GUIDE

How to stop form spam

Form spam is a numbers game for bots. They crawl the web, find your form's endpoint, and POST junk to it around the clock, filling your inbox with phishing links and fake leads. The good news: you can stop most of it with a few layers that cost your real visitors nothing. This guide walks through the techniques that actually work, then shows how Formstork applies them for you.

Why forms are a magnet for spam bots

Public forms don't get spam because a human found them. Automated bots crawl the web looking for form endpoints, then POST fake leads, phishing links, and SEO garbage to them nonstop. They hit your endpoint directly, so a visible form and a submit button are all they need.

Add a honeypot field

A honeypot is a hidden field that real users never see and never fill. Bots fill every field they find, so if the honeypot comes back with a value, you can safely reject the submission. It is invisible, adds zero friction, and catches most low-effort bots.

Filter content on the server

Client-side checks are useless against bots because they skip your JavaScript and POST straight to your endpoint. Real filtering happens on the server: block known spam phrases, suspicious link patterns, and disposable email domains before a submission ever reaches you.

Add a CAPTCHA only when needed

A CAPTCHA (Turnstile, hCaptcha, or reCAPTCHA) asks the visitor to prove they are human. It is effective but adds friction, so treat it as a second layer rather than your first defense. Managed or invisible modes keep most real users from ever seeing a challenge.

How Formstork stops spam for you

Formstork layers these defenses by default. Every form gets a built-in honeypot and a server-side content filter, with optional Turnstile, hCaptcha, or reCAPTCHA when you want a challenge. A rules engine lets you block or flag submissions by field value, and Pro adds an allowed-domains list. Flagged spam is kept separate in your dashboard, so real submissions stay clean while you can still review anything caught by mistake.

html

<form action="https://api.formstork.com/submit" method="POST">
  <input type="hidden" name="access_key" value="YOUR_ACCESS_KEY">

  <input type="email" name="email" required>
  <textarea name="message" required></textarea>

  <!-- Honeypot: hidden from people, tempting to bots -->
  <input type="text" name="company_website" tabindex="-1" autocomplete="off"
         aria-hidden="true" style="position:absolute; left:-9999px">

  <button type="submit">Send</button>
</form>

Frequently asked questions

Do I still need a CAPTCHA if I use a honeypot?

A honeypot stops most low-effort bots with zero friction, so start there. Add a CAPTCHA only if determined bots still get through, since it adds friction for real visitors. With Formstork you can run the honeypot alone and turn on a CAPTCHA later if you need it.

Will spam protection block real submissions?

Well-tuned layers rarely block humans: honeypots are invisible, content filters target patterns rather than people, and managed CAPTCHA modes are usually silent. Formstork keeps flagged spam in a separate view, so you can quickly spot and recover any false positive.

Why doesn't client-side validation stop spam?

Bots POST directly to your form endpoint and skip your JavaScript entirely, so any browser-side check never runs for them. Effective spam protection has to happen on the server, which is exactly where Formstork runs its honeypot, content filter, and rules.

Try Formstork free

250 submissions a month with a full dashboard. No credit card required.

Get your access key Read the docs