On this page
Put a form on the internet and it takes roughly five minutes for the first bot to show up. It doesn't want your newsletter. It wants to tell you about a miracle crypto opportunity, in 400 identical responses, at three in the morning.
The classic fix is a captcha: make everyone prove they're human by squinting at blurry photos of bicycles. It works, sort of. It also annoys every real person who fills in your form, and some of them simply give up.
We wanted something better: layers of protection that bots trip over and humans barely notice. This post walks through each layer in HornetForms, what it's good for and when to switch it on.
Layer one: the quiet stuff (always on)#
Every public HornetForms form has three protections built in. You don't have to set anything up, and your respondents won't see any of them.
A honeypot field. Each form has an extra field that's hidden from people but visible to bots that fill in everything they can find. A human leaves it empty because they never see it. A bot happily types into it and gives itself away.
A minimum fill time. Real people need at least a few seconds to read a question and type an answer. Bots often submit a form the instant the page loads. If a submission arrives impossibly fast, HornetForms knows something's off.
Here's a nice detail: when a bot trips the honeypot or the time check, it gets a cheerful "success" message back, and nothing is saved. The bot thinks it won, moves on, and never learns what gave it away. Petty? Maybe a little. Effective? Yes.
Rate limits. HornetForms limits how many submissions can come from one visitor to one form in a short time, and how many a single form accepts overall. This stops someone from flooding a form, whether it's a script or just a very enthusiastic person with a lot of free time.
For most forms, these three layers are all you'll ever need. Contact forms, feedback surveys and event sign-ups usually stay clean with just the quiet stuff.
Layer two: Cloudflare Turnstile (per form)#
Some forms attract more determined bots: a popular giveaway, a public sign-up, anything that rewards automation. For those, you can switch on Cloudflare Turnstile in the form's settings.
Turnstile is Cloudflare's replacement for the traditional captcha. Instead of asking people to identify traffic lights, it runs its checks in the background and shows a small widget on the form. No picture puzzles; at most, someone might be asked to tick a box.
A few things worth knowing:
- It's per form. Turn it on only where you need it. Your quiet little feedback form doesn't have to carry the weight of your busiest sign-up page.
- It's checked on our server. The token from the widget is verified when the form is submitted, not just in the browser.
- It stacks. Turnstile adds to the honeypot, time check and rate limits. It doesn't replace them.
Turnstile is a service by Cloudflare, so the widget talks to Cloudflare when it loads. If you list the services your forms use in your privacy notice, add it there.
Layer three: prove you are who you say you are#
Bots aren't the only problem. Sometimes the "spam" is a real person who mistypes their email or uses a fake one. For that, HornetForms has a few tools that check identity rather than humanity.
Email verification (Pro). You can require respondents to confirm one email question with a 6-digit code. HornetForms emails the code, the respondent types it in, and only then can they submit. Codes expire after 10 minutes and only a few attempts are allowed, so guessing isn't an option. This is great for anything where a working email matters: registrations, applications, account-like flows.
One response per person. Pick a question that identifies someone, like their email, and HornetForms will refuse a second completed response with the same value. The check happens on the server, so it can't be dodged by opening a private window. It ignores capital letters and stray spaces, and compares phone numbers in international format, so "Sam@Example.com " and "sam@example.com" count as the same person. There's also a softer "one per browser" option if you just want to discourage casual repeats.
Password protection. For private forms, set a password. Until someone enters it, they see only the form's title, not your questions. Wrong guesses are rate limited too. Handy for internal surveys, member-only forms or anything you share in a closed group.
Which layers should you use?#
A quick cheat sheet:
| Your form | What we'd switch on |
|---|---|
| Contact or feedback form | The defaults are enough |
| Public sign-up or newsletter form | Defaults + Turnstile, maybe email verification (Pro) |
| Giveaway or contest | Turnstile + email verification (Pro) + one response per person |
| Event registration | Email verification (Pro), so confirmations actually arrive |
| Internal team survey | Password protection |
| Vote or poll | One response per person, plus Turnstile if it's public |
The general rule: start with the defaults and add a layer only when you see a problem, or when the form is obviously a bot magnet. Every layer you add asks a little more of your respondents. Email verification (Pro) means a trip to their inbox; a password means they need to know it. Worth it when it matters, overkill when it doesn't.
Respecting privacy while you're at it#
Spam protection is often where privacy quietly goes out the window. We tried to be careful here.
- The honeypot and time check run on our own server, with no third-party scripts.
- Rate limits use a hashed version of the visitor's network address rather than storing it in plain form.
- Turnstile is opt-in, per form, so you decide when a third party is involved.
- Our form analytics are cookieless and don't store IP addresses, so protecting a form doesn't mean tracking the people who fill it in.
Keep the bees, lose the bots#
The quiet layers are on for every form in HornetForms, and the rest are a switch away. If spam has been bugging you, the features page has the full list, and our post on why we built HornetForms explains why respondents' time matters so much to us. Turnstile, password protection and one response per person are all on the Free plan, which stays free forever (see the pricing page), so sign up for free and switch them on.