Framer's form spam protection (Basic/Advanced Antispam) accepts every submission first, then classifies it afterward — there's no way, on any plan, to reject a submission that lacks valid verification before it's accepted. This means any request posted directly to a form's endpoint, bypassing the actual page, skips every spam layer entirely, including third-party CAPTCHA/Turnstile marketplace components — none of them can gate acceptance at Framer's backend.

I confirmed this directly across three separate Framer sites:

Basic Antispam set to Block — spam still landed

Added a marketplace slider CAPTCHA — spam still landed (bypasses the actual page, so the component never runs)

Added Cloudflare Turnstile via the same marketplace component — spam still landed, for the same reason

Requested fix: native reCAPTCHA or Cloudflare Turnstile integration where Framer's backend verifies the token server-side and rejects the submission outright if it's missing or invalid — not scored and possibly delivered anyway. This is standard on other form platforms (Formspree, for example, does the full server-side token exchange itself). Without it, form spam protection on Framer is fundamentally client-side only and can be bypassed by any bot that skips loading the page.

Happy to provide more detail on the testing if useful.