Web forms and spam: protecting without driving people away

There are two ways to lose a contact form, and they look nothing alike. The first is noisy: the form isn't protected, automated submissions pile up, and within a few weeks nobody opens the notifications any more. Real enquiries keep arriving. They just die in the heap.

The second is silent. The form is locked down so hard that a prospect gives up in front of a grid of images to click, closes the tab and calls a competitor. In our web services, that's the one that worries us more, because it leaves no trace: nobody writes to tell you they abandoned your form.

So the useful question isn't "how much protection", it's "who pays for it". A good setup makes the bot pay. A bad one hands the bill to your visitor.

The short answer, for the busy

A web form gets lost in two opposite ways. Unprotected, it fills with automated submissions until nobody reads it any more, and real enquiries vanish into the noise. Over-protected, it throws up a visual puzzle that costs the average visitor 32 seconds, according to Cloudflare's own published figures, and that shuts some people with disabilities out entirely: the W3C calls it a denial of service to those users. The approach that works makes the bot pay rather than the visitor, by layering invisible defences: a honeypot field only a program fills in, a timestamp on the form, rate limiting per IP address, server-side validation, and a risk score computed in the background. That last part is what reCAPTCHA (Essentials edition, free up to 10,000 assessments a month) and Cloudflare Turnstile, free and built to meet WCAG 2.2, are for. None of it asks the person writing to you for anything.

Failure one: the inbox nobody opens

An unprotected form always gets found. Not because you were picked, but because programs sweep the web continuously looking for fields to fill, the same way they look for outdated plugins: it's the traffic described in our article on website security for SMBs.

You can survive the volume. The habit is what costs you. When half the notifications are spam, the person receiving them starts skimming. When it's three quarters, they write a filter rule, then stop checking the folder. The form still works technically, and the business has stopped receiving its enquiries.

It gets worse: a form that sends to an address pulled from its own fields becomes a spam relay, and it's your domain that ends up on the blocklists.

Failure two: the puzzle that sorts the wrong people out

The other reflex is to pile on visible protection: image grids, distorted text, a small arithmetic problem. That test has become bad on both sides.

On the bot side, it no longer holds. The W3C, in its "Inaccessibility of CAPTCHA" note updated 16 December 2021, points to a University of Maryland study that hit a 90% success rate breaking Google's audio CAPTCHA using Google's own speech recognition service. Character-based tests are caught in a race they lose: resisting optical character recognition means more distortion, which makes them impractical for humans well before it makes them hard for machines.

On the visitor side, the cost is measurable. Cloudflare published the figure in 2021: 32 seconds on average to complete a challenge. On a contact page that is enormous, never mind the failed attempt you have to redo.

And for a share of your visitors it isn't friction, it's a wall. The W3C is blunt: the very nature of the interactive task inherently excludes many people with disabilities, resulting in a denial of service to those users. Asking someone who is blind or dyslexic to identify characters in a distorted image is asking for precisely the task they are least able to perform. The note adds that a design pattern which expects multiple attempts as a matter of course is arguably inaccessible by design to people living with an anxiety disorder.

WCAG tolerates CAPTCHA, but the exemption is narrow. Success criterion 1.1.1 requires text alternatives that identify the test and describe its purpose, plus alternative forms of CAPTCHA using output modes for different types of sensory perception. So if you put up an image grid, you owe an audio fallback, and that one is broken 90% of the time. You inherit an accessibility obligation without gaining any security.

What stops bots without asking the visitor anything

The layer that works is the one nobody sees. Four mechanisms, stacked, do most of the job.

The honeypot field: a field hidden in CSS, left empty by a human who never sees it, filled in by the program that reads the markup and fills everything. If it has content, the submission goes in the bin with no error message.

The timestamp: record in the form when the page was rendered, and reject submissions that arrive in under two or three seconds. Nobody reads a form and writes a message in two seconds. A script does.

Rate limiting: a cap on submissions per IP address per time window, enforced on the server. It costs nothing and it kills loop-filling.

Server-side validation: never trust what was validated in the browser. A bot doesn't run your JavaScript, it hits your endpoint directly. On the sites we build, every field is revalidated server-side, and the notification email goes to a fixed address set in configuration, never one taken from the form.

None of these four is visible, and none creates an accessibility problem. They take an hour of development once, and they break less often than a third-party service, which matters when you're talking about website maintenance.

The invisible score, and what it costs now

On top of that base sits risk scoring: a third-party service watches browser behaviour and returns a score, and your server decides on it. Nothing is shown to the visitor. That's what we deploy on our clients' forms with reCAPTCHA Enterprise, in score mode, invisible, paired with server-side validation.

Two things are worth knowing before you choose. First, price. At Google, the Essentials edition is free up to 10,000 assessments per calendar month, and that ceiling is counted per organization, aggregated across every account, site and project. Past it, a project without billing gets a quota error; a project with billing moves to the Premium edition, charged an $8 US flat fee from 10,001 to 100,000 assessments, then $1 US per 1,000. Since 22 April 2026, reCAPTCHA is part of the Google Cloud Fraud Defense platform.

Second, a behaviour worth your attention. For older non-Enterprise keys, Google's documentation says a v3 key that exceeds its monthly quota may fail open: verification returns a static score of 0.9 and the message "Over free quota", with no user-visible indication, for the rest of the month. Translation: your filter stops filtering and declares everyone human, silently. Which is exactly why the score has to stay one layer among several, never the only lock.

Turnstile: the other door, free

The serious alternative is Cloudflare Turnstile. The free plan covers up to 20 widgets, with unlimited challenges and verification requests, and 10 hostnames per widget. The widget comes in three forms: managed (it decides whether to show a checkbox based on risk), non-interactive, and invisible.

Three arguments matter for an SMB. Turnstile embeds into any site without routing traffic through Cloudflare's network. Its documentation states that it processes only the data strictly necessary for its security function and does not access, store or transmit form entries or other page inputs, which simplifies the privacy conversation. And Cloudflare advertises WCAG 2.2 compliance on both plans, which is rare in this product category.

A form is a collection of personal information

One last angle, usually forgotten: in Quebec, a contact form is a collection of personal information under the law. Section 5 of the Act respecting the protection of personal information in the private sector is short and unambiguous: any person collecting personal information on another person may collect only the information necessary for the purposes determined before collecting it. Section 4 adds that those purposes are determined before, not after.

In practice, every field has to survive one question: what exactly does it do for answering this enquiry? A mandatory phone number when you reply by email, team size, budget: if you can't name the use, drop the field. You cut friction and risk in the same move, which is the rare case where compliance and conversion pull in the same direction.

Two habits round it out. Scoring services set a cookie: reCAPTCHA installs _GRECAPTCHA, which Google describes as necessary for its risk analysis, and that belongs in your policy. And if you use a third-party service, say so near the submit button, which reCAPTCHA's licence in fact requires when you hide its badge. Our article on Law 25 and your website covers the cookies and forms side.

A well-protected form in 2026 looks like an unprotected one. Three fields, no image grid, no checkbox, and behind it: a honeypot, a timestamp, a rate limit, server-side validation and a score. The visitor writes and sends. The bot doesn't get through.

→ Request an audit of your site

One last note: this is plain-language education about the rules on collecting personal information, meant to help an SMB review its own forms, not legal advice. For a form that collects sensitive information, validate with a legal advisor. The Commission d'accès à l'information and the legislation on LégisQuébec are the references that prevail.