What actually works.
HONEYPOT FIELDS
A hidden field humans do not see and automated scripts fill.
Submissions with it filled are rejected.
Invisible to visitors, effective against simple bots, free.
Enable this first.
TIME CHECKS
Rejecting submissions completed impossibly fast.
Bots submit instantly; humans take time.
CAPTCHA
Requires proving you are human.
Effective, and it costs some legitimate submissions and adds a third-party script.
INVISIBLE CAPTCHA
Scores behaviour without requiring interaction.
Better for conversion than a visible challenge.
KEYWORD AND LINK FILTERING
Rejecting submissions containing certain terms or too many links.
Effective, and check what it blocks. Legitimate enquiries sometimes contain links.
BLOCKING BY COUNTRY OR ADDRESS
Blunt. Blocks legitimate visitors too.
WHAT TO START WITH
Honeypot and a time check. Frequently sufficient.
Add CAPTCHA only if spam persists.
