Stopping contact form spam without a CAPTCHA

1 · The honeypot

A field that's hidden from people but present in the page's code. A person never sees it; a bot that fills in everything fills it in too, and gives itself away. It works best when its name isn't predictable. More in the honeypot guide.

2 · The time trap

A person needs several seconds to read a form and type a message. A bot submits in a fraction of a second. Recording when the form was shown, in a way the bot can't forge, and refusing anything faster than a few seconds catches a large share of automated spam.

3 · A limit per address

Bots that do get through tend to send in bursts. Allowing only a handful of messages from one address within a few minutes stops the flood without affecting anyone typing by hand.

How Mailbag applies them

All three are always on in Mailbag Contact Form: the honeypot's label is random, a form sent less than 3 seconds after it was shown counts as spam, and a sixth message from the same address within 10 minutes is filed as spam too. The address limit works on a hashed value that expires on its own, so no IP address is stored.

Caught messages aren't deleted on the spot. They're kept under Spam in Entries for 30 days, at most 1,000, each with the reason it was caught, so a real enquiry that tripped a check can be found and answered. The visitor sees the normal thank-you message either way, which gives a bot nothing to learn from.

When to add a CAPTCHA anyway

If a targeted campaign or a human spammer gets through, add Cloudflare Turnstile, hCaptcha or reCAPTCHA v3 with your own keys. Mailbag supports all three, and keeps the three quiet checks running alongside.