Anti-spam
Twelve ways to stop form spam, and what each one actually does
Every one of these is recommended somewhere as the answer. One of them genuinely is — and we do not sell it. The rest are worth running, worth understanding, and worth being honest about.
Corey Haines · San Diego · Aug 2026
Written from ~22 independent practitioner accounts. Bypass techniques change; each page carries its date.
We mined about forty threads and a hundred and fifty reviews looking for what people complain about in form builders. Spam was not the most frequent complaint. It was the angriest one — and the only bucket where nobody had a solution.
What made it worth writing about is that the failures are described so specifically. People do not say “CAPTCHA didn’t work.” They say which service solved it, how long it took, and what was running at the time. That level of detail is missing from every page currently ranking for these terms, and it is the only reason these teardowns are worth reading.
“I think that’s the problem with contact form 7, wp forms, jotform, squarespace, and all others. They all are ok to get setup, some even offering SMTP setup. But none have nailed anti-spam to a science.”
Each page below covers how the method works, what it genuinely stops, how it is defeated, when it is still worth using, and what to pair it with. Where a method works, we say so — the OTP verification page concludes that you should go and implement it, and that it is not a thing we are selling you.
The scorecard
Four kinds of unwanted submission, and what each defense does about them. The last column is what the method costs the buyer you actually wanted.
| Method | Scripted bots | Targeted automation | Paid humans | Real people, bad leads | Buyer friction |
|---|---|---|---|---|---|
| reCAPTCHA v2 | Yes | No | No | No | High |
| reCAPTCHA v3 | Yes | No | No | No | None |
| hCaptcha | Yes | No | No | No | High |
| Turnstile | Yes | Partly | No | No | Low |
| Honeypot | Yes | No | No | No | None |
| Time-traps | Yes | No | No | No | None |
| Geo-blocking | Yes | No | Partly | No | Low |
| Rate limiting | Yes | No | No | No | Low |
| Email verification | Yes | Partly | No | No | Medium |
| OTP | Yes | Yes | Partly | No | High |
| Disposable email | Partly | No | No | Partly | Low |
| Removing the form | Yes | Yes | Yes | Yes | High |
Read the bottom row carefully. Removing the form is the only method here that scores yes on every column, and it is on this list because practitioners in our research actually did it. The perfect defense costs you the entire business the form was doing.
The teardowns
Challenge
reCAPTCHA v2
The “I’m not a robot” checkbox. Still the default recommendation, still the most-cited failure in our research corpus.
Challenge
reCAPTCHA v3
The invisible one. It returns a score, not a decision — and almost every integration throws the score away.
Challenge
hCaptcha
The privacy-positioned alternative. The honest reason to choose it is data protection, not protection.
Challenge
Cloudflare Turnstile
The best of the challenges, and it is not close — mostly because it asks the visitor for nothing.
Trap
Honeypot fields
A field the visitor cannot see and a bot fills in anyway. Free, invisible, and it fails silently in both directions.
Trap
Time-traps and submit-delay heuristics
Reject anything filled in faster than a human could. One line for you, one line for them.
Gate
Geo-blocking
Refuse traffic from countries you do not sell to. Blunt, effective on volume, and its false positives are your best customers.
Gate
IP reputation and rate limiting
Cap submissions per address. It protects your infrastructure reliably and your CRM barely at all.
Filter
Email verification
Three different things share this name. Only one of them proves a person exists — and the best of the other two is not an anti-spam tool at all.
Gate
OTP and SMS verification
The one that works. It is expensive, it costs completion, and you should probably use it.
Filter
Disposable-email blocking
Block the throwaway domains. The list is always behind, and privacy relays look identical to it.
Last resort
Taking the form down
The only defense here with a perfect score. It stops one hundred percent of spam and one hundred percent of your leads.
What none of them can tell you
Every method on this page works at the door. CAPTCHAs, honeypots, timing rules, geo-blocks, rate limits, address checks, one-time codes — all of them are attempts to decide whether to accept a submission.
Not one of them tells you what the submissions you accepted turned out to be. Whether they were called. Whether the number was real. Whether anybody bought anything. You can win the entire defensive war and still be unable to answer which of your forms made money, because that question is asked at a different time and no form builder is listening when the answer arrives.
“Cost per lead is amazing. Under $15 per lead. Sales are struggling with the leads.”
Every one of those people could have passed a CAPTCHA. Several of them would have passed an OTP check. Spam defense and lead quality are adjacent problems that get talked about as one, and conflating them is how a team ends up tuning a challenge for six months while the actual problem sits downstream, unmeasured.
That argument, in full and with the counter-arguments at their strongest, is the dishonest dashboard. The vocabulary is in the glossary, and if you want to put a number on what the junk is costing you, the calculators will do it.