How to stop contact form spam
Honeypots, rate limits, a challenge, a content classifier and a review queue: which spam each layer stops, and which it lets through.
Last updated
Why spam gets past your CAPTCHA
Much of the spam that still arrives was typed by a person. A test for humans cannot stop it, and reading the message can.
Last updated
What is a proof-of-work CAPTCHA?
The browser does a small computation instead of the visitor solving a puzzle. How it works, what it costs, and what it does not stop.
Last updated
What is an invisible CAPTCHA?
Risk scores, browser challenges and proof of work all call themselves invisible. What each one does, and what invisible means for accessibility.
Last updated
Honeypot fields: how they work and where they fail
A hidden field that only bots fill in. How to build one that people and password managers leave alone, and which bots walk past it.
Last updated
reCAPTCHA and the GDPR: what EU regulators decided
The French CNIL and an Austrian court both found that reCAPTCHA needed consent. What they decided, and the questions it leaves for a form.
Last updated