How to protect an HTML form from spam
No single filter stops every unwanted submission. Combine low-friction controls first, measure false positives, and add interactive challenges only where the traffic justifies them.
Create a free formStart with server-side controls
Enforce the published field schema, size limits, rate limits, and file rules on the server. Browser validation improves experience but is not an abuse boundary.
A hidden botcheck field and precise allowed origins can reject simple automation with little visitor friction.
Add content and reputation signals
Use bounded heuristics and quarantine uncertain submissions for review. Record why an item was held so legitimate visitors can be recovered.
Use CAPTCHA deliberately
Configure the provider's site key in the page and keep its secret server-side. Test accessibility, expiry, failure recovery, and privacy impact before requiring it for every visitor.
Frequently asked questions
Is a honeypot enough?
No. Some bots bypass it and some legitimate tools may fill hidden controls. Use it as one layer.
Should every form use CAPTCHA?
No. Add it when measured abuse warrants the extra friction and provide a recoverable error state.