Where form spam comes from
You launched a site — and the CRM filled with “submissions”: ads for dubious services, random strings of characters, texts in other languages. These are bots: they automatically look for forms all over the internet and fill them in. The problem is not cosmetic — spam clogs the CRM, distracts managers, distorts your statistics and hurts the deliverability of your emails. So forms need protecting.
The balance: protection vs conversion
The key principle: protection must not get in the way of real customers. An aggressive captcha where you have to pick traffic lights ten times scares off real people and cuts conversion more than it helps. Good protection is invisible to a human and impassable to a bot. Let’s go from the gentlest methods to the tougher ones.
Invisible methods (no friction at all)
- Honeypot (“trap”). A hidden field is added to the form, invisible to a human but visible to a bot. A person will not fill it in, a bot will — and such a submission is cut off. Simple, free, invisible.
- Fill-time check. A human spends seconds to minutes on a form, a bot submits instantly. Submissions that are too fast are rejected.
- Submission limits from one address: a hundred submissions a minute is clearly a bot.
These three methods cut off most primitive bots and do not touch real users at all.
Smart (invisible) captcha
When there are many bots and they are craftier, a new-generation captcha helps — in most cases it requires no action from a person and analyzes behavior in the background:
- Yandex SmartCaptcha — a Russian solution, a good fit for the Russian web and data requirements.
- Google reCAPTCHA v3 — works in the background, scoring “humanness” without images.
- hCaptcha — an alternative with a focus on privacy.
A real person usually passes unnoticed, while a suspicious one is shown a check. This is the golden mean between protection and convenience.
Classic captcha — a last resort
“Select all the buses” images and typing distorted text are the last line of defense. Use it only if gentler methods have failed, because it noticeably lowers conversion and annoys people. Often it is wiser to show it not to everyone but only when there are signs of suspicious activity.
Additional techniques
- Confirmation via messenger/SMS for critical forms — cuts off bots and verifies the contact at the same time.
- Moderation of the first enquiries when the flow is small — spam is quickly spotted by eye.
- Content filters: links in the name field, Cyrillic mixed with hieroglyphs — markers of spam.
Don’t forget about overall security
Protecting forms is part of general site hygiene alongside HTTPS, updates and access control, which we wrote about in the security checklist. Form spam is rarely dangerous by itself, but it often accompanies attempts to find vulnerabilities, so it is worth closing along with the other holes.
Related articles
Conclusion
Form spam is treated incrementally: first invisible honeypots and a fill-time check, then a smart captcha (SmartCaptcha, reCAPTCHA v3), and only as a last resort — classic images. The main rule is that protection must not get in the way of real customers. We will set up form protection without hurting conversion — get in touch.
