Spam
Keeping bots and junk out of a form without punishing real visitors: honeypots, captchas, Akismet and rate limits.
5 articles
-
Math CAPTCHA: How It Works and When You Should Avoid It
A math CAPTCHA blocks simple bots with an arithmetic question, but it creates accessibility and security limits. See when it works and what to use instead.
Read → -
How to Stop Google Form Spam (5 Fixes, Plus Their Limits)
Google Forms has no CAPTCHA setting. I walk through the 5 fixes that actually cut google form spam — sign-in, validation, unlisted links — and where each fails.
Read → -
What Is a Honeypot Field? Invisible Spam Protection, Explained
A honeypot field is a hidden input only bots fill in. Here's how it works, how to add one to any form, and where it fails — from 100+ client forms.
Read → -
Akismet isn't enough — what to layer
Akismet is the WordPress default for spam. But it's not a complete solution. Here's the four-layer setup I run on production sites.
Read → -
reCAPTCHA v3 vs Turnstile vs hCaptcha
Three captchas, three privacy stories, three setups. After running all three on production sites for a year, here's what holds up.
Read →
Stop reading. Ship a form.
All these notes are from running Core Forms on real client sites. Use code
CFLAUNCH for 20% off either plan.