Stop Form Spam Bots — Honeypot + AI Classifier Strategy

<!-- The whole anti-spam strategy, in one form -->
<form action="https://splitforms.com/api/submit" method="POST">
  <input type="hidden" name="access_key" value="YOUR_ACCESS_KEY" />

  <!-- Real fields the user fills out -->
  <input name="name" required />
  <input name="email" type="email" required />
  <textarea name="message" required></textarea>

  <!-- Layer 1: Honeypot. Bots fill it, humans never see it.
       splitforms recognizes 'botcheck' and several other names. -->
  <input type="checkbox"
         name="botcheck"
         style="display:none"
         tabindex="-1"
         autocomplete="off"
         aria-hidden="true" />

  <!-- Layer 2: Time-trap. Submissions in < 3 seconds are flagged.
       (splitforms handles this server-side automatically.) -->

  <button type="submit">Send</button>
</form>

<!--
On the splitforms side:
  Layer 3: AI spam classifier scores every submission.
  Layer 4: Rate limiting per IP and per access key.
  Layer 5: Origin checks against your allowed domains.

Combined, this catches ~95% of automated spam with zero user friction
and zero third-party JavaScript on your page.
-->

Most form spam comes from cheap automated bots that scrape the web for forms and submit garbage to all of them. The bots don't render JavaScript, don't read CSS, and don't follow CAPTCHA puzzles — they parse the HTML, fill every input, and POST. That's the spam profile to defend against, and the defense is cheaper than CAPTCHA.

Layer 1: a honeypot field. Add an `<input>` that's visually hidden via CSS but present in the HTML. Bots that fill every input will fill it; real users won't (they don't see it). splitforms recognizes several common honeypot field names (`botcheck`, `_gotcha`, `hp`, `honey`, `trap`, `do_not_fill`, `leave-blank`, `fax`, `website`, `url`) — any submission where one of these is non-empty gets flagged as spam.

Layer 2: an AI spam classifier on the backend. splitforms runs every submission through a machine-learning model trained on millions of real form submissions. The model catches the spam that gets past the honeypot — modern LLM-written submissions that look human, automated submissions that game the honeypot, and other edge cases.

Together, honeypot + AI classifier catches ~95% of automated spam. No third-party JavaScript, no Google or hCaptcha tracking, no user-facing friction, no accessibility tax. Reach for CAPTCHA only if you're seeing human-driven abuse that the AI classifier misses — which is rare for a contact form.

Honeypot + AI classifier + rate limits. 95% of spam blocked. No CAPTCHA.