How to stop form spam: 7 proven methods compared

Form spam is a universal problem. Every publicly accessible form on the web is targeted by bots that submit links, phishing content, scraped data, or test stolen payment information. No site is too small to be targeted.

This guide compares seven proven anti-spam methods, explains how each works, and recommends the best combination for different scenarios.

Method 1: Honeypot field

A honeypot is a hidden form field that legitimate users never see. Bots that fill every field they find will populate it, revealing themselves as automated.

Implementation:

1
<input
2
  type="text"
3
  name="botcheck"
4
  style="position: absolute; left: -9999px; opacity: 0;"
5
  tabindex="-1"
6
  autocomplete="off"
7
/>

How it works: The field is positioned off-screen using CSS (not display: none or type="hidden", which bots check for). If the field has a value on submission, it is a bot.

Effectiveness: Catches 70-80% of basic bots. Essential first layer.

Method 2: CAPTCHA challenge

CAPTCHAs present a challenge that humans can solve but bots cannot.

Options:

Implementation (Turnstile):

1
<div class="cf-turnstile" data-sitekey="YOUR_SITE_KEY"></div>
2
<script src="https://challenges.cloudflare.com/turnstile/v0/api.js" async defer></script>

Effectiveness: Catches 95%+ of bots when configured properly. Best for high-traffic forms.

Method 3: Domain restriction

Restrict form submissions to only come from your website domain.

How it works: The form backend checks the Origin or Referer header on each submission and rejects requests from other domains.

Effectiveness: Prevents other sites and scripts from using your form endpoint. Essential for all forms.

Method 4: Rate limiting

Limit the number of submissions per IP address within a time window.

How it works: The form backend tracks submissions by IP and rejects requests that exceed the threshold (e.g., 5 submissions per hour per IP).

Effectiveness: Essential defense against flood attacks. Works best combined with other methods.

Method 5: Time-based checks

Reject submissions that happen too quickly after page load.

How it works: Record when the page loaded and compare it to the submission time. Bots typically submit forms within milliseconds of loading the page.

1
<input type="hidden" name="_timestamp" value="" />
2
<script>
3
  document.querySelector('input[name="_timestamp"]').value = Date.now();
4
</script>

The server rejects submissions where the elapsed time is under a threshold (e.g., 3 seconds).

Effectiveness: Catches automated bots that submit instantly. Good supplementary layer.

Method 6: Email validation and disposable email blocking

Reject submissions from disposable or temporary email addresses.

How it works: The form backend checks the submitted email domain against a list of known disposable email providers (mailinator.com, guerrillamail.com, etc.).

Effectiveness: Useful for lead generation forms where email quality matters.

Method 7: Content filtering

Scan submission content for known spam patterns.

How it works: Check field values for common spam indicators: excessive URLs, known spam phrases, non-Latin characters in English-only forms, or content that matches known spam templates.

Effectiveness: Useful as a supplementary filter for forms that receive human spam.

Recommended combinations

Low-traffic site (under 1,000 visits/month)

• Honeypot field
• Domain restriction
• Rate limiting

This combination catches 95%+ of spam with zero user friction.

Medium-traffic site (1,000-10,000 visits/month)

• Honeypot field
• Domain restriction
• Rate limiting
• Cloudflare Turnstile (invisible mode)

Turnstile in managed mode only shows a challenge when suspicious activity is detected, so most real users see nothing.

High-traffic site (10,000+ visits/month)

• Honeypot field
• Domain restriction
• Rate limiting
• Cloudflare Turnstile (managed challenge)
• Time-based checks
• Disposable email blocking

Maximum protection with minimal friction.

Summary

No single anti-spam method is sufficient on its own. Start with a honeypot field and domain restriction on every form. Add rate limiting for all production forms. Layer on CAPTCHA (preferably Turnstile) for medium and high-traffic sites. Use time-based checks and content filtering as supplementary defenses. A form backend service like FormsFort implements all of these layers automatically.