Anti-Spam Protection — Honeypot + reCAPTCHA
Spam is the tax every form owner pays. Fillin Forge’s anti-spam system is built in layers so you can block common automated spam without adding a visible CAPTCHA that hurts user experience. For harder cases, optional Google reCAPTCHA v3 runs invisibly in the background.
The four layers
1. Honeypot
A honeypot is a hidden form field that humans never see (because it’s hidden with CSS) but bots fill in automatically because they see it in the HTML. Fillin Forge adds a honeypot to every form by default and rejects any submission where the honeypot is filled.
This alone stops simple bots without impacting legitimate users.
Pros: Invisible to visitors, no third-party service.
Cons: Sophisticated bots can learn to skip honeypot fields.
2. Time check
The time check records a timestamp when the form is rendered and rejects any submission that arrives in under 2 seconds.
This catches bots that bypass the honeypot and speeds through the form.
Pros: Invisible to users, catches fast bots.
Cons: Can occasionally produce false positives if a user pastes pre-filled data.
3. Token validation
Every form Fillin Forge renders includes a signed token that’s tied to the form ID and a timestamp. The token is validated server-side on submission. Forged tokens, tokens older than 6 hours, and tokens from other forms are all rejected.
This stops scripts that post straight to your form without loading it first.
Pros: Nearly invisible, no third-party service.
Cons: None for normal use.
4. Google reCAPTCHA v3 (optional)
reCAPTCHA v3 is Google’s invisible anti-spam service. Unlike the old “click the fire hydrants” CAPTCHA, v3 runs in the background and returns a confidence score (0.0 to 1.0) indicating how likely the user is to be human. Fillin Forge can reject submissions below a configurable threshold (default: 0.5).
Pros: Runs in the background; visitors see no challenge.
Cons: Requires a Google account, sends data to Google, occasionally false-flags real users.
Enable it by adding your site key and secret key in settings. The keys apply to all forms.
What you don’t need anymore
Image CAPTCHAs
“Click all the images with traffic lights.” Visitors have to solve them before they can submit. Fillin Forge’s anti-spam layers run without a challenge for the visitor.
Text-based CAPTCHAs
“Type the letters you see below.” Same problem: visitors have to solve them.
Math problems
“What is 3 + 7?” Blocks basic bots, but real ones solve it. And users find it annoying.
All of these can be replaced by Fillin Forge’s invisible anti-spam.
Settings
The honeypot, the time check, and the token are built in and apply to every form. reCAPTCHA v3 turns on for all forms once you add your keys in settings.
Blocked submissions
When a submission is blocked by anti-spam, Fillin Forge rejects it before anything is saved. Blocked submissions do not appear in the admin, so there is no spam folder to review.
Honeypot vs CAPTCHA vs reCAPTCHA v3
| Honeypot | Text CAPTCHA | reCAPTCHA v2 | reCAPTCHA v3 | |
|---|---|---|---|---|
| Visible to users? | No | Yes | Yes | No |
| Mobile friendly? | Yes | No | Medium | Yes |
| Stops simple bots? | Yes | Medium | Yes | Yes |
| Blocks sophisticated bots? | No | No | Yes | Yes |
| Third-party dependency | No | No | Yes | Yes |
| Privacy friendly | Yes | Yes | No | No |
Fillin Forge’s default configuration (honeypot + time check + token) works against common automated spam without any third-party service. If spam still gets through, enabling reCAPTCHA v3 adds one more layer.
Ready to stop form spam?
All four anti-spam layers are included in every version of Fillin Forge, including the free one.