How to Stop Contact Form Spam Without a CAPTCHA

Short answer: use three invisible layers — a honeypot field, a minimum time-to-submit check, and server-side content filtering. Together they remove most automated submissions and cost real visitors nothing. A visible CAPTCHA works too, but it costs genuine conversions, so it belongs after the invisible layers have failed rather than instead of them. As of August 2026 spam filtering is included on every BotForms plan, starting at $29/month.

Form spam is a nuisance that gets solved badly. The instinctive fix — add a CAPTCHA — works against bots and also works against the customers you built the form for. This post is about the layers that only affect the bots.

Why the reflex to add a CAPTCHA is wrong

A CAPTCHA is a tax on every visitor to stop a minority of them. That trade is sometimes right. It is rarely right on a contact form.

Every step between intent and submission costs you some proportion of submissions. An image challenge is not a small step: some people fail it and retry, some abandon rather than attempt it, and screen reader users hit genuine accessibility barriers. The cost lands hardest on mobile, where the challenges are fiddliest, and on older visitors — which for a lot of service businesses is a meaningful part of the customer base.

Meanwhile the spam it stops costs you almost nothing directly. It is annoying. It is not expensive. The expensive part is what spam does to your measurement, which we come back to below, and filtering fixes that just as well as blocking does.

So the ordering matters: make the cheap invisible defences work first, and hold the visible challenge in reserve for a form that is genuinely under sustained attack.

Layer one: the honeypot

Add a form field that no human will ever see, and reject any submission that fills it.

The mechanics matter slightly. Hide it with off-screen positioning or zero opacity rather than display: none alone, because some scripts check for the obvious hidden styles and skip those fields. Give it a plausible name — company_url or fax — since a field called honeypot is not much of a trap. Set autocomplete="off" and tabindex="-1" so a keyboard user tabbing through never lands in it and a password manager never autofills it.

Then reject silently. Return the same success response you would for a real submission. Telling a bot it failed just teaches whoever wrote it to adapt.

This catches the low end of the spectrum: scripts that find a form, fill everything, and submit. That is a large share of the volume and none of the effort.

Layer two: the time check

Record when the form was rendered and compare it to when it was submitted. A human reading a contact form and typing a message takes at minimum several seconds. A script takes milliseconds.

A threshold of about three seconds rejects almost nothing genuine. If you want a wider margin, set it lower rather than higher — the failure mode of an aggressive threshold is rejecting someone who prepared their message elsewhere and pasted it in, which is exactly the well-prepared enquiry you least want to lose.

The implementation detail people get wrong is putting the render timestamp in a plain hidden field, where anything can rewrite it. Sign it or store it server-side against a token. An unsigned timestamp is a suggestion, not a check.

This layer catches the middle of the spectrum: scripts sophisticated enough to skip a honeypot but not patient enough to wait.

Layer three: content filtering

The remaining spam looks like a form submission because it is one — submitted by something that behaves plausibly. Now you have to look at what was actually said.

The reliable signals, roughly in order of how well they hold up:

Links in short free-text fields. A genuine enquiry occasionally includes a URL. A name field containing one, essentially never.

The same value repeated across every field. Name, company, message all identical is not a person.

Language mismatch. If you serve one metro area and the message is in a language you have never had an enquiry in, that is worth flagging — flagging, not deleting, because occasionally it is a real customer.

Volume from one source. Six submissions in a minute is a script regardless of what each one contains.

Field-appropriateness. A phone field containing prose. An email field with a disposable domain you have never had a genuine customer from.

The important design decision here is what happens on a match. Quarantine, do not delete. Move it to a filtered view, do not notify, but keep it. Content filtering is the layer most likely to produce a false positive, and a quarantine means the cost of being wrong is that someone finds the enquiry a day late rather than never.

What each layer catches

Layer	Catches	Cost to real visitors	Effort
Honeypot	Naive fill-everything scripts	None	Minutes
Time check	Scripts that skip hidden fields	Effectively none	Under an hour
Content filtering	Plausible-looking automated junk	Occasional false positive, mitigated by quarantine	Ongoing tuning
Invisible scoring (reCAPTCHA v3)	Behavioural anomalies	Third-party script, privacy disclosure	Moderate
Visible CAPTCHA	Nearly everything automated	Real, measurable conversion loss	Low effort, high cost

Work down the table and stop when the spam stops. Most forms never reach row four.

If you are on a hosted form platform, the first three layers should already be running without you configuring anything — on BotForms they are included on every plan, including Starter. If you built your own endpoint on a static site, they are yours to implement, and the static-site form backend guide covers where that responsibility sits.

The real cost of spam is measurement, not annoyance

This is the part that justifies the work, and it is not the inbox clutter.

Spam inflates your submission count. A landing page converting at what looks like 4% might be converting at 2.5% with the rest being junk — and 4% looks acceptable, so nobody investigates. You lose the signal that would have told you the page needs work. That is a far more expensive problem than deleting emails.

It also slows your response to real enquiries, because a genuine lead sitting between two pieces of junk gets triaged with them. Response speed is the single strongest predictor of whether a form-sourced lead converts, and burying leads directly damages it — the mechanics are in the speed-to-lead notification comparison.

So the case for filtering is: your conversion rate becomes true, and your response time stops being sabotaged by noise. Both of those are worth more than the deleting. If you want to check whether your own numbers are being distorted, which form metrics actually matter walks through pulling a clean figure.

What not to do

Do not remove the form. People reach for this after a bad week. Replacing a contact form with an email address reliably costs more genuine enquiries than the spam ever cost you, because a mailto: link is a much worse experience on mobile and a lot of people simply will not use it.

Do not obfuscate the email address instead. Same problem, plus it breaks for anyone without a configured mail client.

Do not block by IP. Automated submissions rotate addresses, and you will eventually block a shared corporate NAT with a real customer behind it.

Do not add more required fields as a deterrent. It does deter bots slightly. It deters humans considerably more, and you have made your form worse to solve a problem that filtering solves for free. The general point about over-collection is in our piece on what AI gets wrong when it writes form questions — over-collection is the most common form design error whatever the cause.

Searching for help on this is confusing, and here is why

If you go looking for advice on this you will hit the phrase "bot form" constantly, meaning different things in different results. It is used for chat-style forms that ask one question at a time, for forms built by AI from a description, and for the automated scripts attacking your form. Three unrelated concepts, one phrase — we untangled them in what a bot form actually is, which is worth two minutes if you are getting contradictory search results.

A reasonable target

You will not reach zero, and chasing zero is where you start damaging real conversions. A well-filtered public form still lets a few plausible submissions through in a month.

The right target is: no notification for anything obviously automated, everything questionable held in a quarantine view someone glances at weekly, and a submission count you can trust for measurement. That is achievable with the three invisible layers and no CAPTCHA.

Spam protection is on every BotForms plan — see features for what is included, pricing for plan limits, or start a 30-day trial and point an existing form at it to see what your current filtering is missing.