Protect web forms with honeypots, CAPTCHA and rate limits
· PoolByte Technology
If your contact form brings up dozens of meaningless messages, fake quote requests, or link-filled comments every day, the problem isn't just annoying. Real customer messages get lost in the pile, the sales team wastes time, and your domain's email reputation can suffer as auto-response emails are sent to fake addresses. Therefore, spam protection in forms is not a matter of convenience, but of business continuity.
No single method is sufficient for effective spam protection. The best results are achieved by combining several layers that are invisible to the user and deploying visible verification when it is actually needed.
Recognize the type of spam
Unwanted traffic to forms is not uniform. Automatic comment bots that try to place links, scripts that open fake memberships, attacks that try passwords on the login screen, and submissions that try stolen cards in the payment form require different precautions. Seeing from the logs which form received which type of attack allows you to choose the right layer.
Invisible first layer: Honeypot and duration control
Honeypot is a hidden form field that is not visible to the real user but is filled by simple bots. The field is hidden with CSS, given aria-hidden="true" for screen readers and tabindex="-1" for the keyboard, and browser autofill is turned off. If this field is filled, the submission will be silently rejected.
Adding a duration control to this is also effective. Record the time the form was opened; Forms that are completed and submitted in less than a few seconds are most likely automated. These two methods weed out a significant portion of simple bots without burdening the user with any additional steps. Advanced bots can bypass these controls; Therefore, it alone is not sufficient.
Don't skip server side validation
Checks made in the browser can be easily disabled. Re-validate each submitted field on the server:
- Limit field lengths; There should not be a thousand characters in the name field.
- Check email and phone format.
- Put an upper limit on the number of links in the message.
- Add a session-dependent CSRF token to forms.
The CSRF token prevents another site from sending requests to your form through the user's browser and also makes direct bulk submissions from outside difficult.
Stop bulk sending with rate limiting
Limit multiple submissions from the same IP address or session in a short period of time. For example, for a contact form, a few submissions per minute is a reasonable upper limit. Once the limit is exceeded, the request is rejected and the user is told to try again shortly.
This limit is even more important on login screens. Counting unsuccessful login attempts and applying a waiting period after a certain threshold slows down password attempt attacks. Firewall and WAF rules on the hosting side can also stop this traffic before it reaches your application; We explained this layer in our DDoS and bot traffic guide.
Set up CAPTCHA and invisible verification correctly
Services such as Google reCAPTCHA or Cloudflare Turnstile evaluate whether the user is a bot or not, often in the background without solving the puzzle. The most critical step in these tools is querying the verification token from the browser to the service's API on the server side. Simply adding widgets to the page and not checking the result does not provide protection.
A third-party verification service processes user data and often uses cookies or similar technologies. Therefore, include this service in your lighting text; For details, you can refer to our KVKK compliant website guide. In terms of accessibility, be sure to test whether users with visual or motor disabilities can complete the form.
Turn off auto-replies from abuse
Sending an automatic thank you email to the user when the form is submitted provides a good experience. However, adding the exact user-typed text into this email may lead spammers to use your form to forward their messages to third parties. Use only fixed text in an auto-reply.
Send notification emails from your own domain and with correct authentication records. If SPF, DKIM and DMARC are missing, notifications may end up in the spam folder even on your inbox.
Track rejected submissions
Layers of spam protection can produce false positives over time: a genuine customer's message may be rate-limited, or an authentication service may reject a user from a network. Save rejected submissions together and review them periodically. Before you tighten a rule, see what this record tells you.
Frequently asked questions
Is just using CAPTCHA enough?
In most cases no. CAPTCHA is just one link in the spam protection chain; It is not a substitute for server verification and speed limiting. Best results are achieved when used with invisible layers.
Does a honeypot area break accessibility?
It does not spoil when hidden correctly. Test that the field is also hidden from screen readers and the keyboard row, with autofill turned off.