We've added Cloudflare Turnstile bot detection as an optional feature for your questionnaires. When enabled, Cloudflare runs invisible JavaScript challenges in respondents' browsers to detect automated submissions — respondents see no captcha or any other visible interaction.
Privacy note
When bot checks are active on a questionnaire, Cloudflare receives the respondent's IP address, TLS fingerprint, and browser User-Agent string for bot scoring purposes. No questionnaire response content is shared. If you have any questions, please contact support@maptionnaire.com.
US Customers
If you are a US-based customer, you can turn this on yourself by following these steps:
- Open the menu on the top right.
- Select Manage teams.
- Click the team name.
- Toggle on "Allow bot checks".
-
You can then enable it per questionnaire in its Settings...
-
or set it on by default for all new questionnaires (note that it won't be automatically turned on for surveys that were already created, you'll need to follow #5 for them).
Customers outside the US
This feature is available to you at no extra cost. Because enabling it involves transferring respondent data (IP address, TLS fingerprint, and browser User-Agent string) to Cloudflare in the United States, activating it requires a separate contract addendum to cover the data transfer. If you're interested, please contact support@maptionnaire.com.
Bot checks for comments on Project Pages and participatory projects
Bot checks (Cloudflare Turnstile) can also be enabled for comments on Project Pages and on participatory project idea pages, not just for questionnaire responses.
- Project Pages: turn on the switch in the page's settings, in the Interactivity tab.
- Participatory projects: turn on the switch in Project Settings, in the General tab.
The switch only takes effect when Allow bot checks is turned on for your team. See the steps above.
How the bot checks show in survey data:
Analysis tool
You will be able to filter out all respondents that have been flagged as probable bots.
You can click on an individual map response and see a symbol of whether it has been flagged as a probably bot entry or not.
In the xslx and geoJSON output
Other ways to limit duplicate or unwanted responses
Bot detection works well together with Allow only one respondent per device+browser, which is on by default and lets each respondent return to their own answers instead of starting a new submission. If people share a device, for example a tablet at an event, use a reset link so each new person starts fresh.
For stricter control over who answers, you can also require respondents to register and log in, or send each respondent or group a unique link.