Get the next one in your inbox.
One email when we publish something worth reading. No spam — appropriately enough, we'd know.
Honeypots alone aren't enough anymore. Here's a practical, layered approach to keeping bot submissions out of your inbox — without punishing real visitors with a CAPTCHA maze.
Get an instant summary, key takeaways, action items, and answers to your questions about this article.
Stopping form spam reliably means layering defenses rather than relying on one: automatic content/behavior scoring on every submission, an optional CAPTCHA (reCAPTCHA or hCaptcha), a hidden honeypot field, and an authorized-domains allow-list — combined, these catch the large majority of bot traffic with minimal friction for real visitors.
Form spam has gotten harder to stop with a single trick — AI-assisted bots are more convincing than they used to be. The reliable approach is layering several lightweight defenses instead of leaning on one.
Every submission should be scored on content, sender patterns, and behavior before it reaches your inbox — no configuration needed. This catches a large share of obvious spam without any setup and without ever showing a visitor a challenge.
A honeypot is a form field hidden from real visitors with CSS, but still visible to simple bots that fill in every field they can find. Real users never see it or interact with it; any submission that fills it in gets silently rejected. It's nearly invisible friction and worth having on by default.
reCAPTCHA and hCaptcha both work by challenging suspicious traffic — reCAPTCHA v3 runs invisibly and only shows a challenge when risk is high; hCaptcha is a privacy-friendlier alternative some teams prefer. Reserve visible CAPTCHA for forms genuinely under attack; applying it everywhere by default adds friction that costs real conversions.
If your form should only ever be submitted from your own site (not embedded or scraped elsewhere), an authorized-domains allow-list rejects submissions originating anywhere else. Leave it empty if you genuinely need to accept submissions from multiple sources.
None of these four layers is sufficient alone against a determined attacker, but stacked together — automatic scoring, honeypot, optional CAPTCHA, and a domain allow-list — they cover the overwhelming majority of real-world form spam with very little friction for legitimate visitors.
FormBridge runs scoring automatically on every submission and lets you turn on the other three per form under Form → Settings → Spam Protection — see the Spam protection section of the docs for the exact setup steps.
A honeypot is a form field hidden from real visitors via CSS but visible to simple bots, which often fill in every field they can find. Any submission that fills the honeypot is silently rejected as a bot.
No — it stops naive bots but not more sophisticated ones. Combining a honeypot with automatic scoring and, where needed, a CAPTCHA gives much stronger coverage.
It can, if applied indiscriminately. That's why layered approaches use lighter defenses (honeypot, scoring) first and reserve visible CAPTCHA challenges for cases that need it.
One email when we publish something worth reading. No spam — appropriately enough, we'd know.