How to Protect HTML Forms From Spam

Put a form on the internet and within days bots will find it. Suddenly your inbox fills with fake messages, SEO pitches and links you'd never click. The instinct is to slap a CAPTCHA on everything — but puzzles frustrate real people and cost you genuine enquiries.

The better approach is layered protection: several invisible defences that stop most bots, with a visible challenge only when you really need it.

Know your enemy: types of form spam

• Simple bots crawl the web and fill every field they find. Most spam is this kind — and it's the easiest to stop.
• Smarter bots run real browsers, execute JavaScript and can skip obvious traps.
• Human spammers paste promotional messages by hand. No technical trick stops them completely, but filtering and rate limits reduce the volume.

Layer 1: A honeypot field

A honeypot is a field humans never see but bots fill in. If it has a value, the submission is spam.

<form action="https://api.formclick.io/submit" method="POST">
  <input type="hidden" name="access_key" value="YOUR_ACCESS_KEY">

  <!-- Honeypot: hidden from people, irresistible to bots -->
  <input type="checkbox" name="botcheck" class="hp" tabindex="-1" autocomplete="off">

  <!-- your real fields -->
</form>

<style>
  .hp { display: none; }
</style>

• tabindex="-1" keeps keyboard users from tabbing into it.
• autocomplete="off" stops browsers auto-filling it.
• Formclick discards any submission where botcheck is ticked.

Honeypots are invisible, free and stop a large share of automated spam. Read more in What Are HTML Forms? for how hidden fields work.

Layer 2: Server-side filtering

Never rely only on the browser — bots can post directly to your endpoint without loading your page. Server-side checks catch what the honeypot misses:

• Content filtering for typical spam patterns and link-stuffed messages.
• Duplicate detection for the same message sent again and again.
• Validating that required fields exist and look sensible.

Formclick runs spam filtering, rate limiting and duplicate detection on every plan. Suspected spam goes to a separate Spam tab instead of your inbox — so a false positive is never lost.

Layer 3: Rate limiting

Real people submit a contact form once. Bots submit hundreds of times. Limiting how many submissions can come from one source in a short period stops floods without affecting anyone genuine. If you run your own backend, rate-limit by IP address and by form.

Layer 4: Restrict submissions to your domain

Your form's endpoint and access key are visible in your page source. Domain restrictions make the service reject submissions sent from any other website. In Formclick, add your domains under the form's Settings → Security (Starter plan and above); each domain covers its subdomains.

Layer 5: A CAPTCHA — only if spam still gets through

If invisible layers aren't enough, add a challenge. Today's options are much less painful than the old "type these wobbly letters" puzzles:

Option	User experience	Notes
Cloudflare Turnstile	Usually invisible or one click	Privacy-friendly, free
Google reCAPTCHA v3	Invisible; returns a score	You choose the threshold
Google reCAPTCHA v2	"I'm not a robot" checkbox, sometimes image puzzles	Most familiar to users
hCaptcha	Checkbox, sometimes puzzles	Privacy-focused alternative

On Formclick's paid plans you can turn on Google reCAPTCHA (v2 or v3) or Cloudflare Turnstile in your form's Security settings — Formclick verifies the token on the server for you.

Smaller tricks that help

• Require a message length with minlength — many spam bots send one-word junk.
• Use specific field types (type="email") so malformed data is rejected early.
• Avoid obvious field names for honeypots like "honeypot" — some bots skip them.
• Don't publish your email address in plain text next to the form.

What not to do

• Don't put a CAPTCHA on every form by default. Measure first.
• Don't silently delete suspected spam. Quarantine it so real messages caught by mistake can be recovered.
• Don't rely on JavaScript-only checks. Bots can skip your page entirely.
• Don't hide the honeypot with type="hidden". Bots know hidden inputs aren't meant to be filled; a visually hidden checkbox or text field works better.

A recommended setup

1. Honeypot field on every form.
2. Server-side filtering, duplicate detection and rate limits (built into Formclick).
3. Domain restriction once your site is live.
4. Turnstile or reCAPTCHA only if spam continues.

Every Formclick HTML template already includes the honeypot. Start free and spam filtering is on from your first submission.