Spam Protection Without Making Customers Solve a Puzzle
Every public form attracts spam eventually. The usual answer is a CAPTCHA, but asking a customer to identify traffic lights before they can ask for a quote has a cost that rarely gets measured.
July 24, 2026
The cost of a puzzle
A CAPTCHA adds friction at the exact moment someone has decided to contact the business. Some people give up. Some can't complete it on an older phone or with a screen reader. The spam it blocks is visible; the customers it blocks are not.
Quieter checks
Most automated spam can be caught without the visitor doing anything. A hidden field that people never see but simple bots fill in is one common check. Another is noticing a form submitted faster than any person could type it. Limiting how many submissions can come from the same source in a short time stops floods.
These checks work best together and on the server, where a bot can't simply skip them.
Validate like you mean it
The server should check every submission as if the browser had never seen it: required fields present, email shaped like an email, message within a sensible length. Front-end checks help people fix mistakes; server checks protect the business.
Don't lose real messages
Spam filtering should fail gently. If a check is unsure, it is often better to flag a message than to discard it, so a real customer isn't quietly dropped.
Watch what gets through
No method is perfect. Looking at what arrives now and then shows whether the checks need adjusting, and keeps the form working for the people it was built for.