How to Stop Form Spam Without CAPTCHA

CAPTCHA is a tax on your real visitors. It adds friction, hurts accessibility, and modern bots solve image challenges more reliably than some humans. For most forms you can stop the overwhelming majority of spam without ever showing a puzzle.

The Honeypot Trick

A honeypot is a hidden field that real people never see and never fill in. Bots fill in every field they find, so a filled honeypot is a near-certain sign of automation. The submission gets flagged as spam and quietly stored without triggering a notification — the bot thinks it succeeded and moves on.

<input name="_gotcha" style="display:none" tabindex="-1" autocomplete="off">

Because the field is hidden with CSS, your visitors never interact with it and never even know it exists.

Rate Limiting

The second layer is per-IP rate limiting. A real person submits a contact form once, maybe twice. A spam script hammers it dozens of times a minute. Capping submissions per IP per hour blocks floods without affecting anyone legitimate.

Origin Allowlisting

If your form should only be submitted from your own domain, an origin allowlist rejects posts that come from anywhere else. Spammers who scrape your endpoint and post from their own servers get turned away.

Layered, Not Perfect

No single technique catches everything, but honeypot plus rate limiting plus origin checks removes nearly all automated spam invisibly. Your visitors get a clean form, and you get a clean inbox — no puzzles required.

---

Bluejay Forms includes a honeypot, per-IP rate limiting, and origin allowlisting on every form. Try it free.