Stop form spam without annoying visitors
Any form on the public web gets spam. The usual answer, a puzzle every visitor must solve, costs you real messages. FormDoc uses layers instead, starting with ones your visitors never notice.
Layer 1: the honeypot
A honeypot is a field people can’t see but simple bots fill in anyway:
<input type="checkbox" name="botcheck" style="display:none" tabindex="-1" autocomplete="off">
When botcheck has a value, FormDoc stores the submission as spam and doesn’t email you. The bot still gets a normal success response, so it has no reason to try something smarter.
Layer 2: spam scoring
Every submission is checked for common spam signs: lots of links, known spam phrases, disposable email addresses, random-looking text, and the same message sent again within a few minutes. High scores are stored as spam instead of being emailed.
Layer 3: rate limits
One visitor can send at most 10 submissions a minute to a form, and a form accepts at most 120 a minute. Floods are stopped before they reach your inbox.
Layer 4: a captcha, only if you need it
If a form still attracts spam, turn on Cloudflare Turnstile or hCaptcha in the form’s settings (reCAPTCHA is available on paid plans). Turnstile usually runs without asking visitors to do anything.
Start simple
For most sites the honeypot and spam scoring are enough. Add a captcha only if spam still gets through: every extra step for visitors means fewer real messages.