Captcha protects your form from bots and automated submissions. Without it, a public form on a busy real estate site will pick up junk traffic within days. The form builder uses Google reCAPTCHA behind the scenes, and Form Settings gives you three modes to pick from. Each mode trades off some friction for some protection.
Auto (recommended). This is the default and the right pick for almost every form. Invisible reCAPTCHA runs in the background on every submission. Real visitors never see a thing. Only suspicious traffic gets challenged — the "pick all the squares with traffic lights" puzzle most people know.
Always show challenge. Every visitor sees the puzzle, every time. Use this only if you're under active bot attack and Auto isn't catching enough. The cost is real — conversion drops noticeably when every lead has to solve a puzzle to submit.
Disabled. No captcha at all. Use only on internal forms that sit behind a login, or short term while you're debugging something. Public forms with captcha disabled will fill up with spam.
The captcha keys come from your platform settings. You don't enter a site key on each form. If your platform reCAPTCHA isn't set up yet, captcha falls back to the platform default — so there's nothing extra to do per form.