Why is Zoho forms not working: bot checks

A public form runs protections every time someone submits it. A bot challenge can appear when a browser looks new or unusual, and it may ask for picked images or a tick box that a small screen or a privacy setting makes hard to complete. A rule that rejects a second entry with the same address can answer a repeat submission with an error that reads like a failure. You may never see any of this when you submit from your own dashboard, so the form can look finished on your side and stop a stranger on the public page.

• The public link in a private window, submitted once, with no owner login.
• Any bot challenge that appears after the submit press, and whether a phone can finish it.
• The exact error text after a second submission with the same details.
• Required fields the visitor cannot see, which the form checks before it sends.
• Whether the builder's preview behaves like the public address. Treat the public link as the test.

The trouble usually starts after the last field. When a visitor presses submit, the form can run checks before it saves anything: a challenge that asks the visitor to prove they are a person, a comparison with earlier entries, and the required-field rules. Each one can stop the send with a different screen, and the visitor often sees only that nothing happened. Your preview is not the stranger's view, so a form can look finished from your side.

Find the check by reproducing the stranger's path. Open the public link in a private window with no owner login, fill it with plain answers, and submit once. Then submit again with the same details and read the message. A challenge that appears at submit points at a bot check. An error on the second submission points at a repeat-entry rule. A stop with no message at all points at a required field the visitor cannot see.

A bot challenge is meant to slow automated traffic, and it also stops real people when it is hard to finish. Image puzzles and tick boxes that depend on a background check can fail on a small screen, in a browser that blocks third-party scripts, or after a privacy setting has cleared the check's history. The visitor is a real person who cannot get through, and the form records that as a failure.

Decide what the challenge protects before you change it. A form that gets spam from strangers may need one, and removing it can bring junk entries back. Test the challenge on a phone in a private window with extensions off. If a real visitor cannot finish it, a simpler check is usually the better trade, as long as the form still stops the spam you care about.

A simulated visitor fills the public form, presses submit, and reads whatever appears next. If a challenge stops it, the run reports the challenge as the step and marks the visit as blocked by the site, not as a visitor who gave up. That label matters. It tells you the site stopped the test, so the result is a finding about the check and not a judgment about the form's fields.

Run the public link again after changing the challenge, the repeat-entry rule or a required field, and keep one phone visitor in the set. The run cannot pass a bot challenge, so it will show that step as blocked. Write down the step each run stops on so the results compare. It does not read your Zoho account, and it does not show whether a submission reached your records.

Protections get added after a spam wave, a campaign brings new traffic, or a team edits the form and turns on a stricter check. Each change can stop real visitors at a step your dashboard preview never shows. Rerun the public link after each one, from a private window and a phone, and compare the step the run stops on with the step you expected.