Stop Spam Form Submissions: Honeypots, Rate Limits, Turnstile and reCAPTCHA

If your website has a contact or booking form, you've probably seen it: enquiries full of links, gibberish names, Russian text, crypto offers or "SEO services" pitches. Spam bots scan the web for forms and submit them automatically. A few a day is annoying; hundreds can bury real customer enquiries, fill your database and even get your email server flagged.

The good news is that most form spam can be stopped with layers of simple, mostly invisible protection.

Layer 1: Honeypot field

A honeypot is a hidden field that humans never see but bots fill in automatically. If it has a value, the submission is rejected.

<div style="position:absolute;left:-9999px" aria-hidden="true">
  <label>Website <input type="text" name="website" tabindex="-1" autocomplete="off"></label>
</div>

if (!empty($_POST['website'])) {
    http_response_code(200);   // pretend success, quietly discard
    exit;
}

Use a plausible field name and hide it with CSS rather than type="hidden". Many simple bots are caught by this alone.

Layer 2: Time check

Humans take several seconds to fill a form; bots submit instantly. Store the time the form was shown (for example in the session) and reject submissions made in under 3 seconds.

Layer 3: Rate limiting

Limit how many submissions one IP address can make — for example 5 in 10 minutes. This stops floods and repeated attempts. On shared hosting, you can track counts in a small database table or temporary files. If you use Cloudflare, its rate-limiting rules can do this at the edge.

Layer 4: Server-side validation

• Check required fields aren't empty and have sensible lengths.
• Validate phone numbers (for Indian mobiles, 10 digits starting with 6–9, optionally with +91).
• Validate email format with filter_var($email, FILTER_VALIDATE_EMAIL).
• Reject names containing URLs.
• Limit the number of links allowed in the message.

Client-side (JavaScript) validation improves user experience, but bots skip it. Always validate on the server.

Layer 5: Invisible challenge (Turnstile or reCAPTCHA)

For persistent spam, add a challenge service:

Whichever you use, verify the token on the server by calling the provider's verification API. Only adding the widget on the page is not protection.

Layer 6: Safe handling of what gets through

• Escape output with htmlspecialchars() when showing enquiries in admin panels or emails, to prevent script injection.
• Use prepared statements for database inserts. See PHP security basics.
• Never put user input into email headers (From, CC) without cleaning it — this can be abused for header injection.
• Send notification emails through authenticated SMTP so they don't land in spam.

What not to do

• Hard image puzzles that block real customers, especially older users on phones.
• Blocking entire countries if you have international customers (for example NRI families booking taxis).
• Relying on "secret" form URLs — bots find them.
• Deleting suspected spam without review at first; check a few to make sure real leads aren't being caught.

Monitor what gets blocked

For the first few weeks after adding protection, log rejected submissions with the reason (honeypot, too fast, rate limit, failed challenge). Review a sample each week. If a real customer was blocked, loosen the rule that caught them. This small habit keeps protection strong without silently losing genuine leads.

Frequently Asked Questions

Why do bots target small business websites?

Automated tools try every form they find to post links or test vulnerabilities. It's not personal.

Does a honeypot affect accessibility?

Not if it's hidden properly with aria-hidden and removed from tab order, so screen readers and keyboard users skip it.

Can spam submissions harm my website?

They can if inputs aren't validated and escaped. With proper handling, they're mostly a nuisance.

Why am I getting real-looking spam from humans?

Some spam is sent manually by people selling services. Rate limits and quick filtering rules help; no system blocks it completely.

Protect your enquiry forms

Joboo Web builds secure forms that save every lead to a database. See contact form fixes, web development or contact us.