How to stop form spam and fake sign-ups without losing customers
Updated:
Quick answer
Stop form spam with layers, not one big wall: validate on the server, add a low-friction bot check such as proof-of-work, rate-limit by IP and account, and watch your conversion rate. Avoid puzzles on forms that real customers must complete, because every extra step costs sign-ups.
What bots do to your forms
- Spam through contact and comment forms that fills inboxes and damages trust.
- Fake sign-ups that distort your user numbers and cost money in emails and trial resources.
- Credential stuffing, where stolen passwords are tried against your login at scale.
- Scraping and card testing on checkout and payment forms.
A layered defence
- Validate on the server. Never trust the browser: check every field, length and format yourself.
- Add a low-friction bot check. A proof-of-work or invisible check on each abused form.
- Rate-limit. Cap attempts per IP, per account and per email address in a time window.
- Verify email addresses on sign-up before you grant access or send further messages.
- Use a honeypot field as a free extra signal that costs real users nothing.
- Monitor. Track submissions, blocked requests and the sign-up completion rate.
What to avoid
| Mistake | Why it hurts | Better |
|---|---|---|
| A hard image puzzle on every form | Real visitors give up, and people with disabilities are locked out. | A check the visitor does not have to solve. |
| Client-side checks only | Bots skip the browser and post directly. | Verify the token on your server. |
| No monitoring | You cannot tell whether protection blocks customers. | Compare completion rate before and after. |
| Collecting more data than needed | Creates GDPR duties and consent questions. | Use a service that sets no cookies and is hosted in the EU. |
Set it up with BurgCaptcha
Request a demo, add the widget script to the form and verify the token on your server. The API answers in the reCAPTCHA response format, so if you already use reCAPTCHA you change a script URL, a site key and a secret.
The free plan covers 1,000 requests a month, commercial sites included.
Frequently asked questions
How do I stop spam on a contact form?
Validate input on the server, add a low-friction bot check, rate-limit submissions and add a honeypot field. Monitor how many real messages get through.
Will a CAPTCHA reduce my conversion rate?
Puzzles can. A check the visitor never notices adds no step, so it should not. Measure completion rate before and after you change anything.
Do I still need rate limiting with a CAPTCHA?
Yes, for login, password reset and other sensitive endpoints. The two measures complement each other.