Blog ·
Honeypot vs reCAPTCHA for form spam
Compare honeypots vs reCAPTCHA vs Cloudflare Turnstile for contact form spam: privacy, UX trade-offs, and why FormHeron skips reCAPTCHA entirely.
- spam
- turnstile
reCAPTCHA trained users to click traffic lights. It also ships third-party scripts, privacy baggage, and failure modes that block real people. For many contact forms, a honeypot plus rate limits plus optional Turnstile is enough — and kinder to users.
What honeypots do well
They cost nothing, need no third-party script, and catch dumb bots that POST every field. Implementation quality matters: off-screen text inputs beat type=hidden. FormHeron includes honeypot behaviour on every plan.
Where honeypots fail
Targeted bots that parse CSS and skip honeypots. Human spam farms. When that shows up, add a CAPTCHA — preferably privacy-friendlier than legacy reCAPTCHA.
Why Turnstile instead of reCAPTCHA
- Cloudflare Turnstile is free and often invisible
- You bring your own keys (analytics stay yours)
- Server-side siteverify with fail-closed on bad secrets
- No puzzle UX for most visitors
FormHeron does not offer reCAPTCHA. That is intentional product surface: always honeypot, optional customer Turnstile keys, atomic rate limits. See docs and stop form spam.
Privacy and performance
Every third-party captcha script is a privacy and Core Web Vitals decision. Honeypots add no script. Turnstile is a deliberate trade when bot quality rises. Measure bounce and conversion before and after enabling captcha.
Recommended default stack
- Honeypot off-screen on every form
- Atomic rate limits (in-app, not only CDN)
- Origin allowlist for browser abuse reduction
- Turnstile when you see sophisticated bots
- Spam never spends quota
Decision matrix
- Low traffic brochure site: honeypot + rate limits is usually enough
- Public campaign with scraped keys: add Turnstile immediately
- High trust B2B form: Turnstile + tight origin allowlist + webhook to CRM
- Regulated buyer review: document no raw IPs, retention, DPA — captcha is secondary
Avoid stacking three captcha products “just in case.” Each one hurts conversion. Measure. That stack is what FormHeron runs by default with optional Turnstile. Start free or read features.
FormHeron is a form backend with spam controls, a lead inbox, HMAC webhooks and Slack. Free plan: 250 submissions/month. Leads stored in the EU (Amsterdam); operated from India. No raw IPs.