You can stop most form spam without showing your visitor anything. A honeypot and a submission timing check are free, invisible and handle the automated majority. Server-side filtering on content and reputation catches what is left, including spam written by a person, which no captcha can do.
Why avoid the captcha
Every challenge you add moves the cost onto the customer. They came to ask you for a quote and you asked them to prove something first.
The argument for accepting that cost was that challenges work. That has weakened. Solving services are cheap and easily available, a growing share of form spam is sent by people rather than scripts, and the methods that do not interrupt anyone have improved.
There is also a plain comparison worth sitting with. Your email has a spam filter. You have never once identified a traffic light to read your inbox. Filtering happened on the way in, invisibly, and everyone accepted that as normal twenty years ago. Forms never made the same move.
The invisible stack
Honeypot
A field hidden from real visitors that bots fill in anyway. Free, instant, works on any platform. Stops low-effort automated submissions, which is most of the volume on most sites.
If you later remove the plugin providing it, remove its form tag too, or the tag can become visible.
Timing check
Record when the page loaded, server-side, and reject anything submitted faster than a person could type. Scripts submit instantly. People do not.
Rate limiting
Cap submissions per IP per window. A published practical limit for a contact form is 5 per hour and 20 per day. Too tight and you block shared connections, which is a real risk on B2B forms where a whole office shares an address.
Server-side content and reputation filtering
The submission goes to a service after the visitor presses send, and the service scores it on the message text, the sender’s address and the IP’s history. Nothing appears on the page, so there is nothing for a bot to detect or defeat client-side.
This is the only layer that catches spam a person typed, because it is the only one reading what was actually said.
Network reputation
Some filters only know what has happened on your site. Others recognise patterns caught elsewhere. The difference matters most for new campaigns: a pattern that has already been seen somewhere arrives at your form pre-identified instead of getting one free run at you.
What invisible methods miss
Being honest about this is the difference between advice and marketing.
| Method | What it misses |
|---|---|
| Honeypot | Bots that detect hidden fields. Anything typed by a person |
| Timing check | Anything driven by a real browser at human speed |
| Rate limiting | Distributed sources using many addresses |
| Content filtering | Well-written spam that reads like a genuine enquiry |
| Network reputation | Genuinely new patterns, until they are seen once |
No layer is complete. The combination is what works, which is true of captchas too, with the difference that this combination costs your visitor nothing.
The question that matters more than accuracy
Every anti-spam tool claims a high catch rate. Far fewer will tell you what happens to something they catch by mistake.
A filter that silently rejects can turn away a real customer and leave no record. Nothing in your inbox, nothing in your spam folder, nothing in any report. The enquiry simply never existed, and you go on not knowing.
Ask what happens to a flagged submission before you ask how accurate the filter is. Held and reviewable is a different product from silently dropped, even if the detection is identical. The version of this question that costs the most is blocking free email domains, where the rejected enquiries leave no trace at all.
How Lead Source does it
No captcha on the page by default. On a Lead Source form the checks sit in the form itself, so most junk never becomes a submission in the first place.
Anything flagged is quarantined rather than deleted: held in a separate view, excluded from your lead counts and your attribution, and reviewable. Restore one and it rejoins your leads with its source and page journey intact. What the junk does to those counts before it is filtered is worked through in what spam leads do to your marketing numbers.
A captcha is available if you want one. It is off by default. See how it works, or start with lead capture software if you are choosing how enquiries reach you in the first place.