Form spam protection is a question of order: which layer runs first, and which one a real visitor ever sees. The forms that get both the spam and the complaints are the ones that put the puzzle first. The order that works is a hidden field bots fill, a check that the form was not sent in under a few seconds, a limit on sends from one place, and only then a captcha for forms, shown to the sender the first three layers could not clear. This page sets out the four layers for a small business site's forms, says what each one catches, and puts the cost of the visible layer in the free contact form design sheet's terms, because a challenge is a field with a finish rate like any other.
The honeypot and the time check
A honeypot is a field a person cannot see and a bot fills because it is there; a send with the honeypot filled is dropped before anything else runs. The time check drops a send that arrived faster than a person could have typed it. Between them they clear most of what a small site receives, and neither adds a field, a second or a share of starts on the contact form design sheet. The hidden input linked below is what a honeypot is built from.
The rate limit and the captcha, in that order
A rate limit stops one sender from sending fifty times in a minute, and it is invisible to a person who sends once. A captcha for forms is the visible layer, and it is shown only to a sender the first three layers could not clear, which for most real visitors means never. When it is shown, the modern kinds are a checkbox or a score rather than a puzzle; the two challenge services linked below are the reference for what each shows the visitor. A captcha on every send is a field on every send, and the sheet counts it as one.
What spam protection must not do
It must not drop real entries silently. Every send the layers refuse is kept somewhere the owner can read, marked as spam, so a real customer caught by the time check on a fast phone can be found. In Shortcodo Pro a refused send is an entry with the status spam and the layer that refused it, never counted as a lead and never deleted unread, and the count of spam against real entries is on the list, which is how the layers are tuned.
Questions people ask about form spam protection
Is a captcha for forms enough on its own?
It is the last layer, not the only one. Put it behind the honeypot, the time check and the rate limit and most visitors never meet it.
Does spam protection lower the finish rate?
The invisible layers do not. A challenge on every send does, and the contact form design sheet prints what a lower finish rate costs at your enquiry value.
What happens to a real entry marked as spam?
It is kept with the status spam and the layer that caught it, so it can be found and restored. A layer that deletes is a layer that loses customers.