Fighting form spam is a permanent part of running a website, and the annoying part is that the blunt tools punish genuine visitors. Captchas that demand puzzle-solving cost enquiries. Here is the layered approach I use instead.
Invisible checks catch most of it
A honeypot field that humans never see, time-based checks that reject instant submissions, and server-side validation together silently discard the vast majority of automated spam. Real visitors never notice any of it, which is exactly the point.
The best spam filter is the one your visitors never notice.
Rate limits and alerts finish the job
For the persistent remainder, rate limiting per address and quiet notifications when patterns spike keep things manageable. The goal is a form the owner never thinks about: genuine messages arrive, everything else disappears.
