The short answer
Most form spam is automated and unsophisticated. Several invisible checks catch the bulk of it without asking anything of the person filling the form in.
Reserve a visible challenge for the case where those have genuinely failed, because every challenge costs you real enquiries.
Checks that work invisibly
| Technique | Catches |
|---|---|
| Hidden field left empty | Scripts that fill everything |
| Minimum time to complete | Instant automated submissions |
| Token issued when the page loads | Direct posts to the endpoint |
| Content rules on the server | Obvious link spam |
| Rate limit per address | Repeated submissions |
The first two together remove most of it. Neither is visible to a person and neither asks anyone to do anything.
Hidden fields need care
A hidden field is only safe if browsers and assistive technology genuinely skip it. Hide it properly, exclude it from the tab order and mark it so screen readers ignore it.
- Positioned off screen rather than merely transparent
- Excluded from tab order
- Hidden from assistive technology
- Marked so password managers and autofill leave it alone
- Never a name like address or website that autofill recognises
That last point causes real lost enquiries. Naming a hidden field something autofill knows means browsers fill it in for genuine visitors, whose submissions are then silently rejected.
Fail visibly, not silently
- Never discard a submission without telling the sender.
- If a check fails, say the submission could not be accepted.
- Log rejections so you can see what is being caught.
- Review the log occasionally for genuine enquiries being blocked.
- Provide an alternative contact route on the error.
Silent rejection is the worst possible behaviour. The visitor believes they contacted you and you never know they tried.
When a challenge is justified
Sustained targeted spam that the invisible checks do not catch is a reason for a visible challenge. General caution is not.
If you do add one, choose the least demanding option available and monitor whether enquiry volume falls after you add it.