Website form spam: how honeypots and heuristics stop bots

Every public form on the internet eventually gets found by a spam bot. The bots crawl for <form> elements, fill every field with junk or promotional links, and submit as fast as they can. The goal is usually SEO spam — dumping links into your site in the hope you publish them — or simply testing whether your form is an open relay for mail. Whatever the motive, the result is the same: your inbox fills with garbage and real submissions get buried.

Why captchas are the wrong first move

Captchas (and their modern successors) work by making the human prove they are human, which is exactly backwards: the visitor is the one person you know is human, and they are the one you inconvenience. A checkbox captcha adds friction to every real submission, and the newest 'invisible' versions still load third-party scripts that track visitors across the web. For a contact form, there is a cheaper and friendlier approach: assume the visitor is human and make the bots prove they aren't.

Honeypot fields: the trap that catches bots

A honeypot is a form field that real users never see. You hide it with CSS — off-screen, or inside a visually hidden container — and give it a plausible name like website or company. Humans can't fill it in because they can't see it. Bots, which treat the page as a flat list of inputs and fill everything, type into it happily.

When a submission arrives with the honeypot field non-empty, you know the submitter was a bot — no human filled that hidden field. The submission can be discarded silently, with no error page. A good implementation returns the same success response it would to a human, so the bot never learns the trap exists and keeps submitting into the void.

Adding a honeypot is one hidden field and one server-side check. It is the single highest-value spam defence available because it exploits a difference bots can't easily close: they don't render the page the way humans do.

Heuristics: judging submissions by their content

Not every bot is dumb enough to fill a hidden field. Smarter scrapers render the page, read the layout, and skip fields they detect as traps. For those, content-based heuristics step in — cheap rules applied at submission time that flag behaviour real visitors almost never exhibit:

• Too many URLs: a human contact message rarely contains more than one link; spam frequently contains several. Flag submissions with more than three URLs across their text fields.
• Throwaway email domains: spam tools generate addresses on disposable domains (temporary mail services). A blocklist of known throwaway domains catches many automated signups instantly.
• Submission velocity: one endpoint receiving dozens of submissions per minute is either a busy launch or a bot attack. Rate limiting slows bots down without touching real visitors.

Heuristics are imperfect by nature, which is why they should flag rather than delete: a submission judged likely-spam is stored but marked, so a false positive is one click from recovery, and a false negative is still in your dashboard where you can flag it yourself.

What a good defence looks like in practice

Layered. The honeypot silently removes the bulk of naive bot traffic before it touches your data. Heuristics mark the smarter remainder. Rate limiting absorbs bursts. And everything that survives lands in a dashboard where a human can apply final judgement with one click. No captcha, no third-party script, no friction for the people you actually want to hear from.

FormHook applies exactly this combination to every endpoint: a honeypot field (website) that silently discards bot submissions, heuristic checks that flag suspicious content as spam, and a per-endpoint rate limit. The spam stays out of your count, real submissions stay in, and nothing is ever deleted without you seeing it first.