Add gobwebs-formguard to the public forms. So I think this includes:
If there are other forms accessible by the unauthenticated then add it there too.
It's already on registration. Not on login, forgot password.