Form spam protection for your own site: how well reCAPTCHA, hCaptcha and honeypots actually work

reCAPTCHA v2/v3, hCaptcha and honeypots: what each spam protection option costs users and how well it blocks bots

Form spam protection for your own site: how well reCAPTCHA, hCaptcha and honeypots actually work

Bottom line first: Stricter isn’t better when it comes to form spam protection. A required reCAPTCHA v2 checkbox blocks about 90% of bots, but every extra verification step pushes abandonment up 3% to 10%. On an inquiry form, that scares off more real customers than the spam it blocks. The best-value setup: start with a honeypot field (zero cost to the user, stops low-level bots) + invisible reCAPTCHA v3 scoring (never interrupts anyone, scores every submission) + manual review of low-scoring submissions. The counterintuitive part: the best spam protection is the kind users never notice. If most of your visitors are in Europe, swap v3 for hCaptcha and you can drop one GDPR consent popup.

1. Do the math first: blocking spam and driving customers away are the same thing

People working on form spam protection fall into one extreme: spam is up, so pile on more CAPTCHA. The bots do drop off, but so do real inquiries. Overseas B2B buyers already dislike long forms; make them pick eight traffic lights before they can submit and they’ll likely just close the tab. CAPTCHA strength and form abandonment move together: every verification step the user has to perform costs you conversion.

Here’s the counterintuitive judgment:For most inquiry forms, the conversion you lose to CAPTCHA can outweigh the spam it blocks. Say a B2B site gets 100 submissions a month and 20 are spam. If you block those 20 but knock 10% off your conversion rate, you’ve lost 10 real inquiries and come out behind. The right approach is layered: use zero-cost honeypots and invisible scoring to stop most bots, and only ask a real person to verify when something looks suspicious, instead of putting everyone through it. For how form fields affect conversion, see Inquiry Form Field Design and Conversion Rate.

Solution	What the user does	Blocking effectiveness	Impact on conversion
reCAPTCHA v2 checkbox	Tick “I’m not a robot”	Blocks about 90% of bots	Abandonment up 3% to 5%
reCAPTCHA v2 image challenge	Pick the right images	Blocks about 95%	Abandonment up 5% to 10%
reCAPTCHA v3	Nothing at all	Scores submissions, blocks low scores	Almost no impact
hCaptcha	Occasionally pick images	On par with v2	Better privacy, similar impact
Honeypot	Never notices it	Blocks low-level bots	No impact

2. How each of the four options works and when to use it

The honeypot is the simplest and most elegant approach: hide a field in the form that real people can’t see but bots will fill in. Bots fill every input by default, so if that field gets filled, you know it’s spam — drop it silently, don’t even send the email. The upside is users never notice a thing. The downside is it only stops dumb bots that blindly fill everything; a smarter script that reads the page structure will walk right past it.

reCAPTCHA v3 is Google’s invisible option: it tracks mouse movement, time on page, and browsing patterns in the background, then scores each visit from 0.0 to 1.0. You set a threshold (say 0.5), and submissions below it aren’t rejected outright — they go to a manual review queue. The cost is you have to spend time reviewing those suspicious submissions, and it sends data to Google, so European sites need to handle consent. hCaptcha works like v2 but puts more weight on privacy, keeping data less concentrated in Google’s hands — a good fit for sites with strict GDPR requirements and lots of European visitors. For a full walkthrough of deliverability and reliability, see Inquiry Form Reliability.

Dimension	Honeypot	reCAPTCHA v3	hCaptcha
User Experience	Completely invisible	Completely invisible	Occasional image puzzles
Blocking strength	Weak — only stops dumb bots	Medium — score-based	Strong — human-style verification
Privacy compliance	No external data — cleanest	Sends data to Google — needs consent	More privacy-friendly than Google
Maintenance cost	zero	Requires regularly checking the low-score queue	Low
Best for	Essential baseline	Main site with global visitors	Main site with mostly European visitors

3. How to set it up: a three-layer defense framework

Don’t pick just one — the right approach is to stack three layers. The first layer is always the honeypot: zero cost, zero impact, and it blocks over 60% of dumb bot scans. The second layer is invisible scoring (v3 or hCaptcha’s invisible mode), which scores every submission. The third layer is an image challenge that only appears for low-scoring or unusual submissions, or sends them straight to manual review. That way normal users never notice anything, and only suspicious behavior gets asked to prove it’s human.

Setting the threshold is the key. When v3 first goes live, set the blocking threshold very loose — just observe, don’t actually block — and run it for one to two weeks to see how normal users score. If real users are mostly above 0.6, set your blocking line at 0.4, and only send anything below that to review.Scenario 1: a site that gets 200 submissions a month, 20% of them spam. After adding the honeypot and v3, first set v3 to log only, no blocking. Watch for a week and find that real users all score above 0.5, then route submissions below 0.4 to the spam folder instead of rejecting them outright.Scenario 2: a site where half the visitors are European. Use hCaptcha instead of Google’s option, skip the “we use Google services” consent popup, and make the compliance experience smoother. For how to set up anomaly alerts, see Site monitoring and alerts.

Spam rate	Recommended setup	Need manual review?
Under 10%	Honeypot is enough — no CAPTCHA	No
10% to 30%	Honeypot + v3 invisible scoring	Review the low-score queue once a week
30% to 50%	Add image challenges, trigger only on suspicious activity	Check once a day
Over 50%	Check whether you’re being targeted	Add IP rate limiting

4. Pitfalls: the four most common configuration mistakes

The first pitfall is treating v3 as “install it and you’re done” — set your threshold and never look at the queue again. v3 scores, it doesn’t block, so low scores still get through. If you don’t work the review queue, you might as well not have installed it. The second pitfall is setting the threshold too tight and blocking real users — especially on Asian and Latin American networks, where many people share one IP and scores run systematically low. A blanket cutoff kills real inquiries.

The third pitfall is forgetting mobile and accessibility. Image CAPTCHAs are hard on users with shaky hands and screen readers, which conflicts with the accessibility work you just finished. The fourth pitfall is protecting only the form and not the admin side — bots will also scan your wp-login directly, and that’s a separate problem. The real test is net loss: after each verification change, compare two weeks of real inquiry volume. If it drops more than 5%, you’ve gone too far. For how first response time relates to conversion, see First-response SLA and conversion rate for inquiries.

Common mistake	Consequence	Fix
Install v3 and never check the review queue	Low-score spam lands in your inbox	Review it once a week, every week
Threshold set too tight	Real users on shared IPs get blocked	Start loose, tighten later, watch the distribution
Force image challenges on the first screen	Abandonment rate climbs sharply	Trigger only on suspicious submissions
Watch spam volume but not conversions	The more you block, the fewer people fill out the form	Compare real inquiries after every change
Ignore accessibility	Screen reader users can’t submit	Choose frictionless options first

FAQ

reCAPTCHA v2 or v3: which one should you pick?

For inquiry forms, go with v3 first. v2 makes users tick a box or pick images, and every extra step raises abandonment by 3% to 10%. v3 is completely frictionless: it scores each visit from 0.0 to 1.0 in the background, and all you have to do is send low-score submissions to manual review. The trade-off is that you have to check that queue regularly. If bots hammer your site and v3 can’t hold them off, then consider escalating suspicious submissions to v2 image challenges — not putting everyone through v2.

What is a honeypot, and does it actually work?

A honeypot is a hidden field added to a form that real people can’t see but bots fill in by default. When a bot walks through every input, it fills the field; the backend sees a non-empty value and silently discards the submission as spam. It costs nothing in user experience and raises no privacy issues, and it blocks over 60% of low-level scanning bots. The downside is that it doesn’t work against advanced scripts that read the DOM, so it should be your first layer of spam protection, not your only one — pair it with frictionless scoring.

What makes hCaptcha better than reCAPTCHA?

The main advantage is privacy compliance. reCAPTCHA sends user data to Google, and European sites need an extra consent popup that can stack on top of your cookie banner into two layers of consent, which is a poor experience. hCaptcha collects less data and is more GDPR-friendly, with verification strength on par with v2. If more than half your visitors come from Europe, switching from Google to hCaptcha makes both compliance and experience smoother. If your visitors are mostly global and you don’t care about this issue, staying in the Google ecosystem is less hassle.

What’s a good score threshold for reCAPTCHA v3?

Don’t set it arbitrarily. Observe first, then decide. For the first one to two weeks, set the mode to “log only, don’t block” and watch the score distribution of normal submissions. If your real users are generally above 0.6, set the block line around 0.4, and send anything below 0.4 to manual review instead of rejecting it outright. Scores are systematically lower in regions with many shared IPs, like Asia and Latin America, so the threshold should be loosened accordingly. After setting it, review false positives every two weeks: raise the threshold if real inquiries get blocked, lower it if spam slips through.

Our site doesn’t get much spam. Do we still need a CAPTCHA?

Yes, but a honeypot alone is enough. A honeypot costs nothing and doesn’t affect the experience, so turn it on first. When you find spam submissions are under 10%, you don’t need any CAPTCHA that requires user action, since adding one only lowers conversion. Only when spam climbs to 10% to 30% should you add v3 invisible scoring; above 30%, consider triggering an image challenge for suspicious submissions. The standard is always net loss, not eradicating bots completely.

Will anti-spam measures hurt real customers? How do I tell?

Yes, especially when the threshold is too tight or image challenges are forced. The way to tell is to compare real inquiry volume over two weeks after each adjustment: if normal submissions drop by more than 5%, you’re blocking real people. Remedies include changing blocking to “send to review” instead of “reject outright,” loosening the threshold, and switching European users to hCaptcha. A healthy state is one where real users never notice anything and only suspicious users are asked to prove themselves, rather than treating everyone as a suspect.

Final thoughts

The goal of form anti-spam isn’t “zero spam,” but “keeping spam within a range sales can handle without driving away real customers.” Adding the harshest CAPTCHA for zero spam essentially trades real inquiries for a clean inbox, and that math usually comes out at a loss. Remember the layered approach: honeypot as the base, invisible scoring for judgment, and escalating verification only for suspicious behavior.

Three steps to roll this out. First, turn on a honeypot: it costs nothing and stops low-effort bots. Second, add reCAPTCHA v3 or hCaptcha for invisible scoring, and for the first two weeks just watch the scores without blocking anything. Third, set your threshold based on how real users actually score, send low-scoring submissions to manual review, and every two weeks check whether you’ve mistakenly blocked any genuine inquiries. Your form is the last mile of lead capture, and spam protection is only done right when users never notice it’s there.

One line worth remembering: the best spam protection is the kind users never know exists. Treat everyone like a thief, and you’ll shut out real customers first.