Honeypots versus CAPTCHAs for form spam
Short answer: A honeypot is a hidden field that bots fill and people never see, so it costs legitimate visitors nothing. A CAPTCHA challenges every visitor, including people using screen readers or slow connections, so it belongs after cheaper filters, not before them.
Every contact form eventually receives something that is not a customer. The question is not whether to filter, but what the filter costs the people you actually want to hear from.
What a honeypot actually does
A honeypot is an input a person cannot see or reach. A generic spam bot fills every field it finds. If the hidden field arrives with a value, the request is dropped.
- Cost to a legitimate visitor: nothing visible.
- Cost to you: one hidden input and one server-side check.
- Weakness: a bot that reads CSS and skips hidden fields, or a human paid to submit by hand.
That weakness is why a honeypot is a first filter, not the only filter, and why the field should be hidden with positioning rather than display:none.
What a CAPTCHA costs
A CAPTCHA interrupts everyone to stop some. The interruption is small on a fast desktop and considerably larger on a slow connection, in a screen reader, or for someone filling the form in a hurry on a phone.
There are cases where that trade is right: a public form that is being flooded right now, or a sign-up that creates a costly resource. It is rarely right as the first and only defence on a contact form.
Layers, cheapest first
- 1Server-side validation: reject malformed bodies before anything else runs.
- 2Honeypot: drop obvious automation for free.
- 3Rate limits: cap per form, per IP and per form per IP, so a flood cannot finish.
- 4Origin rules: refuse browser requests from sites you did not authorise.
- 5Quota: cap what one workspace can store per month.
- 6CAPTCHA: add it only if the layers above are still not enough.
Formivo implements the first five on every plan. The sixth is a decision for your own form, because it runs on your page.
What not to do
- Do not block an entire IP range because one address misbehaved: offices, schools and mobile carriers share addresses.
- Do not silently delete suspicious submissions without a record, because you will eventually delete a real lead.
- Do not publish your filtering rules in a visible error message; it teaches the next bot how to pass.
A practical default
Honeypot on, rate limits untouched, allowed domains set to the sites you own, monthly quota reviewed when a form gets attention. That combination costs visitors nothing and removes the bulk of automated submissions.