We currently have a Contact Us form on our web page (name, email, comment field), but our issue is that we consistently receive spam from it.
The sender email changes each time and the text varies slightly.
If we had to use a captcha, are there metrics on whether a user would simply not send, using the form, because of it? (I'm open to other alternatives too.)

  • 3
    I've been using a honeypot for over 3 years now and it has successfully filtered all spam. I know this because when the honeypot is tripped I save all of the data into a .txt file and occasionally review them. 100% spam and 0% legitimate users; the whole "well what if they have JS disabled" line is a hot load of steaming brownie pie. If someone has JS disabled then they should know enough to enable it if something is failing, the average users couldn't give two fits of a tish hit.
    – MonkeyZeus
    Commented Sep 26, 2016 at 20:47

2 Answers 2


There are better methods for detecting bots without requiring the users to enter anything.

The honeypot technique

Bots usually try to fill every form field so they can submit and send the information successfully. However, if you put 1 form field which is hidden with CSS or JS humans won't be able to see it and fill it. Unlike humans bots will be able to see the visually hidden field and fill it. So if you detect messages that had filled the hidden form field - it is a bot.

Time based detection of bots

This technique relies on the fact that bots fill out form fields immediately where humans usually need some time. So if you see that the page loaded and after 0.3 seconds your forms were filled and send then - its most probably a bot.


People with screen readers will see the hidden form field so it should be named appropriately. In my opinion, it would be most efficient to mix both approaches so you can have better detection of spam bots without requiring extra user effort.

  • If I named the field appropriately, wouldn't a bot be able to detect that the form is intended for non-humans? Commented Sep 26, 2016 at 13:29
  • 1
    Usually bots are not that smart. Unless there is something like that out there that I'm unaware of?
    – UXerUIer
    Commented Sep 26, 2016 at 13:35
  • 1
    Maybe the bigger problem will be browser autofilling. If the browser autofills the hidden field you might be detected as bot. So the naming of this field is crucial. We should avoid names like first name, fname, ccard, etc. Commented Sep 26, 2016 at 14:08
  • 1
    Just implemented a simple honeypot and it's working like a charm. Commented Oct 12, 2016 at 20:53

You should try Google's chapta "i am not a robot". It is very simple and not frustrating (aka has a good UX). For technical info you can read this Quora page

  • Yes, thought about that too. It's likely one of the least painful captchas out there. But I simply don't know the impact it would have on the response rate for a Contact Us form. Since it's a place for a potential customer to get in touch, we want to be careful about any friction we impose. Commented Sep 27, 2016 at 18:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.