Honeypots catch naive bots with zero user friction. Turnstile and reCAPTCHA add visible or invisible challenges for higher bot pressure. Best practice: honeypot plus rate limits always; add Turnstile or reCAPTCHA when public marketing pages get hammered.
Guide
Contact form spam: honeypot vs Turnstile vs reCAPTCHA
Compare honeypot fields, Cloudflare Turnstile, and Google reCAPTCHA for public contact forms—UX, bot resistance, privacy, and what hosted backends support.
Spam controls compared
| Control | UX cost | Bot resistance |
|---|---|---|
| Honeypot field | None if hidden well | Low–medium |
| Rate limiting | None until blocked | Medium |
| Cloudflare Turnstile | Low–medium | High |
| Google reCAPTCHA v3 | Low (score-based) | High with tuning |
| Google reCAPTCHA v2 checkbox | High | High |
Public contact forms attract bots. Signup spam, SEO pitches, and credential-stuffing scripts do not care that you only wanted five fields. Spam control is not optional on marketing pages—it is part of the form backend’s job alongside validation and storage.
This guide compares honeypot fields, Cloudflare Turnstile, and Google reCAPTCHA so you can choose layers that match your traffic, privacy stance, and UX—whether you use MuxForms, Formspree, or your own API.
Defense in depth (recommended stack)
- Rate limiting at the edge or API (requests per IP per minute).
- Honeypot field hidden from humans, empty on submit.
- Schema validation (max lengths, required fields) to reject garbage fast.
- CAPTCHA (Turnstile or reCAPTCHA) when abuse spikes or on high-value forms.
- CORS allowlists for browser embeds so random sites cannot POST your form id.
- Ingest secret for mobile and server clients instead of public CAPTCHA when possible.
MuxForms supports honeypot, rate limits, optional Turnstile, and per-form CORS—see features and embed docs.
Honeypot fields
A honeypot is an input bots fill but humans never see—often _hp or website positioned off-screen with CSS.
<input type="text" name="_hp" tabindex="-1" autocomplete="off"
style="position:absolute;left:-9999px" aria-hidden="true" />
If the field is non-empty, reject the submission silently or with 400.
| Pros | Cons |
|---|---|
| Zero UX friction | Smart bots skip or auto-fill |
| Easy on static HTML | Accessibility if poorly hidden |
| Works with any backend | Not enough alone on viral pages |
Best for: Low-to-medium traffic B2B contact forms, paired with rate limits.
Cloudflare Turnstile
Turnstile is Cloudflare’s CAPTCHA alternative—widgets range from invisible challenges to click-to-verify.
| Pros | Cons |
|---|---|
| Strong bot signal | Third-party script on your page |
| Often better UX than v2 checkbox | Requires site/secret keys in dashboard |
| Popular with privacy-conscious teams | Another vendor in the chain |
MuxForms: enable Turnstile on the form; embed loads site key from schema GET; failed verification returns 403.
Best for: Marketing sites with rising bot traffic when honeypot alone fails.
Google reCAPTCHA
v2 (“I’m not a robot”) — obvious checkbox, high friction, familiar.
v3 — score-based, invisible-ish, requires tuning thresholds on your server or vendor.
| Pros | Cons |
|---|---|
| Industry standard | Google data processing concerns (GDPR narratives) |
| v3 low friction when tuned | v2 hurts conversion on mobile |
| Formspree and others bundle it | False positives block real users |
Best for: Teams already standardized on Google Cloud; legacy integrations.
Side-by-side summary
| Control | User friction | Bot resistance | Privacy / compliance |
|---|---|---|---|
| Honeypot | None | Low–medium | Best |
| Rate limit | None until blocked | Medium | Best |
| Turnstile | Low–medium | High | Review Cloudflare DPA |
| reCAPTCHA v3 | Low | High with tuning | Review Google terms |
| reCAPTCHA v2 | High | High | Review Google terms |
What hosted backends typically offer
- Formspree: reCAPTCHA, filtering tiers (compare)
- Web3Forms: captcha options (compare)
- MuxForms: honeypot + rate limits + optional Turnstile
- WordPress CF7: plugin maze—why teams move to hosted embed
Mobile and native apps
CAPTCHA in WebViews is painful. Prefer ingest secret authentication on React Native POSTs so only your build can submit—documented in React Native guide and API.
Operational playbook
- Launch with honeypot + rate limits.
- Monitor inbox noise weekly.
- Enable Turnstile if >10% spam or SEO garbage.
- Never hide honeypot with
display:noneonly—usearia-hiddenand off-screen positioning; some bots detecttype=hiddenon wrong fields. - Log 422 and 403 responses during tests—see CORS and 403 guide.
FAQ pointers
- Accidentally blocking users? Disable CAPTCHA temporarily and check false positives.
- EU visitors? Document processors in your privacy policy (privacy).
- Need definitional context? What is a form backend?
Common questions
- Does MuxForms support Turnstile?
- Yes—optional per form in the dashboard alongside honeypot and rate limits.
- Honeypot alone enough?
- Often for low-traffic B2B sites; add CAPTCHA when spam spikes.
- reCAPTCHA privacy concerns?
- Some teams prefer Turnstile for GDPR narratives—verify your legal stance.
- Mobile apps?
- Use ingest secret auth instead of CAPTCHA on native clients when possible.
Apply this on your stack.
MuxForms is the inbox, embed, and JSON API. Start free, or upgrade to Pro or Team.
Upgrade to Pro