Stop Form Spam Bots — Honeypot + Server-Side Filter Strategy

<!-- The whole anti-spam strategy, in one form -->
<form action="https://splitforms.com/api/submit" method="POST">
  <input type="hidden" name="access_key" value="YOUR_ACCESS_KEY" />

  <!-- Real fields the user fills out -->
  <input name="name" required />
  <input name="email" type="email" required />
  <textarea name="message" required></textarea>

  <!-- Layer 1: Honeypot. Bots fill it, humans never see it.
       splitforms recognizes 'botcheck' and several other names. -->
  <input type="checkbox"
         name="botcheck"
         style="display:none"
         tabindex="-1"
         autocomplete="off"
         aria-hidden="true" />

  <!-- Layer 2: Time-trap. Submissions in < 3 seconds are flagged.
       (splitforms handles this server-side automatically.) -->

  <button type="submit">Send</button>
</form>

<!--
On the splitforms side:
  Layer 3: Content heuristics flag link-stuffed and boilerplate spam.
  Layer 4: Rate limiting per IP and per access key.
  Layer 5: Origin checks against your allowed domains.

Combined, this catches the vast majority of automated spam with zero
user friction and zero third-party JavaScript on your page.
-->

Most form spam comes from cheap automated bots that scrape the web for forms and submit garbage to all of them. The bots don't render JavaScript, don't read CSS, and don't follow CAPTCHA puzzles — they parse the HTML, fill every input, and POST. That's the spam profile to defend against, and the defense is cheaper than CAPTCHA.

Layer 1: a honeypot field. Add an `<input>` that's visually hidden via CSS but present in the HTML. Bots that fill every input will fill it; real users won't (they don't see it). splitforms recognizes several common honeypot field names (`botcheck`, `_gotcha`, `hp`, `honey`, `trap`, `do_not_fill`, `leave-blank`, `fax`, `website`, `url`) — any submission where one of these is non-empty gets flagged as spam.

Layer 2: server-side filtering on the backend. splitforms runs rule-based checks on every submission: a time-trap (a form completed faster than a human can type gets flagged), per-IP and per-access-key rate limits, origin checks against your allowed domains, and content heuristics that catch link-stuffed and boilerplate spam the honeypot misses.

Together, honeypot + server-side filtering catches the vast majority of automated spam. No third-party JavaScript, no Google or hCaptcha tracking, no user-facing friction, no accessibility tax. Reach for CAPTCHA only if you're seeing human-driven abuse that the filters miss — which is rare for a contact form. The spam-free contact form page ships this exact setup as a copy-paste snippet.

Honeypot + time-trap + rate limits + content heuristics. No CAPTCHA.