--- title: "How to Stop Form Spam Without a CAPTCHA" slug: stop-form-spam description: "Honeypots, timing checks, and rate limits stop most automated form spam without asking real people to identify traffic lights. What works, what doesn't, and in what order." publishedAt: "2026-08-15" author: "Instaform Team" tags: ["forms", "guide", "conversion"] locale: en --- Form spam has an obvious fix that nobody likes: add a CAPTCHA. It works, and it costs you real submissions — studies consistently show measurable abandonment when one is added, concentrated among mobile users and people with accessibility needs. The better approach is to make automated submission unattractive without asking humans to prove anything. Most form spam is not targeted; it is a script filling every form it finds. Defences that raise the cost slightly are enough to redirect it elsewhere. ## Start with a honeypot Add a field that humans never see and bots reliably fill. Position it off-screen with CSS, mark it `aria-hidden`, give it a plausible name like `email_confirm`, and reject any submission where it has a value. This single technique stops a large share of unsophisticated bots, costs nothing in conversion, and is invisible to real users. The important detail is hiding it with CSS rather than `type="hidden"` — scripts often skip genuinely hidden inputs but happily fill visible-in-the-DOM ones. Every Instaform form includes a honeypot by default, which is why the [contact form template](/templates/contact-form-template) does not ship with a CAPTCHA. ## Add a timing check Humans take time to fill a form. Scripts do not. Issue a signed token when the form renders, check the elapsed time on submit, and reject anything completed in under two or three seconds. Sign the token rather than trusting a timestamp from the client, or you have added a field the bot can simply set. The signature is what makes this work — without it, timing is a suggestion. Together, honeypot plus timing removes the overwhelming majority of automated volume. Most sites can stop here. ## Rate limit by IP and by form If the same address submits eleven times in a minute, that is not a person changing their mind. Rate limiting is straightforward server-side and catches the case where a script has been pointed specifically at you. Be careful with thresholds on forms used from offices or schools, where many genuine users share an address. Per-form limits are usually safer than per-site. ## Do not rely on email validation Rejecting addresses that fail a regex catches almost nothing — spam scripts use syntactically valid addresses. Disposable-domain blocklists are more useful but need maintenance and produce false positives for people who legitimately use forwarding services. Validate to help users catch typos, not to stop spam. They are different problems. ## When you actually need a CAPTCHA There are cases: forms that trigger something expensive, high-value targets that attract manual abuse, or a spam problem that survives everything above. In those cases use an invisible challenge that only escalates on suspicion rather than one that greets every visitor. Treat it as an escalation, not a default. Adding one at the start costs you submissions before you know whether you had a problem. ## Measure before and after The reason this ordering matters is that spam is visible and lost submissions are not. A CAPTCHA that eliminates twelve spam messages a week and quietly costs you three real enquiries looks like a success in the inbox and a failure in the pipeline. If your submissions land as structured records rather than email, this is easy to check: compare submission volume for the fortnight before and after any change. Instaform records every submission as a Contact with its source, so the count is a filter rather than an inbox estimate — see [lead generation](/use-cases/lead-generation) for how that record is used afterwards. ## The order to apply them 1. **Honeypot** — free, invisible, stops most of it. 2. **Signed timing check** — free, invisible, stops most of the rest. 3. **Rate limiting** — cheap, catches targeted scripts. 4. **CAPTCHA** — only if the first three genuinely failed. Most sites never reach step four. The ones that do should be able to point at the data that made it necessary.