{"id":8900,"date":"2026-08-11T04:22:58","date_gmt":"2026-08-11T04:22:58","guid":{"rendered":"https:\/\/dextora.agency\/insights\/form-spam-honeypots-captcha-and-what-they-cost\/"},"modified":"2026-08-11T04:22:58","modified_gmt":"2026-08-11T04:22:58","slug":"form-spam-honeypots-captcha-and-what-they-cost","status":"publish","type":"insight","link":"https:\/\/dextora.agency\/en\/insights\/form-spam-honeypots-captcha-and-what-they-cost\/","title":{"rendered":"Form Spam: Honeypots, CAPTCHA and the Conversion They Cost"},"content":{"rendered":"<p>Form spam is filed under annoyance and budgeted as zero. It is actually three separate costs: the staff time spent reading rubbish, the real enquiries that get deleted alongside it, and \u2014 the one nobody counts \u2014 the genuine customers turned away by whatever was installed to stop it.<\/p>\n<p>That third cost is the reason this is worth thinking about rather than solving reflexively. Every anti-spam measure is a tax on legitimate users, and the measures most commonly installed are the ones with the highest tax.<\/p>\n<h2>What is actually arriving<\/h2>\n<p>Treating all of it as &#8220;bots&#8221; leads to the wrong defence. Three categories arrive through a typical contact form and they need different answers.<\/p>\n<table>\n<thead>\n<tr>\n<th>Type<\/th>\n<th>What it looks like<\/th>\n<th>What stops it<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>Automated bulk<\/td>\n<td>Gibberish, links, form filled in under a second<\/td>\n<td>Honeypot and timing checks<\/td>\n<\/tr>\n<tr>\n<td>Targeted probing<\/td>\n<td>Code in fields, attempts at injection or header abuse<\/td>\n<td>Server-side validation, not a challenge<\/td>\n<\/tr>\n<tr>\n<td>Human outreach spam<\/td>\n<td>&#8220;I noticed your website could rank better&#8221;<\/td>\n<td>No technical measure; filtering after the fact<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<div class=\"accent-block\">\n<p>The third row matters more than it appears. A large share of what businesses call form spam is sent by people, often paid people, and no CAPTCHA prevents it because a human is solving it. Installing a challenge to stop outreach spam adds friction for customers and changes nothing about the problem, which is a common and expensive misdiagnosis.<\/p>\n<\/div>\n<h2>The compliance question that changed in 2026<\/h2>\n<p>The default answer to form spam in most of the world is Google reCAPTCHA. In the EU it carries obligations that many sites are not meeting, and the position moved this year.<\/p>\n<p>Privacy vendors report that from 2 April 2026 Google changes its role for reCAPTCHA from data controller to data processor. Note who is reporting it: most of the coverage comes from companies selling alternative CAPTCHA products, so read the framing with that in mind. The substance is straightforward though, and it is not in dispute: as processor, Google acts on the site owner&#8217;s instructions, which moves responsibility for lawfulness onto the site owner rather than sharing it.<\/p>\n<p>Two consequences follow for anyone with EU or UK visitors.<\/p>\n<ul>\n<li><strong>The script reads the visitor&#8217;s device and behaviour,<\/strong> which in the European framework generally requires informed consent before it loads, rather than after. A challenge that fires on page load, before any consent choice, is the common implementation and the problematic one.<\/li>\n<li><strong>Security purposes do not automatically exempt it.<\/strong> The argument that a tool is protective rather than commercial does not by itself remove the consent requirement when the tool accesses information on the user&#8217;s device.<\/li>\n<\/ul>\n<p>None of this makes reCAPTCHA unusable. It makes it a choice that needs a lawful basis, a mention in your privacy documentation and, for most implementations, loading only after consent \u2014 which is precisely what a spam filter cannot do, because the spam does not wait for consent. That tension is the practical reason to prefer measures that do not require the challenge at all.<\/p>\n<h2>The accessibility cost<\/h2>\n<p>Challenges also exclude people. Image puzzles are impassable for some visually impaired users, audio alternatives are frequently worse, and timed interactions cause problems for users with motor or cognitive impairments. This sits directly against WCAG requirements and, for businesses in scope, against the obligations described in <a href=\"https:\/\/dextora.agency\/en\/insights\/website-accessibility-legal-requirements-business-value\/\">what accessibility law actually requires<\/a>.<\/p>\n<p>The commercial version of the same point: every visitor who fails a challenge is a lost enquiry that never appears in your analytics as anything. The spam you blocked is visible. The customer you blocked is not.<\/p>\n<h2>The measures, ranked by cost to the user<\/h2>\n<ol>\n<li><strong>Honeypot field.<\/strong> A hidden field that humans never see and simple bots fill in. Zero friction, zero privacy implications, stops a large share of automated submissions. Must be hidden accessibly rather than with an attribute screen readers announce.<\/li>\n<li><strong>Timing check.<\/strong> Reject submissions completed in under two or three seconds, which no human achieves on a real form. Also zero friction, and it catches what the honeypot misses.<\/li>\n<li><strong>Rate limiting.<\/strong> A cap on submissions per address per hour, applied at the server. Invisible to normal users and effective against volume.<\/li>\n<li><strong>Server-side validation.<\/strong> Not anti-spam as such, but it is what stops the targeted category: reject unexpected characters in name fields, refuse URLs where they do not belong, and never trust the client.<\/li>\n<li><strong>A simple question.<\/strong> &#8220;What is two plus three&#8221; or a domain-specific question. Low friction, moderate effectiveness, and it fails for the same accessibility reasons if implemented carelessly.<\/li>\n<li><strong>A privacy-respecting challenge.<\/strong> Proof-of-work or European-hosted alternatives that avoid cookies and cross-border transfer. Higher friction than the above, considerably lower compliance burden than reCAPTCHA.<\/li>\n<li><strong>reCAPTCHA or similar.<\/strong> Effective, and the most expensive option in friction, accessibility and compliance terms. A reasonable last resort, not a first move.<\/li>\n<\/ol>\n<p>The first four are free, invisible and cumulative. In most audits we run they are absent while option seven is present, which is the wrong way round.<\/p>\n<h2>The stack that works for a small business<\/h2>\n<p>Start with honeypot, timing check, rate limiting and strict server-side validation. Together these eliminate the overwhelming majority of automated submissions with no effect whatsoever on a real visitor, and they add nothing to your privacy documentation.<\/p>\n<p>Measure for a month. If the remaining volume is manageable, stop there: you have solved the problem for free. If it is not, add a privacy-respecting challenge before considering reCAPTCHA, and if you do end up with reCAPTCHA, load it on interaction rather than on page load, disclose it, and give it a lawful basis.<\/p>\n<p>Where forms are long or multi-step, the same discipline that improves completion also reduces spam, because staged forms are harder for naive bots to traverse, which is a side benefit of <a href=\"https:\/\/dextora.agency\/en\/insights\/smart-forms-multi-step-adaptive-fields-conversion-guide\/\">multi-step form design<\/a> rather than a reason to adopt it.<\/p>\n<h2>When the volume suddenly jumps<\/h2>\n<p>Spam rarely arrives at a steady rate. It arrives in step changes, and the step usually has a cause worth identifying rather than absorbing.<\/p>\n<ul>\n<li><strong>A new form went live without protection.<\/strong> The most common explanation, and the easiest to check: compare the date the volume changed against the deployment log.<\/li>\n<li><strong>The address was published somewhere.<\/strong> A team member listed the form address in a directory, or it appeared in a plugin&#8217;s public output. Once harvested, it circulates indefinitely.<\/li>\n<li><strong>The site was added to a target list.<\/strong> Sites running a widely used form plugin at a default configuration get swept in bulk. Nothing personal, and nothing that will stop on its own.<\/li>\n<li><strong>Someone disabled a check.<\/strong> A plugin update reset a setting, or a well-meaning colleague turned off a filter because a genuine enquiry was blocked once. This is more common than any of the above.<\/li>\n<\/ul>\n<p>Establish which before adding defences, because the answer changes the response. A configuration reset is fixed in a minute; being on a target list means the invisible measures need to be genuinely in place rather than nominally.<\/p>\n<h2>The forms you have forgotten about<\/h2>\n<p>Attention goes to the contact form. The submissions that cause the most trouble frequently arrive somewhere else, and each of these exists on a typical site whether anyone uses it or not.<\/p>\n<p><strong>Comments<\/strong> on posts, often left enabled on a site with no commenting strategy, which turns the blog into a link farm nobody reads. If comments are not part of the plan, disable them rather than moderating them forever.<\/p>\n<p><strong>User registration,<\/strong> which on many WordPress installations is switched on by default and produces accounts whose only purpose is a profile link. If customers do not need accounts, it should be off.<\/p>\n<p><strong>Newsletter signup,<\/strong> where fake addresses damage something more expensive than time: repeated hard bounces harm sender reputation, which is exactly the mechanism described in <a href=\"https:\/\/dextora.agency\/en\/insights\/email-deliverability-spf-dkim-dmarc-what-they-are-worth\/\">what authentication is worth<\/a>. Double opt-in solves this and is a legal preference in Europe anyway.<\/p>\n<p><strong>Product reviews and search,<\/strong> both of which accept public input and both of which are routinely left unprotected because they are not thought of as forms at all.<\/p>\n<h2>What to measure, including the invisible half<\/h2>\n<p>Three numbers, tracked before and after any change.<\/p>\n<p><strong>Spam rate:<\/strong> the share of submissions that are junk. Easy, and the only one most teams have.<\/p>\n<p><strong>Form completion rate:<\/strong> submissions divided by people who started filling in the form. This is where an anti-spam measure shows its real cost, and a drop here after installing a challenge is the finding that matters.<\/p>\n<p><strong>False positives:<\/strong> genuine enquiries wrongly rejected. Hard to see by definition, which is why it needs a deliberate check: once a month, look at what the filter blocked rather than only at what it let through. Businesses that do this routinely find real customers in there.<\/p>\n<h2>Dealing with what gets through<\/h2>\n<p>Some spam always arrives, and the response is process rather than technology.<\/p>\n<ul>\n<li><strong>Never reply to confirm the address is live.<\/strong> Automated replies to spam are how a form becomes a permanent target.<\/li>\n<li><strong>Do not publish the address the form sends to.<\/strong> A separate, unpublished inbox for form submissions removes an entire attack surface.<\/li>\n<li><strong>Filter on the receiving side too.<\/strong> Rules in the mailbox catch the human outreach category that no form measure can, and cost nothing.<\/li>\n<li><strong>Keep the submissions out of the site database<\/strong> where you can, or purge them on a schedule. Stored form entries are personal data with a retention obligation, and a spam-filled table is a liability rather than an archive, as covered in <a href=\"https:\/\/dextora.agency\/en\/insights\/personal-data-on-your-website-what-you-can-collect-guide\/\">what you can collect and keep<\/a>.<\/li>\n<\/ul>\n<h2>The short version<\/h2>\n<p>Form spam has three costs and the largest is usually the customers repelled by the defence. Not all of it is automated: a substantial share is sent by humans, and no challenge stops that. In the EU the position on reCAPTCHA shifted in April 2026 when Google moved from controller to processor, which puts responsibility for lawfulness on the site owner, and consent is generally required before the script loads rather than after. Challenges also exclude users with disabilities and conflict with accessibility obligations. Start instead with a honeypot, a timing check, rate limiting and strict server-side validation, all of which are free and invisible, and measure for a month before escalating. Track form completion rate and inspect what the filter blocked, because the spam you stopped is visible and the customer you stopped is not.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Google moved reCAPTCHA from controller to processor in April 2026, shifting responsibility to you. Why challenges are the wrong first move, four free invisible measures, and how to see the customers your filter blocked.<\/p>\n","protected":false},"author":5,"featured_media":8891,"template":"","insight_category":[154],"insight_tag":[190,170,186],"class_list":["post-8900","insight","type-insight","status-publish","has-post-thumbnail","hentry","insight_category-guides","insight_tag-accessibility","insight_tag-conversion","insight_tag-security"],"acf":[],"_links":{"self":[{"href":"https:\/\/dextora.agency\/en\/wp-json\/wp\/v2\/insight\/8900","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/dextora.agency\/en\/wp-json\/wp\/v2\/insight"}],"about":[{"href":"https:\/\/dextora.agency\/en\/wp-json\/wp\/v2\/types\/insight"}],"author":[{"embeddable":true,"href":"https:\/\/dextora.agency\/en\/wp-json\/wp\/v2\/users\/5"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/dextora.agency\/en\/wp-json\/wp\/v2\/media\/8891"}],"wp:attachment":[{"href":"https:\/\/dextora.agency\/en\/wp-json\/wp\/v2\/media?parent=8900"}],"wp:term":[{"taxonomy":"insight_category","embeddable":true,"href":"https:\/\/dextora.agency\/en\/wp-json\/wp\/v2\/insight_category?post=8900"},{"taxonomy":"insight_tag","embeddable":true,"href":"https:\/\/dextora.agency\/en\/wp-json\/wp\/v2\/insight_tag?post=8900"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}