Put a form on the internet and, sooner or later, the junk arrives. Sign-ups from addresses that don't exist, messages full of strange links, the same nonsense submitted over and over. It clutters your responses, wastes your time and makes it harder to spot the people who really wanted to reach you.
The usual reflex is to add a puzzle: click all the traffic lights, type the wobbly letters. That can work, but it asks every honest visitor to prove they're human before they can say hello. There are kinder ways to start, and most of them are invisible to the people filling in your form.
First, look at what kind of spam you get
Not all spam is the same, and the fix depends on the problem. Before you change anything, have a look at the junk you've received so far.
- Automated bots fill in every field they find, often within moments of loading the page, and usually stuff the message with links.
- Repeated submissions come in bursts: the same form, sent many times in a short period.
- Fake or stolen addresses show up in sign-up forms, sometimes because someone is signing up other people without their knowledge.
- People sending junk by hand, such as sales pitches in your contact form. These are real humans, so tricks aimed at bots won't stop them.
Knowing which of these you're dealing with keeps you from adding heavy protection for a problem you don't have.
Quiet checks that real people never notice
The best spam protection is the kind your visitors never see. These measures sit in the background and catch a lot of automated junk without asking anything of real people.
A honeypot field. Add an extra field that's hidden from view, for example one labelled "Website". People don't see it, so they leave it empty. Many bots fill in every field they find, so a response with that field filled in is almost certainly automated. Hide it properly: not just visually, but also from screen readers and keyboard navigation, so nobody using assistive technology stumbles into it by accident.
A timing check. Real people need a little while to read and type. A form that is completed and sent almost instantly after the page loads is a strong hint that no human was involved. Treat it as a signal, not proof, because some people do use autofill.
Don't tell bots what they did wrong. When a submission trips one of these checks, show the normal thank-you message and quietly set it aside. A bot that gets a clear error learns how to get around it. A bot that thinks it succeeded simply moves on.
Set sensible limits on repeated sending
If the same form is sent many times in a short period from the same source, that's rarely a person. A limit on how often a form can be submitted in a few minutes stops bursts of junk without bothering anyone who sends a single message.
Keep the limits generous enough for real life: a family registering several children for a workshop, or a team signing up colleagues one by one. And keep in mind that technical details such as IP addresses count as personal data under the GDPR. If you use them for this, keep them only as long as you need them and mention it in your privacy notice. We wrote more about that side of things in How to make a GDPR-friendly form.
Confirm sign-ups by email
For newsletters, waitlists and other sign-ups, a confirmation email is one of the most effective and friendliest measures you can take. The person signs up, receives an email with a link, and is only added once they click it.
This does two jobs at once. Fake addresses never get confirmed, so they never make it onto your list. And nobody can sign up someone else's address without that person knowing, which protects people who never asked to hear from you. Keep the confirmation email short, say clearly what they signed up for, and make the button obvious.
Validate kindly, so real people get through
Validation helps keep junk out, but strict rules can just as easily keep real people out. Before you add a rule, think about who it might block by mistake.
- Names come in every shape. People have apostrophes, hyphens, accents, very short names, very long names and sometimes only one name. Don't reject a name because it looks unusual.
- Phone numbers are international. Accept spaces, a plus sign and country codes, or don't ask for a phone number at all if you won't call.
- Email checks should catch typos, not judge. A friendly hint when an address looks mistyped helps. Blocking whole email providers or new domains usually hurts real people.
- Errors should help. Say what to fix, in plain words, and keep what people already typed. Nobody should have to start again.
A rule that stops a bot but also stops one real customer is not a good trade.
Be wary of links where you don't expect them
A lot of spam exists to drop links. If your form has a message field where links are rarely needed, such as a contact form or a feedback form, a response packed with links deserves a second look.
Rather than blocking links outright, flag those responses for review. Sometimes a real person shares a link to their website or a screenshot, and you don't want to lose that message.
Set doubtful responses aside instead of deleting them
Every spam filter makes mistakes now and then. If suspicious responses disappear without a trace, you'll never know who you missed. A safer approach is a separate "probably spam" pile that someone checks regularly.
That pile shouldn't become a permanent archive, though. Spam can contain personal data too, such as a real person's address that a bot used. Look through it, rescue anything real, and delete the rest on a regular schedule.
A CAPTCHA as a last resort
Sometimes the quiet measures aren't enough, for example when a form is a popular target. Then a CAPTCHA or a similar challenge can help. Just be aware of the cost before you add one.
- It puts the work on everyone. Every honest visitor has to solve it, every time.
- It can shut people out. Visual puzzles can be hard or impossible for people with visual or cognitive impairments, and fiddly on a small screen. If you use one, choose a service with an accessible alternative.
- It may involve another company. Some services load scripts from a third party and can collect data about your visitors. Check what the service does, whether you need to mention it in your privacy notice, and whether it needs consent.
If you add one, consider showing it only to suspicious submissions rather than to everyone.
A quick checklist
- You know what kind of spam you're getting.
- There's a properly hidden honeypot field.
- Submissions that are impossibly fast are flagged.
- Repeated sending is limited, with room for real life.
- Sign-ups are confirmed by email.
- Validation accepts real names, international phone numbers and unusual email addresses.
- Responses full of unexpected links are flagged, not blocked.
- Doubtful responses go to a review pile that's checked and cleared regularly.
- A CAPTCHA is only added when nothing else works, and it has an accessible alternative.
How we're thinking about this at Cuppaform
Cuppaform is still being built, and we'd like spam protection to stay out of real people's way. The waitlist and contact form on this website already use a hidden honeypot field rather than a puzzle. As we build the form builder, we're working on ways to keep junk out of your responses without making honest people jump through hoops.
You can try the demo to see what a friendly form feels like from the other side.