Spam
Keeping bots and junk out of a form without punishing real visitors: honeypots, captchas, Akismet and rate limits.
5 articles
-
Math CAPTCHA: How It Works and When You Should Avoid It
A math CAPTCHA asks a visitor to solve an arithmetic question. See examples, what it stops, and the accessibility limits that make it a poor default.
Read → -
How to Stop Google Form Spam (5 Fixes, Plus Their Limits)
Google Forms has no CAPTCHA setting. I walk through the 5 fixes that actually cut google form spam — sign-in, validation, unlisted links — and where each fails.
Read → -
What Is a Honeypot Field? Invisible Spam Protection, Explained
A honeypot field catches bots that fill an input hidden from people. Learn the HTML, accessibility checks, server validation and limits.
Read → -
Akismet isn't enough — what to layer
Akismet is the WordPress default for spam. But it's not a complete solution. Here's the four-layer setup I run on production sites.
Read → -
reCAPTCHA v3 vs Turnstile vs hCaptcha
Three captchas, three privacy stories, three setups. After running all three on production sites for a year, here's what holds up.
Read →
Stop reading. Ship a form.
All these notes are from running Core Forms on real client sites.
Use code HALLOWEEN for 35% off either plan. Ends November 2 (IST).