Build
How to add spam protection to a contact form
Start with a honeypot field and a submission timing check — together they stop most automated spam, cost nothing and never inconvenience a real person. Add a privacy-respecting challenge only if spam continues.
Before you start
- Access to the form and its handler
The steps
-
Step 1: Add a honeypot field
A text input hidden with CSS, labelled something a bot would fill. Reject any submission where it is not empty.
-
Step 2: Hide it accessibly
Position it off-screen rather than using display:none, and add tabindex="-1" plus aria-hidden so screen reader users never meet it.
-
Step 3: Add a timing check
Record when the form rendered. Reject submissions completed in under about three seconds — no human types that fast.
-
Step 4: Validate server-side
Every rule, again, on the server. Client-side validation is a convenience and trivially bypassed.
-
Step 5: Rate-limit by IP
A small number of submissions per hour stops volume attacks without affecting anyone real.
-
Step 6: Measure before escalating
Log what gets through for two weeks. If the honeypot and timing check are holding, stop here.
-
Step 7: Only then add a challenge
Prefer a privacy-respecting option such as Turnstile or hCaptcha over reCAPTCHA, which sends visitor data to Google and requires disclosure.
Why CAPTCHA is a last resort
It costs every legitimate user time and effort, it is a genuine barrier for people with disabilities, and it fails against paid solving services. It should be a response to measured spam, not a default.
The privacy consequence people miss
reCAPTCHA transmits visitor data to Google on every page it loads. Under UK and EU data protection that is a disclosure obligation, and it means a third party is profiling your visitors as the price of a contact form.
The background behind this
Website accessibility, without the compliance theatre covers the reasoning in about 5 minutes — free, ungated, written from client work.
Who wrote this
Anas Bin Masud builds e-commerce sites and does technical SEO for businesses in the UK, Canada, Ireland and Pakistan. These procedures are the ones I run on client work, written down rather than invented — including the ones where the honest answer is that the fix is not available on your current hosting.