We currently have a Contact Us form on our web page (name, email, comment field), but our issue is that we consistently receive spam from it.
The sender email changes each time and the text varies slightly.
If we had to use a captcha, are there metrics on whether a user would simply not send, using the form, because of it? (I'm open to other alternatives too.)

  • 3
    I've been using a honeypot for over 3 years now and it has successfully filtered all spam. I know this because when the honeypot is tripped I save all of the data into a .txt file and occasionally review them. 100% spam and 0% legitimate users; the whole "well what if they have JS disabled" line is a hot load of steaming brownie pie. If someone has JS disabled then they should know enough to enable it if something is failing, the average users couldn't give two fits of a tish hit. – MonkeyZeus Sep 26 '16 at 20:47

There are better methods for detecting bots without requiring the users to enter anything.

The honeypot technique

Bots usually try to fill every form field so they can submit and send the information successfully. However, if you put 1 form field which is hidden with CSS or JS humans won't be able to see it and fill it. Unlike humans bots will be able to see the visually hidden field and fill it. So if you detect messages that had filled the hidden form field - it is a bot.

Time based detection of bots

This technique relies on the fact that bots fill out form fields immediately where humans usually need some time. So if you see that the page loaded and after 0.3 seconds your forms were filled and send then - its most probably a bot.


People with screen readers will see the hidden form field so it should be named appropriately. In my opinion, it would be most efficient to mix both approaches so you can have better detection of spam bots without requiring extra user effort.

  • If I named the field appropriately, wouldn't a bot be able to detect that the form is intended for non-humans? – vphilipnyc Sep 26 '16 at 13:29
  • 1
    Usually bots are not that smart. Unless there is something like that out there that I'm unaware of? – Majo0od Sep 26 '16 at 13:35
  • 1
    Maybe the bigger problem will be browser autofilling. If the browser autofills the hidden field you might be detected as bot. So the naming of this field is crucial. We should avoid names like first name, fname, ccard, etc. – Kristiyan Lukanov Sep 26 '16 at 14:08
  • 1
    Just implemented a simple honeypot and it's working like a charm. – vphilipnyc Oct 12 '16 at 20:53

You should try Google's chapta "i am not a robot". It is very simple and not frustrating (aka has a good UX). For technical info you can read this Quora page

  • Yes, thought about that too. It's likely one of the least painful captchas out there. But I simply don't know the impact it would have on the response rate for a Contact Us form. Since it's a place for a potential customer to get in touch, we want to be careful about any friction we impose. – vphilipnyc Sep 27 '16 at 18:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.