Honeypot vs CAPTCHA: which is better for form spam prevention?

Form spam prevention comes down to distinguishing humans from bots. Two primary techniques exist: honeypot fields and CAPTCHA challenges. Each has different tradeoffs between effectiveness and user experience.

This guide compares them in detail and explains when to use each.

What is a honeypot field?

A honeypot is a hidden form input that legitimate users never see or interact with. Automated bots that crawl the web and fill in every field they find will populate the honeypot, revealing themselves.

1
<input
2
  type="text"
3
  name="botcheck"
4
  style="position: absolute; left: -9999px; opacity: 0;"
5
  tabindex="-1"
6
  autocomplete="off"
7
/>

When the form is submitted, the server checks if the honeypot field has a value. If it does, the submission is from a bot and is rejected.

How bots find honeypots

Sophisticated bots can detect honeypots by:

• Checking for CSS properties that hide elements (opacity: 0, left: -9999px)
• Checking if the element is visible in the viewport
• Checking tabindex="-1" which removes the field from tab order
• Checking for common honeypot field names (botcheck, honeypot, website_url)

Making honeypots harder to detect

Use multiple hiding techniques and non-obvious field names:

1
<input
2
  type="text"
3
  name="company_website"
4
  style="position: absolute; left: -9999px; opacity: 0; height: 0; width: 0; overflow: hidden;"
5
  tabindex="-1"
6
  autocomplete="off"
7
  aria-hidden="true"
8
/>

The field name company_website looks like a legitimate field that bots would fill in.

What is a CAPTCHA?

A CAPTCHA (Completely Automated Public Turing test to tell Computers and Humans Apart) presents a challenge that humans can solve but bots cannot.

Types of CAPTCHA

Cloudflare Turnstile

Turnstile is the recommended CAPTCHA for modern forms:

1
<div class="cf-turnstile" data-sitekey="YOUR_SITE_KEY"></div>
2
<script src="https://challenges.cloudflare.com/turnstile/v0/api.js" async defer></script>

• Privacy-friendly (no cross-site tracking)
• Often resolves without showing any challenge
• No Google account required
• Free for all sites

Google reCAPTCHA v3

reCAPTCHA v3 assigns a score to each visitor based on behavior:

1
<script src="https://www.google.com/recaptcha/api.js?render=YOUR_SITE_KEY"></script>
2
<script>
3
  grecaptcha.ready(function () {
4
    grecaptcha.execute("YOUR_SITE_KEY", { action: "submit" }).then(function (token) {
5
      document.getElementById("recaptchaToken").value = token;
6
    });
7
  });
8
</script>
9
<input type="hidden" id="recaptchaToken" name="g-recaptcha-response" />

• Invisible (no user interaction)
• Score-based (0.0 = bot, 1.0 = human)
• Requires Google tracking
• Requires server-side token verification

Google reCAPTCHA v2

The familiar “I’m not a robot” checkbox with image puzzles:

1
<div class="g-recaptcha" data-sitekey="YOUR_SITE_KEY"></div>
2
<script src="https://www.google.com/recaptcha/api.js" async defer></script>

• High friction (image puzzles frustrate users)
• Very effective against bots
• Requires Google tracking

Head-to-head comparison

When to use a honeypot

Use a honeypot on every form, always. It costs nothing in user experience and catches the majority of basic bot submissions.

Best for:

• Low-traffic forms (contact, newsletter signup)
• Forms where user friction must be absolutely zero
• First line of defense on any form

When to use a CAPTCHA

Add a CAPTCHA when:

• Your form receives more than 100 submissions per day
• You notice spam getting through the honeypot
• The form is on a high-visibility page (homepage, pricing page)
• You need to block human spammers (not just bots)

Best CAPTCHA choice by scenario:

Combining both for maximum protection

The optimal setup uses both techniques together:

1
<form action="https://api.formsfort.com/submit" method="POST">
2
  <input type="hidden" name="access_key" value="YOUR_ACCESS_KEY" />
3

4
  <!-- Honeypot: catches basic bots -->
5
  <input
6
    type="text"
7
    name="company_website"
8
    style="position: absolute; left: -9999px; opacity: 0;"
9
    tabindex="-1"
10
    autocomplete="off"
11
  />
12

13
  <!-- Form fields -->
14
  <label for="name">Name</label>
15
  <input type="text" id="name" name="name" required />
16

17
  <label for="email">Email</label>
18
  <input type="email" id="email" name="email" required />
19

20
  <label for="message">Message</label>
21
  <textarea id="message" name="message" required></textarea>
22

23
  <!-- CAPTCHA: catches sophisticated bots and humans -->
24
  <div class="cf-turnstile" data-sitekey="YOUR_TURNSTILE_KEY"></div>
25
  <script src="https://challenges.cloudflare.com/turnstile/v0/api.js" async defer></script>
26

27
  <button type="submit">Send message</button>
28
</form>

This layered approach catches:

• Basic bots (honeypot)
• Sophisticated bots (CAPTCHA)
• Human spammers (CAPTCHA)

Add domain restriction and rate limiting on the server side for a complete defense.

Accessibility considerations

Honeypot accessibility

A properly implemented honeypot does not affect accessibility:

• tabindex="-1" removes it from keyboard navigation
• aria-hidden="true" hides it from screen readers
• Off-screen positioning means it is not announced

CAPTCHA accessibility

CAPTCHAs can be problematic for users with disabilities:

• Image puzzles are difficult for visually impaired users
• Audio alternatives exist but are often poor quality
• Time limits can be challenging for users with motor disabilities

Turnstile and reCAPTCHA v3 are preferred because they often resolve without any user interaction. When a challenge is shown, provide alternative contact methods (email, phone) for users who cannot complete it.

Summary

Honeypots and CAPTCHAs serve different roles in spam prevention. Honeypots are a zero-friction first line of defense that catches basic bots. CAPTCHAs provide stronger protection against sophisticated bots and human spammers but add some user friction. Use a honeypot on every form. Add Cloudflare Turnstile for medium and high-traffic forms. Combine with domain restriction and rate limiting for comprehensive protection.