basic format validation built into the Email question type on every plan; we found no built-in disposable-domain blocking |
| Rate limiting | Medium to high — needs infrastructure | Effective against a flood from a small number of sources; bots rotating IP addresses get through (Split Forms) | No user-configurable rate limiting on any plan |
A few notes on using this table. Layering honeypots, a time check, and CAPTCHA together catches a much larger share of automated submissions than any one technique alone, because each targets a different kind of bot behaviour. None of them, alone or combined, guarantees a form with zero bot traffic — the goal is cutting the volume down to something that doesn't eat your quota or pollute your lead list.
If you're staying on Typeform
If switching tools isn't on the table right now, there's still a workable stack on Basic, Plus, or Business:
- Add a required "verification" question — a simple word or number a bot script is unlikely to answer correctly — as suggested in Typeform's own community forum (community.typeform.com).
- Check submissions against the bot patterns above (completion time, timing clusters, repeated answers, missing UTM data) and delete anything that matches, on a regular schedule rather than only after you're already near your cap.
- If bot volume is consistently costing you real quota, weigh the cost of Growth Flow or Talent — the only two Typeform tiers with reCAPTCHA built in — against what that traffic is actually costing you in wasted response slots (typeform.com/pricing).
None of this is a full fix. It reduces the damage while you decide what to do next.
Why this is a paid-traffic problem, not just an annoyance
If you're running Meta or Google ads into a Typeform, bot-inflated response counts aren't just clutter in your dashboard — they're a direct hit to your ad spend. Every bot submission is a response slot you paid ad spend to fill, and on Basic through Business, it's a slot a real lead could have used instead. If a flood pushes your form into Private mode mid-campaign, as described above, the ads keep running and keep spending while the form itself has stopped accepting anyone at all (help.typeform.com — Response limits).
There's a second cost that's easier to miss: conversion data quality. If you're feeding form completions back into an ad platform as a conversion signal, bot submissions that look like conversions but aren't will distort what the platform thinks a "good" lead looks like, which affects who it targets next. Cleaning bot traffic out of your response data isn't just tidiness — it's protecting the signal you're using to spend money.
What we do differently
Formglide includes Cloudflare Turnstile bot protection on every plan, including the free plan — not gated behind a higher-priced tier. Formglide also has no hard response cap that shuts a form off: the free plan's 500 responses/mo is a soft quota, and anything collected over it is stored and unlocked the moment you upgrade, rather than discarded or blocked mid-campaign. See /pricing for the full breakdown.
Build your first form free
No credit card. 500 responses/month, forever — never shuts off.