Built-in time-trap
Every form has a built-in time-trap: submissions that arrive impossibly fast after the form loads are treated as bots and silently dropped. This works automatically, with nothing to configure.
CAPTCHA
For stronger protection you can enable a Cloudflare Turnstile CAPTCHA per workspace by adding your site and secret keys. The secret key is stored encrypted. Turnstile is privacy-friendly and usually invisible to real visitors.