How to protect your contact form from spam
Bots auto-fill any form they find. You can stop them without an annoying CAPTCHA: an invisible trap field (honeypot), a timing check and, if needed, a discreet CAPTCHA. Here are the methods, in the order we recommend.
You get spam in your contact form because automated bots scan the page's code, find the fields, fill them in themselves and hit "Send" — they don't need anyone to actually see the form. The good news: you can stop them without an annoying CAPTCHA. For an ordinary site, the best combination is an invisible trap field (honeypot) plus a timing check, and you only add a CAPTCHA if it's genuinely still needed.
Why you get spam, exactly
It isn't personal and you did nothing wrong. Bots crawl the internet day and night, open pages at random and, whenever they hit a `<form>`, they auto-fill it with text and links. Their goal is to slip ads, links to dodgy sites or phishing attempts straight into your inbox. It doesn't even matter that you hid your email address: the message goes through the form, not the address. Which leads to a simple conclusion — protection belongs on the form, not on keeping your contact details secret.
Honeypot: the invisible trap (first line of defence)
A honeypot is an extra field you hide with CSS, so a human never sees or fills it. The bot, on the other hand, blindly fills everything it finds — including the hidden field. If that field comes back filled, you know for certain it's a bot and you discard the message silently.
What makes it our favourite method:
- Free — it doesn't depend on any external service.
- Completely invisible to the real customer: zero clicks, zero friction.
- Easy to add to any kind of site.
One important detail: give the field a plausible name (for example "website" or "company") and hide it with `position:absolute; left:-9999px` or `opacity:0`, not with `type="hidden"` — good bots ignore the latter. The honeypot stops the vast majority of automated spam, but not quite all of it, so we reinforce it.
The timing check: the second silent filter
A human needs a few seconds to read and type into a form. A bot fills it instantly. If you record when the page loaded and when it was submitted, you can reject anything that arrives in, say, under 2–3 seconds. It's an invisible barrier with no cost to the real visitor, and it catches exactly the fast bots a honeypot would miss.
CAPTCHA: only if it's genuinely needed
CAPTCHA comes with a real trade-off: the more you demand of the visitor, the more people give up. That's why we don't add it by reflex. If you do end up needing it, choose a discreet variant:
| Solution | How it feels for the customer | When we use it |
|---|---|---|
| Honeypot | Invisible, zero actions | Almost always, as the base |
| Timing check | Invisible, zero actions | Alongside the honeypot |
| reCAPTCHA v3 / Turnstile | Runs in the background, rarely asks anything | High traffic or persistent spam |
| Classic CAPTCHA (images/text) | Frustrating, raises abandonment | Practically never |
reCAPTCHA v3 and Cloudflare Turnstile run in the background and only ask for an action when the behaviour looks suspicious. In the vast majority of cases, the real customer sees and does nothing.
What we recommend, in short
Go in steps, don't put it all in at once:
1. Honeypot + timing check — covers an ordinary presentation site without bothering anyone.
2. Add an invisible CAPTCHA only if spam still gets through or your traffic is high.
3. Don't stack three barriers from the start — you complicate the experience for nothing and lose real leads.
It's worth it especially if the form is your main source of enquiries: a form full of junk makes you miss the real messages buried among it.
A clean form supports everything else: if you want to understand why you need a website and what it would cost, we have a guide on how much a website costs. And if you want people to actually find you, read about local SEO.
At MPO Web Studio we set up anti-spam protection on every form we build — invisible to your customer, only annoying for the bots. Want a free, no-obligation demo? Message us on WhatsApp: wa.me/40750257140.
Frequently asked questions
Why do I get spam if I never published my email address anywhere?+
Bots don't need your address. They scan the page's HTML, find the form fields, auto-fill them and hit "Send". You weren't targeted personally — they crawl thousands of sites a day. That's why protection belongs on the form itself, not on keeping the address secret.
Does a honeypot actually work, or have bots learned to skip it?+
A simple honeypot stops the vast majority of automated bots, which blindly fill every field. More advanced bots can bypass it, which is why we pair it with a timing check and, at high volume, an invisible CAPTCHA. As a first line of defence it's still the best choice: free and completely invisible to the real visitor.
Will a CAPTCHA scare off my real customers?+
Old CAPTCHAs with traffic-light photos and distorted text, yes — they raise abandonment. That's why we recommend invisible variants (reCAPTCHA v3, Cloudflare Turnstile) that run in the background and only ask for an action if the behaviour looks suspicious. In most cases the real customer sees and does nothing.
How many methods do I need to be covered?+
For an ordinary presentation site, a honeypot plus a timing check is enough in most cases and bothers no one. Add an invisible CAPTCHA only if spam still gets through or your traffic is high. Don't stack three barriers from the start — you complicate the experience for nothing.
Doesn't my email spam filter already solve this?+
Only partly. The filter moves unwanted messages to another folder, but the form still sends them, fills your database, can trigger notifications and, if you use a sending service, eats into your quota. It's healthier to stop spam before it's sent, right at the form level.
7 mistakes that drive clients away from your website
Leave your email and get the guide right here, instantly. No spam.
Want to see what your business's website could look like?
Message us on WhatsApp and we'll prepare a FREE demo website with your business name. See it first — decide after.