Formstorkdocs
PricingENTRDashboard

Stop form spam without reCAPTCHA

reCAPTCHA works, but it puts a Google badge on your site, adds a tracking script, and sometimes makes real people solve puzzles. You can stop most form spam without it. Formstork layers three defenses, and the first two need no widget at all.

1. Honeypot (invisible, no widget)

Add a hidden field that humans never see and bots almost always fill. Any submission with it filled is dropped silently.

<form action="https://api.formstork.com/submit" method="POST">
  <input type="hidden" name="access_key" value="YOUR_ACCESS_KEY">
  <input type="email" name="email" required>
  <textarea name="message" required></textarea>

  <!-- Honeypot: keep it hidden. Bots fill it, humans do not. -->
  <input type="checkbox" name="botcheck" style="display:none" tabindex="-1" autocomplete="off">

  <button>Send</button>
</form>

This alone removes a large share of automated spam, with zero friction for real visitors and nothing to load.

2. Server-side content filter (automatic)

Every submission runs through Formstork’s spam heuristics before it reaches you. Submissions that score too high are quarantined in your Spam tab and send no email, so your inbox stays clean without you configuring anything. You can tune how aggressive it is per form under Settings, from Loose to Strict.

3. One-click CAPTCHA, only if you need it

If a form is under heavy attack, turn on a modern CAPTCHA that respects your visitors. Formstork supports Cloudflare Turnstile and hCaptcha, both of which are privacy-friendly and usually invisible, no puzzle for most users. Add your keys under Settings, and on hosted forms we render the widget for you.

<!-- Turnstile example on your own HTML form -->
<div class="cf-turnstile" data-sitekey="YOUR_TURNSTILE_SITE_KEY"></div>
<script src="https://challenges.cloudflare.com/turnstile/v0/api.js" async defer></script>

Formstork verifies the token server-side, so a spammer cannot skip it by posting directly to the endpoint.

Which should I use?

  • Most sites: honeypot + the built-in content filter. No widgets, no badge, no tracking.
  • Forms getting targeted: add Turnstile or hCaptcha on top.
  • You do not have to choose reCAPTCHA at all. If you prefer it, it is supported too, but nothing here requires it.

See the full spam protection guide for details, or get your free access key and turn these on.