How to stop form spam without a CAPTCHA

---

title: How to stop form spam without a CAPTCHA description: CAPTCHAs punish real visitors and still let bots through. Here's how modern form spam protection works — honeypots, time-traps and invisible checks — and how to get it for free. date: 2026-06-20 author: wwwform tags: [spam, security, how-to] hero: spam-shield tldr: You don't need a CAPTCHA to stop form spam. Honeypot fields, submission time-traps and invisible bot checks filter the vast majority of junk before it reaches you, with zero friction for real visitors. wwwform runs all three automatically on every form. faq:

• q: Do I still need a CAPTCHA if I use these techniques? a: For most contact and lead forms, no. Honeypots, time-traps and invisible heuristics stop the overwhelming majority of automated spam without making real visitors solve a puzzle. wwwform applies them by default.
• q: What is a honeypot field? a: A hidden field that humans never see or fill in, but automated bots fill in anyway because they fill every field. If it's filled, the submission is almost certainly a bot and gets dropped silently.
• q: Will spam protection block real people? a: No. The checks target bot behaviour — filling hidden fields, submitting in milliseconds, missing browser signals — not the content a person types. Genuine submissions pass straight through.

---

If you've ever added a form to a public site, you know what happens next: within days, your inbox fills with junk. The usual reflex is to bolt on a CAPTCHA. But CAPTCHAs are a bad trade — they slow down and frustrate your real visitors, hurt conversion, fail accessibility, and increasingly don't even stop modern bots.

There's a better approach, and it's invisible.

Three quiet techniques that actually work

1. Honeypot fields

Add a field that's hidden from people but present in the HTML. A human never sees it, so they never fill it. A bot fills in every field it finds — so if the hidden field has a value, you know the submission is automated and can drop it silently. No puzzle, no friction.

2. Time-traps

A person takes at least a few seconds to read and complete a form. A bot submits in milliseconds. By measuring how long a form was on screen before submission, you can flag impossibly fast fills as automated.

3. Invisible bot checks

Real browsers carry signals — they run JavaScript, hold a session, and behave like a person clicking and typing. Lightweight, behind-the-scenes heuristics use these to tell humans from scripts, again without ever interrupting a real visitor.

Stacked together, these catch the large majority of spam before it ever reaches your inbox, while genuine submissions sail through untouched.

Why not just use a CAPTCHA?

• It hurts conversion. Every extra step costs you real submissions.
• It's an accessibility barrier. Image and audio puzzles exclude people.
• It leaks data. Many CAPTCHAs hand visitor signals to a third party.
• Bots beat it anyway. Solving services and AI have made many CAPTCHAs trivial.

The goal isn't to interrogate every visitor — it's to quietly filter the obvious junk.

Get it built in, for free

With wwwform, all three techniques run automatically on every form, on every plan, with nothing to configure. You paste one line:

<div id="wwwform-k_yourkey"></div>
<script src="https://cdn.wwwform.com/f/embed.js" data-wwwform="k_yourkey" async></script>

…and spam protection is already on. Your visitors never see a puzzle, and you stop sorting junk out of your inbox.