Honeypots vs CAPTCHA: Stopping Form Spam Without Annoying Buyers

Every CAPTCHA you add costs you legitimate leads. Stanford research puts the abandonment rate at 3–15% depending on difficulty. Yet most sites still slap reCAPTCHA on every form.

There is a better way.

What is wrong with CAPTCHA

• Friction: even invisible reCAPTCHA loads ~500ms of JS and asks for click confirmations on suspicious sessions
• Privacy: reCAPTCHA sends user behavior to Google
• Accessibility: image puzzles fail screen readers
• Does not work: bot farms solve CAPTCHAs for $0.001 each

The honeypot technique

A honeypot is an invisible form field. Bots fill out every field they find. Humans do not see invisible fields, so they leave them blank.

<input type="text" name="website" tabindex="-1" autocomplete="off"
       style="position:absolute;left:-9999px" />

If website has a value on submit → reject. Silent. Zero friction. Bots never know they failed.

Layer two: timing checks

Bots fill out forms in <500ms. Humans take 2+ seconds. Record the form load time, compare on submit:

if (Date.now() - formLoadedAt < 2000) reject();

Combine the two and you stop >95% of bots with zero impact on humans.

Layer three: domain allow-listing

For embedded widgets, only render and accept submissions from domains you have authorized. Bots scraping your widget script cannot run it from your allow-listed domains.

When to actually use CAPTCHA

• Login forms after N failed attempts
• Password reset forms
• Account creation if you see a sustained attack

Not for: contact forms, newsletter signups, lead capture, calculators.

What we ship by default

Every Next Day Sales Rep — Lead Form, FAQ, Booking, Search — uses honeypot + timing + domain allow-listing. No CAPTCHA. No friction. We track rejection counts so you can see how much spam was filtered.