# Stop form spam without annoying visitors

> How honeypot fields, spam scoring, rate limits and an optional captcha keep spam out of your inbox while real people send messages easily.

Spam protection

How honeypot fields, spam scoring, rate limits and an optional captcha keep spam out of your inbox while real people send messages easily.

By [Venkatesh](https://www.linkedin.com/in/ageven/) 29 October 2026 · 1 min read

![Cover image: Stop form spam without annoying visitors, a FormDoc guide](https://www.formdoc.dev/images/blog/stop-form-spam.png)

Any form on the public web gets spam. The usual answer, a puzzle every visitor must solve, costs you real messages. FormDoc uses layers instead, starting with ones your visitors never notice.

## Layer 1: the honeypot

A honeypot is a field people can’t see but simple bots fill in anyway:

```html
<input type="checkbox" name="botcheck" style="display:none" tabindex="-1" autocomplete="off">
```

When `botcheck` has a value, FormDoc stores the submission as spam and doesn’t email you. The bot still gets a normal success response, so it has no reason to try something smarter.

## Layer 2: spam scoring

Every submission is checked for common spam signs: lots of links, known spam phrases, disposable email addresses, random-looking text, and the same message sent again within a few minutes. High scores are stored as spam instead of being emailed.

## Layer 3: rate limits

One visitor can send at most 10 submissions a minute to a form, and a form accepts at most 120 a minute. Floods are stopped before they reach your inbox.

## Layer 4: a captcha, only if you need it

If a form still attracts spam, turn on Cloudflare Turnstile or hCaptcha in the form’s settings (reCAPTCHA is available on paid plans). Turnstile usually runs without asking visitors to do anything.

## Start simple

For most sites the honeypot and spam scoring are enough. Add a captcha only if spam still gets through: every extra step for visitors means fewer real messages.

Every [form template](https://www.formdoc.dev/templates/) already includes the honeypot field, and the [FAQ](https://www.formdoc.dev/faq/#how-does-formdoc-stop-spam) sums up how the layers work together.

Written by**[Venkatesh](https://www.linkedin.com/in/ageven/)**