Entry Restrictions

All plans Last reviewed November 4, 2026

Entry restrictions help you keep entries genuine and decide how often one person can enter. You can allow repeat entries up to a limit you choose, count entrants by Email Address or by Login, and add bot protection such as Google reCaptcha and Cloudflare Turnstile. Most settings are in the Form Container settings.

Allow repeat entries and still keep a limit

Each Form Container has its own Limit repeat entries setting, and it decides how many times one person can enter. Check it on every new form, because it may be set to one entry per person. Visitors who reach the limit see the message you wrote for them.

To let people enter again, and still keep a cap:

Open the Form Container settings and go to Entry Restrictions.
Choose how to tell entrants apart: by Email Address or by Login. See Email Address or Login.
Choose how many entries each person gets:
- entry every and a number of hours or days: people can enter again once that time has passed. For example, 1 entry every 24 hours gives each person a daily entry.
- A maximum of and a number: each person can enter up to that many times in total.
Write the message people see when they reach the limit, then save and exit.

To remove the limit, select None. The choices are None, by Email Address and by Login, and you can pick one at a time. With None, everyone can enter as often as they like, so pair it with bot prevention to keep entries genuine.

The changes apply to your live campaign as soon as you publish them. For the rest of the Form Container settings, see Form Container Widget.

Both choices count each person's entries. They differ in which email address they count.

	by Email Address	by Login
What is counted	The address the entrant types in your form.	The address the entrant has verified with a code.
Setup	Select by Email Address in the Form Container's entry restrictions.	Add a Login Field to the form, set up the verification email, and select by Login in the Form Container's entry restrictions.
Plan	All plans	Max plan
Use it when	You want a simple limit and don't need to confirm who entered.	You want every entrant to prove they own the address, which makes it the most dependable way to stop repeat entries from made-up addresses.

Addresses that differ only in small ways count as the same person. With by Email Address, Gmail addresses that differ only by dots share one limit. With by Login, upper and lower case, +tag endings, and Gmail dots are all ignored, so a@example.com and a+contest@example.com count as one person.

A Login Field only verifies entrants. To limit repeat entries, also select by Login in the Form Container's entry restrictions. The builder reminds you with "A Login field is required to limit entries by login." if the form has no Login Field.

Restrict via email address

Open the Form Container settings.
Go to the Entry Restrictions section.
Select by Email Address and set how many entries each person gets, for example 1 every 24 hours.

Available on Max Plan.

The Email Login method is the most dependable way to prevent fraudulent entries. Entrants verify their email with a unique code, so only addresses they can open are used.

Add a Field Widget to your Form Container.
Select Login Field from the list of fields.
In the Layout section, click the red Email Configuration Required button.
Create a new email campaign in the wizard to configure the verification email.
- Save and activate the campaign.
Customize the email campaign text.
(Optional) Configure how often an entrant must verify their email in the Verification frequency section. The default is Verify every 30 days, and any longer interval is available. Always verify, or an interval shorter than 30 days, requires your own SendGrid account connected to ShortStack. Codes are 6 digits, expire after 15 minutes, and work only once.
Close the Login Field Widget by clicking Save and Exit.
Open the Form Container settings.
In Entry Restrictions, select by Login.
Adjust the number of allowable entries per time frame, then save and exit.

Country-based visibility

Available on the Max Plan.

Restrict or display content based on the visitor’s country, using their IP address to determine location. This helps reduce spam and improve lead quality.

Steps to set country-based visibility

Open the visibility settings for the widget you want to configure.
Click All Countries to access the country picker.
Select specific countries from the dropdown:
- Click a country to add it to the Visible Countries column.
- Use the Select All button for all countries, and move selected countries as needed.

Bot prevention

Google reCaptcha

Available on Scale Plan and higher.

Enable Google reCaptcha to add a CAPTCHA to your forms or voting widgets.

Locate the Google reCaptcha setting in the Form Container or Entry Display Widget settings.
In the Restrictions section, check the box to Enable Google reCaptcha.
Adjust the Sensitivity Level slider to determine CAPTCHA strictness.
- If entrants encounter issues, move the slider left to make the CAPTCHA more lenient.

Learn How to Create Google reCaptcha Keys.

Cloudflare Turnstile

Available on Scale Plan and higher.

Cloudflare Turnstile creates a turnstile to verify whether visitors are human before they access your campaign.

Adjusting Cloudflare Turnstile settings

Access the Campaign Builder Settings (gear icon at the top of the builder).
Click the Security section.
Select one of the following options from the dropdown:
- Invisible (default): Best for embedded campaigns. Uses an invisible challenge with no interaction.
- Visible: Prompts visitors with an interactive challenge if necessary. Ideal for stand-alone landing pages.
- Disable: Turns off Turnstile (not recommended due to increased fraud risk).
For embedded campaigns, check the box to Enable if my campaign is embedded to activate Cloudflare Turnstile.

Key notes

Both Google reCaptcha and Cloudflare Turnstile are valuable tools for reducing bot entries, though no method is completely foolproof.
ShortStack engineers are continuously improving bot prevention solutions.
For best results, combine multiple restriction methods to secure your campaigns effectively.

Was this helpful?

Allow repeat entries and still keep a limit

Email Address or Login