Bot protection

A honeypot field and per-email and per-IP limits are always on, which stops the overwhelming majority of automated abuse without asking real shoppers to do anything. For an extra layer, add Google reCAPTCHA v3 keys under Settings → Bot Protection. v3 scores visitors invisibly, so there is nothing for a shopper to click and nothing to style.

Google's script is fetched only when a visitor opens the wheel, or starts filling in the inline wheel's form, not on every page the popup could open on. The form then carries Google's own sentence about reCAPTCHA, with links to its privacy policy and terms, which Google allows in place of its badge, so the badge is hidden rather than sitting over a bottom-right launcher. A Google font chosen under Font is fetched at the same moment for the popup, and with the page for the inline wheel, which is on show from the start.