Layers of protection
- Honeypot fieldA hidden field that only bots fill in.
- Server checksReject bad emails, phone numbers and links.
- Background checkA tool like Turnstile tests the visitor invisibly.
- Rate limitsBlock floods of submissions from one source.
Each layer catches different bots. Together they stop nearly all spam without bothering real people.
Why invisible beats puzzles
Picture puzzles and distorted text slow people down and frustrate them on phones. Some visitors with disabilities cannot solve them at all. WCAG 2.2 treats puzzle tests during sign-in as a barrier unless there is an alternative.
Modern tools avoid the puzzle. Cloudflare says Turnstile runs small background checks and avoids showing a visual puzzle in most cases. It works on any website, without routing traffic through Cloudflare. Google's reCAPTCHA v3 also runs without a challenge and returns a score for each visit.
What spam costs you
- Real leads buried under junk in your inbox
- Sales staff wasting time on fake requests
- CRM records full of bots
- Ad platforms learning from fake conversions
That last one matters if you run ads. When spam submissions count as conversions, Google and Meta optimize toward the wrong people.
Good example. A plumber's form uses a honeypot, checks for a valid U.S. phone number and runs Turnstile in the background. Spam drops to near zero, and customers never see a puzzle.
Bad example. The same plumber adds a hard image puzzle. Spam drops, but so do real requests from customers on phones.
Our forms use a honeypot, server checks and Cloudflare Turnstile, and they send clean leads straight to your CRM. Our web design team sets this up on every form we build.